Clock synchronization method of high-credibility triple safety control system

Abstract

The invention discloses a high-credibility clock synchronization method for a triple safety control system, which comprises the following steps of: S1, enabling each interconnected controller to enter an initialized synchronization state, running according to a self clock in an initialized synchronization state and periodically sending an initial state synchronization declaration frame and an initial state synchronization following frame; s2, each controller receives an initial state synchronization declaration frame and an initial state synchronization following frame sent by an adjacent controller, and when each controller receives the initial state declaration frames of two adjacent controllers, each controller receives the initial state synchronization following frame sent by the adjacent controller; and S3, each controller is switched from an initial synchronization state to a normal synchronization state. According to the method, the reliability of the system is enhanced, online undisturbed replacement of a certain channel is supported, maintenance or replacement can be carried out under the condition that other operating channels are not influenced, and additional interruption control is avoided.

Description

Technical Field

[0001] The present application relates to the field of industrial automation control, and in particular to a clock synchronization method for a high-reliability triple safety control system. Background Art

[0002] In the field of industrial automation control, SIS systems (Safety Instrumented System, English abbreviation (Safety Instrumented System)) are widely used in high-risk industries such as oil, natural gas, chemicals, pharmaceuticals, and power generation. They monitor potentially dangerous process states in real time and take measures to keep them within a safe operating range, thereby ensuring the safety of personnel, assets, and the environment. In order to meet the requirements of the SIL3 safety level, SIS systems usually adopt a multiplexed (multiple independent channels) design, voting on the execution results of each channel as the final control output, ensuring that normal safety functions can be guaranteed in the event of failure of one or several channels.

[0003] In the multiplexed design, each channel uses a clock synchronization mechanism to ensure that the start and end times of its execution are consistent. The higher the synchronization accuracy between channels, the better the real-time responsiveness of the system. The multiplexed system supports online non-disruptive replacement in the event of a channel failure, and the newly replaced channel cannot affect the clock of the channel in normal operation.

[0004] With the popularity of SIS systems, safety control systems have been used in many petrochemical plants. Safety control systems have high requirements for the response time to execute safety functions after a fault occurs on site. If the response time is too long, the fault cannot be isolated in time, and may even cause the fault to spread further. This safety hazard is not accepted by users in high-risk industries.

[0005] Taking the controller in the current mainstream triple control system as an example, there are three independent controllers in the triple control system. Each controller will perform the following processes in each control cycle: collect data from this channel, obtain data collected by other two controllers, vote on the data collected by the three controllers, perform logical calculations on the voted data, output the result data, obtain the data calculated by other two controllers, vote on the result data of the three channels, and output the voted data to the actuator. In the two processes of obtaining the collected data and the calculated result data of the other two controllers, the operating clock of each controller is inconsistent, which may result in the value obtained in the previous cycle. The input value at the current moment will be obtained in the next cycle, which will cause the response time from input to output to be lengthened. In the worst case, the response time will be delayed to 4 times the control cycle. In this case, many application scenarios cannot meet the requirements.

[0006] At present, the conventional solution is to connect to each controller through a hardware connection line, select one controller from multiple controllers as the master clock server, and the controller as the master clock server controls the level signal of this line according to the control cycle. Other controllers monitor the level changes on this line through interrupt reception to achieve the purpose of periodic synchronization. Although this solution has a good synchronization effect, it introduces interrupt control. The fewer interrupt control requirements in the SIS system, the better. At the same time, in the multiplexed system, online replacement of a controller is supported. When a controller needs to be replaced online, the plug-in process will inevitably affect the disturbance of the hardware connection line, which will cause frequent interruptions in other controllers, which will directly affect the safety of the entire system. This risk is unacceptable and needs to be improved. Summary of the invention

[0007] In view of the deficiencies in the prior art, the present application provides a clock synchronization method for a triple safety control system with high reliability, aiming to solve the above problems.

[0008] A clock synchronization method for a high-reliability triple safety control system comprises the following steps: Step S1: When the system is powered on, each interconnected controller enters an initialization synchronization state, runs according to its own clock in the initialization synchronization state and periodically sends an initial state synchronization declaration frame and an initial state synchronization follow-up frame. When sending the initial state synchronization declaration frame, the hardware logic unit of the controller will save the sending time T1, and T1 is sent out together with the initial state follow-up frame; Step S2: Each controller receives the initial state synchronization declaration frame and the initial state synchronization follow frame sent by the adjacent controller. When each controller receives the initial state declaration frames from two adjacent controllers, the hardware logic unit of the controller records the receiving times T2 and T3 respectively. When each controller receives the initial state synchronization follow frame sent by the adjacent controller, the hardware logic unit of the controller records the receiving times T4 and T5 respectively, and selects the appropriate time as its own system time based on the time information through the set time selection logic; Step S3: Each controller switches from the initial synchronization state to the normal synchronization state. In the normal synchronization state, the controller provides a clock synchronization source to the adjacent system and obtains clock data from the adjacent system to update its own clock.

[0009] By adopting the above technical solution, the timestamp is processed by the hardware logic unit, which reduces the uncertainty caused by the software execution time and network delay, and significantly improves the accuracy of time synchronization. The method adopts a redundant design. Even if one or two controllers fail, the third controller can still maintain correct clock synchronization, thereby enhancing the reliability of the system. It also supports online non-disruptive replacement of a channel, which can be maintained or replaced without affecting other running channels, simplifying the initialization process, reducing the risk of configuration errors, and speeding up the system startup. In the normal synchronization state, the controller provides a clock synchronization source to the adjacent system and obtains clock data from the adjacent system to update its own clock, avoiding additional interrupt control, optimizing resource utilization, and ensuring efficient data exchange. In addition, the hardware state machine manages state transitions, ensures accuracy and timeliness, and can ensure overall clock convergence through a reverse synchronization process in the event of a communication failure, thereby increasing the flexibility and robustness of the system. It meets the industry's extremely high requirements for real-time and security, and promotes the stability and consistency of the entire system.

[0010] Optionally, the time selection logic set in step S2 is: When T2≥T4, T3≥T5, if T2-T4≥T3-T5, the system time of this controller is adjusted to T4. The adjustment method is to subtract (T2-T4) from the current system time as the system time; When T2≥T4, T3≥T5, if T2-T4≤T3-T5, the system time of this controller is adjusted to T5. The adjustment method is to subtract (T2-T5) from the current system time as the system time; When T2≥T4, T3≤T5, the system time of this controller is adjusted to T4. The adjustment method is to subtract (T2-T4) from the current system time as the system time; When T2≤T4, T3≥T5, the system time of this controller is adjusted to T5. The adjustment method is to subtract (T2-T5) from the current system time as the system time; When T2≤T4, T3≤T5, the system time of this controller will not be adjusted; each controller executes the above logic at least 3 times.

[0011] By adopting the above technical solution, this set time selection logic significantly improves the synchronization accuracy and overall system performance in the triple safety control system. By comparing the receiving time and the sending timestamp, and selecting the minimum time as the system time according to the predefined rules, this logic effectively reduces the time deviation caused by network delay and hardware differences, ensuring that all controllers can quickly and accurately achieve time synchronization. Each controller executes at least 3 times according to the above logic, which speeds up the synchronization convergence speed of the entire system, while avoiding system oscillation caused by frequent adjustments, and enhancing the stability and reliability of the system. This logic is not only suitable for ideal communication environments, but also can flexibly cope with complex actual working conditions, simplify the system configuration and startup process, and reduce the possibility of errors. By giving priority to earlier time sources, protecting existing time, and flexibly handling mixed situations, it ensures that the time of all controllers is consistent and promotes coordinated operations between multiple controllers.

[0012] Optionally, when the controller is in the initial synchronization state, if it receives a normal state synchronization declaration frame from an adjacent controller, it stops sending initial state declaration frames and initial state follow-up frames to this adjacent controller, and starts receiving the normal synchronization clock of this adjacent controller to complete the system time synchronization process.

[0013] By adopting the above technical solution, the synchronization speed is significantly accelerated, and the time required for the initialization phase is reduced by quickly responding and switching to the normal synchronization state. At the same time, it effectively reduces the network load, avoids unnecessary communication overhead, reduces data traffic in the network, and improves overall communication efficiency. More importantly, this mechanism prevents time conflicts, ensures that all controllers are synchronized based on the latest and accurate time information, and maintains the stability and consistency of the system. In addition, the automated processing of state transition logic simplifies the system management and configuration process, reduces the need for manual intervention, and reduces the risk of operational errors.

[0014] Optionally, step S3 specifically includes the following steps: Step S3.1: Send a normal state synchronization declaration frame to the corresponding communication port of an adjacent controller through the communication port of one controller, and record the sending time M1; Step S3.2: The adjacent controller receives the normal state synchronization declaration frame and saves and records the reception time M2; Step S3.3: The sending controller then sends a normal state synchronization follow frame containing a timestamp M1 to the receiving controller; Step S3.4: After receiving the synchronization follow-up frame, the receiving controller saves the time M1 carried therein, and sends a response frame to the sending controller, and records the time of sending the response frame as M3; Step S3.5: After receiving the response frame, the sending controller records the receiving time as M4, and sends a synchronization completion frame with a timestamp of M4 to the receiving controller; Step S3.6: The receiving controller saves the received time M4, calculates the clock deviation offset and transmission delay delay based on the four precise timestamps M1, M2, M3 and M4, and adjusts its own system time.

[0015] By adopting the above technical solution, the accuracy of clock synchronization is significantly improved through precise timestamp exchange and calculation, ensuring that all controllers achieve highly consistent time synchronization; by recording and exchanging four timestamps, and using this time information to calculate clock deviation and transmission delay, the time error caused by network delay and hardware differences is effectively reduced; the entire synchronization process is efficient and orderly, reducing unnecessary communication overhead, accelerating the transition from initialization to normal synchronization state, and improving the startup efficiency of the system; at the same time, it avoids system oscillations caused by frequent time adjustments, ensuring the consistency and stability of clock synchronization; Automated processing of timestamp recording and synchronization logic reduces the need for manual intervention, reduces the risk of configuration errors, and simplifies system management and maintenance; in addition, by directly handling key tasks such as timestamp generation and parsing through hardware logic, the need for software interrupts is reduced, the CPU load is reduced, and the system efficiency is improved.

[0016] Optionally, the clock deviation offset and transmission delay delay in step S3.6 are calculated as follows: offset = ((M2-M1)-(M4-M3)) / 2; delay=((M2-M1)+(M4-M3)) / 2; When offset+delay=0, the receiving controller does not adjust the system time; When offset+delay>0, the receiving controller does not adjust the system time, and the receiving controller performs a clock synchronization process with the sending controller; When offset+delay<0, the receiving controller adjusts the system time to the current system time minus (offset+delay).

[0017] By adopting the above technical solution and accurately calculating clock deviation and transmission delay, this method can effectively reduce the time error caused by network delay and hardware differences, ensure that all controllers achieve highly consistent time synchronization, and improve the overall accuracy of the system.

[0018] Optionally, each controller has two communication ports, which are set as COM1 and COM2 respectively. The communication ports of each controller are connected end to end. When the controller periodically sends time synchronization to the adjacent controller, the controller's COM2 receives the clock synchronization process of the adjacent controller by default. Only when offset+delay>0, the controller will send a clock synchronization process from COM2 to the adjacent controller.

[0019] By adopting the above technical solutions, the efficiency, stability and resource utilization of the system are significantly improved through clear division of labor of communication ports and conditional clock synchronization process; COM2 receives the clock synchronization information of adjacent controllers by default, ensuring that all controllers can continuously receive the latest time data and maintain high-precision time synchronization, while reducing unnecessary communication traffic and improving the utilization of network bandwidth; strictly controlling the triggering conditions of clock synchronization prevents system oscillation caused by frequent time adjustments, enhances the stability and reliability of the system, and can quickly respond to any potential time inconsistency problems.

[0020] Optionally, when the controller is in a normal synchronization state and receives an initial state synchronization declaration frame from an adjacent controller, the controller acts as a clock source and sends a clock synchronization process to the adjacent controller.

[0021] By adopting the above technical solutions, the response speed and consistency of the system are significantly improved, ensuring that new nodes or controllers after restart can quickly complete time synchronization, reducing the online time and maintaining the clock consistency of the entire system.

[0022] In summary, the present application includes at least one of the following beneficial technical effects: 1. The timestamp is processed by the hardware logic unit, which reduces the uncertainty caused by software execution time and network delay, and significantly improves the accuracy of time synchronization. This method adopts a redundant design. Even if one or two controllers fail, the third controller can still maintain correct clock synchronization, which enhances the reliability of the system. It also supports online non-disruptive replacement of a channel, which can be maintained or replaced without affecting other running channels, simplifying the initialization process, reducing the risk of configuration errors, and speeding up the system startup. In the normal synchronization state, the controller provides a clock synchronization source to the adjacent system and obtains clock data from the adjacent system to update its own clock, avoiding additional interrupt control, optimizing resource utilization, and ensuring efficient data exchange. In addition, the hardware state machine manages state transitions, ensuring accuracy and timeliness, and can ensure overall clock convergence through a reverse synchronization process in the event of a communication failure, increasing the flexibility and robustness of the system. It meets the industry's extremely high requirements for real-time and security, and promotes the stability and consistency of the entire system.

[0023] 2. This set time selection logic significantly improves the synchronization accuracy and overall system performance in the triple safety control system. By comparing the receiving time and the sending timestamp, and selecting the minimum time as the system time according to predefined rules, this logic effectively reduces the time deviation caused by network delays and hardware differences, ensuring that all controllers can quickly and accurately achieve time synchronization. Each controller executes the above logic at least 3 times, which speeds up the synchronization convergence speed of the entire system, while avoiding system oscillations caused by frequent adjustments, and enhancing the stability and reliability of the system. This logic is not only suitable for ideal communication environments, but also can flexibly cope with complex actual working conditions, simplify the system configuration and startup process, and reduce the possibility of errors. By giving priority to earlier time sources, protecting existing time, and flexibly handling mixed situations, it ensures that the time of all controllers is consistent and promotes coordinated operations between multiple controllers.

[0024] 3. Through precise timestamp exchange and calculation, the accuracy of clock synchronization is significantly improved, ensuring that all controllers achieve highly consistent time synchronization; by recording and exchanging four timestamps, and using this time information to calculate clock deviation and transmission delay, the time error caused by network delay and hardware differences is effectively reduced; the entire synchronization process is efficient and orderly, reducing unnecessary communication overhead, accelerating the transition from initialization to normal synchronization state, and improving the startup efficiency of the system; at the same time, it avoids system oscillations caused by frequent time adjustments, ensuring the consistency and stability of clock synchronization; Automated processing of timestamp recording and synchronization logic reduces the need for manual intervention, reduces the risk of configuration errors, and simplifies system management and maintenance; in addition, by directly handling key tasks such as timestamp generation and parsing through hardware logic, the need for software interrupts is reduced, the CPU load is reduced, and the system efficiency is improved.

[0025] 4. Through clear division of labor of communication ports and conditional clock synchronization process, the efficiency, stability and resource utilization of the system are significantly improved; COM2 receives the clock synchronization information of adjacent controllers by default, ensuring that all controllers can continuously receive the latest time data and maintain high-precision time synchronization, while reducing unnecessary communication traffic and improving the utilization of network bandwidth; strictly controlling the triggering conditions of clock synchronization, preventing system oscillation caused by frequent time adjustments, enhancing the stability and reliability of the system, and being able to quickly respond to any potential time inconsistency problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 It is a flowchart of an embodiment of the present application.

[0027] Figure 2 It is a schematic diagram of the connection relationship between various controllers in the embodiment of the present application.

[0028] Figure 3 It is a flow chart of step S3 in the embodiment of the present application.

[0029] Figure 4 It is a schematic diagram of the connection relationship when a fault occurs in the connection between adjacent controllers in an embodiment of the present application. DETAILED DESCRIPTION

[0030] In order to facilitate the understanding of the present application, the present application is described in more detail below in conjunction with the accompanying drawings and specific embodiments. It should be noted that when an element is described as "fixed to" another element, it can be directly on the other element, or there can be one or more centered elements therebetween. When an element is described as "connected to" another element, it can be directly connected to the other element, or there can be one or more centered elements therebetween. The terms "vertical", "horizontal", "left", "right" and similar expressions used in this specification are for illustrative purposes only.

[0031] Unless otherwise defined, all technical and scientific terms used in this specification have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used in the specification of this application are only for the purpose of describing specific embodiments and are not intended to limit this application. The term "and / or" used in this specification includes any and all combinations of one or more of the related listed items.

[0032] The embodiment of the present application discloses a clock synchronization method for a triple safety control system with high reliability. Figure 1 and Figure 2, including the following steps: Step S1: When the system is powered on, each interconnected controller enters the initialization synchronization state, runs according to its own clock in the initialization synchronization state and periodically sends the initial state synchronization declaration frame and the initial state synchronization follow frame. When sending the initial state synchronization declaration frame, the hardware logic unit of the controller will save the sending time T1, and T1 is sent out together with the initial state follow frame; Step S2: Each controller receives the initial state synchronization declaration frame and the initial state synchronization follow frame sent by the adjacent controller. When each controller receives the initial state declaration frame sent by two adjacent controllers, the hardware logic unit of the controller records the receiving time T2 and T3 respectively. When each controller receives the initial state synchronization follow frame sent by the adjacent controller, the hardware logic unit of the controller records the receiving time T4 and T5 respectively, and selects the appropriate time as its own system time based on these time information through the set time selection logic; Step S3: Each controller switches from the initial synchronization state to the normal synchronization state. In the normal synchronization state, the controller provides a clock synchronization source to the adjacent system and obtains clock data from the adjacent system to update its own clock. By processing timestamps through hardware logic units, the uncertainty caused by software execution time and network delays is reduced, and the accuracy of time synchronization is significantly improved. This method adopts a redundant design. Even if one or two controllers fail, the third controller can still maintain correct clock synchronization, thereby enhancing the reliability of the system. It also supports online non-disruptive replacement of a channel, which can be maintained or replaced without affecting other running channels, simplifying the initialization process, reducing the risk of configuration errors, and speeding up system startup. In the normal synchronization state, the controller provides a clock synchronization source to the adjacent system and obtains clock data from the adjacent system to update its own clock, avoiding additional interrupt control, optimizing resource utilization, and ensuring efficient data exchange. In addition, the hardware state machine manages state transitions, ensuring accuracy and timeliness, and can ensure overall clock convergence through a reverse synchronization process in the event of a communication failure, thereby increasing the flexibility and robustness of the system. It meets the industry's extremely high requirements for real-time and security, and promotes the stability and consistency of the entire system.

[0033] Reference Figure 1 and Figure 2The time selection logic set in step S2 is: when T2 ≥ T4, T3 ≥ T5, if T2-T4 ≥ T3-T5, the system time of this controller is adjusted to T4, and the adjustment method is to subtract (T2-T4) from the current system time as the system time; when T2 ≥ T4, T3 ≥ T5, if T2-T4 ≤ T3-T5, the system time of this controller is adjusted to T5, and the adjustment method is to subtract (T2-T5) from the current system time as the system time; when T2 ≥ T4, T3 ≥ T5, if T2-T4 ≤ T3-T5, the system time of this controller is adjusted to T5, and the adjustment method is to subtract (T2-T5) from the current system time as the system time; When T2≤T4 and T3≥T5, the system time of this controller is adjusted to T4. The adjustment method is to subtract (T2-T4) from the current system time as the system time. When T2≤T4 and T3≥T5, the system time of this controller is adjusted to T5. The adjustment method is to subtract (T2-T5) from the current system time as the system time. When T2≤T4 and T3≤T5, the system time of this controller is not adjusted. Each controller executes the above logic three times, and the time of all controllers is consistent with the controller with the smallest system time. This set time selection logic significantly improves the synchronization accuracy and overall system performance in the triple safety control system. By comparing the receiving time and sending timestamp, and selecting the minimum time as the system time according to predefined rules, this logic effectively reduces the time deviation caused by network delay and hardware differences, ensuring that all controllers can quickly and accurately achieve time synchronization, speeding up the synchronization convergence of the entire system, while avoiding system oscillation caused by frequent adjustments, and enhancing the stability and reliability of the system. This logic is not only suitable for ideal communication environments, but also can flexibly cope with complex actual working conditions, simplifying the system configuration and startup process, and reducing the possibility of errors. By giving priority to earlier time sources, protecting existing time, and flexibly handling mixed situations, it ensures that the time of all controllers is consistent and promotes coordinated operations between multiple controllers.

[0034] When the controller is in the initial synchronization state, if it receives the normal state synchronization declaration frame from the adjacent controller, it stops sending the initial state declaration frame and the initial state follow-up frame to this adjacent controller, and starts receiving the normal synchronization clock of this adjacent controller to complete the synchronization process of the system time. The synchronization speed is significantly accelerated, and the time required for the initialization phase is reduced by quickly responding and switching to the normal synchronization state; at the same time, it effectively reduces the network load, avoids unnecessary communication overhead, reduces the data traffic in the network, and improves the overall communication efficiency; more importantly, this mechanism prevents time conflicts, ensures that all controllers are synchronized based on the latest and accurate time information, and maintains the stability and consistency of the system; in addition, the automated processing of state transition logic simplifies the management and configuration process of the system, reduces the need for manual intervention, and reduces the risk of operational errors.

[0035] Reference Figure 1 , Figure 2 and Figure 3 , Assume that there are three controllers, controller A, controller B and controller C. Each controller has two communication ports, which are set as COM1 and COM2 respectively. The communication ports of each controller are connected end to end. When the controller is in the normal synchronization state and receives the initial state synchronization declaration frame from the adjacent controller, the controller acts as a clock source to send the clock synchronization process to the adjacent controller.

[0036] Reference Figure 1 , Figure 2 and Figure 3 , step S3 specifically includes the following steps: step S3.1: sending a normal state synchronization declaration frame to the corresponding communication port of an adjacent controller through a communication port of a controller, and recording the sending time M1; step S3.2: the adjacent controller receives the normal state synchronization declaration frame and saves the recorded receiving time M2; step S3.3: the sending controller then sends a normal state synchronization follow-up frame containing a timestamp M1 to the receiving controller; step S3.4: after receiving the synchronization follow-up frame, the receiving controller saves the time M1 carried therein, and the receiving controller sends a response frame to the sending controller, and records the time of sending the response frame as M3; step S3.5: after receiving the response frame, the sending controller records the receiving time as M4, and sends a synchronization completion frame with a timestamp M4 to the receiving controller; step S3.6: the receiving controller saves the received time M4, calculates the clock deviation offset and transmission delay delay based on the four precise timestamps M1, M2, M3 and M4, and adjusts its own system time. Through precise timestamp exchange and calculation, the accuracy of clock synchronization is significantly improved, ensuring that all controllers achieve highly consistent time synchronization; by recording and exchanging four timestamps, and using this time information to calculate clock deviation and transmission delay, the time error caused by network delay and hardware differences is effectively reduced; the entire synchronization process is efficient and orderly, reducing unnecessary communication overhead, accelerating the transition from initialization to normal synchronization state, and improving the startup efficiency of the system; at the same time, it avoids system oscillations caused by frequent time adjustments, ensuring the consistency and stability of clock synchronization; Automated processing of timestamp recording and synchronization logic reduces the need for manual intervention, reduces the risk of configuration errors, and simplifies system management and maintenance; in addition, by directly handling key tasks such as timestamp generation and parsing through hardware logic, the need for software interrupts is reduced, the CPU load is reduced, and the system efficiency is improved. The clock deviation offset and transmission delay delay in step S3.6 are calculated as follows: offset = ((M2-M1)-(M4-M3)) / 2; delay=((M2-M1)+(M4-M3)) / 2; When offset+delay=0, the receiving controller does not adjust the system time; When offset+delay>0, the receiving controller does not adjust the system time, and the receiving controller performs a clock synchronization process with the sending controller; When offset+delay<0, the receiving controller adjusts the system time to the current system time minus (offset+delay). By accurately calculating the clock deviation and transmission delay, this method can effectively reduce the time error caused by network delay and hardware differences, ensure that all controllers achieve highly consistent time synchronization, and improve the overall accuracy of the system. When the controller periodically sends time synchronization to the adjacent controller, the controller's COM2 receives the clock synchronization process of the adjacent controller by default. Only when offset+delay>0, the controller will send a clock synchronization process from COM2 to the adjacent controller.

[0037] Reference Figure 1 , Figure 2 and Figure 3 , take the clock synchronization process of COM1 of controller A to COM2 of controller B as an example. First, COM1 of controller A sends a normal state synchronization declaration frame to COM2 of controller B, and the hardware logic unit saves the time of sending the declaration frame as M1. After controller B receives the normal synchronization declaration frame from controller A, the hardware logic unit saves the received time M2. Controller A sends a normal state synchronization follow frame with a timestamp M1 to controller B. After controller B receives the normal state synchronization follow frame, it saves the time M1 carried in the data frame. After receiving the normal state synchronization follow frame, controller B sends a response frame to controller A, and the hardware logic unit saves the time M3 of sending the response frame. After controller A receives the response frame, the hardware logic unit saves the received time as M4, and sends a synchronization completion frame with a timestamp of M4 to controller B. After controller A receives the synchronization completion frame, it saves the time M4.

[0038] Controller B can obtain the clock deviation offset and transmission delay delay with controller A through the four precise timestamp information of M1, M2, M3, and M4. The calculation method is as follows: offset = ((M2-M1)-(M4-M3)) / 2; delay = ((M2-M1)+(M4-M3)) / 2; When offset+delay = 0, controller B does not adjust the system time.

[0039] When offset+delay>0, controller B does not adjust the system time, and controller B performs a clock synchronization process with controller A.

[0040] When offset+delay<0, controller B adjusts the system time to the value of the current system time minus (offset+delay).

[0041] COM1 of each controller periodically sends the time synchronization process to the adjacent controller, and COM2 receives the clock synchronization process of the adjacent controller by default. Only when offset+delay>0, the controller will send a clock synchronization process from COM2 to the adjacent controller. When the controller COM1 receives the clock synchronization frame from the adjacent controller, the controller adjusts the system time of the controller according to the above method of calculating the synchronization time, and at the same time, it leaves a cycle to not obtain the clock from COM2 to prevent clock synchronization oscillation.

[0042] Reference Figure 2 , Figure 3 and Figure 4 This method can also effectively solve the problem that the clock cannot converge when any two controllers in the triple controller fail to communicate. If the communication between controller B and controller C fails, controller C cannot obtain the clock from controller B. At this time, if the clock of controller B is ahead of the clock of controller A, controller A will synchronize the clock to controller C in the reverse direction, so that the clock of the entire system converges to the minimum clock.

[0043] The implementation principle of a clock synchronization method for a high-reliability triple safety control system in an embodiment of the present application is as follows: by processing timestamps through a hardware logic unit, the uncertainty caused by software execution time and network delay is reduced, and the accuracy of time synchronization is significantly improved. The method adopts a redundant design, and even if one or two controllers fail, the third controller can still maintain correct clock synchronization, thereby enhancing the reliability of the system; and supports online non-disturbance replacement of a channel, and can be maintained or replaced without affecting other running channels, thereby simplifying the initialization process, reducing the risk of configuration errors, and speeding up the system startup speed. In the normal synchronization state, the controller provides a clock synchronization source to the adjacent system and obtains clock data from the adjacent system to update its own clock, thereby avoiding additional interrupt control, optimizing resource utilization, and ensuring efficient data exchange; in addition, the hardware state machine manages state transitions, ensures accuracy and timeliness, and can ensure overall clock convergence through a reverse synchronization process in the event of a communication failure, thereby increasing the flexibility and robustness of the system; it meets the industry's extremely high requirements for real-time and security, and promotes the stability and consistency of the entire system.

[0044] The above are all preferred embodiments of the present application, and the protection scope of the present application is not limited thereto. Therefore, any equivalent changes made according to the structure, shape, and principle of the present application should be included in the protection scope of the present application.

Claims

1. A clock synchronization method for a triple safety control system with high reliability, characterized in that: The following steps are involved: Step S1: When the system is powered on, each interconnected controller enters an initialization synchronization state, runs according to its own clock in the initialization synchronization state and periodically sends an initial state synchronization declaration frame and an initial state synchronization follow-up frame. When sending the initial state synchronization declaration frame, the hardware logic unit of the controller will save the sending time T1, and T1 is sent out together with the initial state follow-up frame; Step S2: Each controller receives the initial state synchronization declaration frame and the initial state synchronization follow frame sent by the adjacent controller. When each controller receives the initial state declaration frames from two adjacent controllers, the hardware logic unit of the controller records the receiving times T2 and T3 respectively. When each controller receives the initial state synchronization follow frame sent by the adjacent controller, the hardware logic unit of the controller records the receiving times T4 and T5 respectively, and selects the appropriate time as its own system time based on the time information through the set time selection logic; Step S3: Each controller switches from the initial synchronization state to the normal synchronization state. In the normal synchronization state, the controller provides a clock synchronization source to the adjacent system and obtains clock data from the adjacent system to update its own clock.

2. The clock synchronization method of a triple safety control system with high reliability according to claim 1 is characterized in that: The time selection logic set in step S2 is: When T2≥T4, T3≥T5, if T2-T4≥T3-T5, the system time of this controller is adjusted to T4. The adjustment method is to subtract (T2-T4) from the current system time as the system time; When T2≥T4, T3≥T5, if T2-T4≤T3-T5, the system time of this controller is adjusted to T5. The adjustment method is to subtract (T2-T5) from the current system time as the system time; When T2≥T4, T3≤T5, the system time of this controller is adjusted to T4. The adjustment method is to subtract (T2-T4) from the current system time as the system time; When T2≤T4, T3≥T5, the system time of this controller is adjusted to T5. The adjustment method is to subtract (T2-T5) from the current system time as the system time; When T2≤T4, T3≤T5, the system time of this controller will not be adjusted; each controller executes the above logic at least 3 times.

3. The clock synchronization method of a triple safety control system with high reliability according to claim 2 is characterized in that: When the controller is in the initial synchronization state, if it receives the normal state synchronization declaration frame from the adjacent controller, it stops sending the initial state declaration frame and the initial state follow frame to this adjacent controller, and starts receiving the normal synchronization clock of this adjacent controller to complete the synchronization process of the system time.

4. The clock synchronization method of a triple safety control system with high reliability according to claim 1 is characterized in that: Step S3 specifically includes the following steps: Step S3.1: Send a normal state synchronization declaration frame to the corresponding communication port of an adjacent controller through the communication port of one controller, and record the sending time M1; Step S3.2: The adjacent controller receives the normal state synchronization declaration frame and saves and records the reception time M2; Step S3.3: The sending controller then sends a normal state synchronization follow frame containing a timestamp M1 to the receiving controller; Step S3.4: After receiving the synchronization follow-up frame, the receiving controller saves the time M1 carried therein, and sends a response frame to the sending controller, and records the time of sending the response frame as M3; Step S3.5: After receiving the response frame, the sending controller records the receiving time as M4, and sends a synchronization completion frame with a timestamp of M4 to the receiving controller; Step S3.6: The receiving controller saves the received time M4, calculates the clock deviation offset and transmission delay delay based on the four precise timestamps M1, M2, M3 and M4, and adjusts its own system time.

5. The clock synchronization method of a triple safety control system with high reliability according to claim 4 is characterized in that: The clock deviation offset and transmission delay delay in step S3.6 are calculated as follows: offset = ((M2-M1)-(M4-M3)) / 2; delay=((M2-M1)+(M4-M3)) / 2; When offset+delay=0, the receiving controller does not adjust the system time; When offset+delay>0, the receiving controller does not adjust the system time, and the receiving controller performs a clock synchronization process with the sending controller; When offset+delay<0, the receiving controller adjusts the system time to the current system time minus (offset+delay).

6. The clock synchronization method of a triple safety control system with high reliability according to claim 5 is characterized in that: Each controller has two communication ports, which are set as COM1 and COM2. The communication ports of each controller are connected end to end. The controller periodically sends time synchronization to the adjacent controller. The controller's COM2 receives the clock synchronization process of the adjacent controller by default. Only when offset+delay >0, the controller will send a clock synchronization process from COM2 to the adjacent controller.

7. The clock synchronization method of a triple safety control system with high reliability according to claim 1 is characterized in that: When the controller is in the normal synchronization state and receives the initial state synchronization declaration frame from the adjacent controller, the controller acts as a clock source to send the clock synchronization process to the adjacent controller.

Images