Time synchronization implementation method of three-redundancy flight control computer

Abstract

The invention provides a time synchronization implementation method of a three-redundancy flight control computer, which is characterized in that parameter configuration is carried out through a three-machine synchronization programmable timer module, an AXI bus and an APB bus, the setting of a timing interrupt signal period, interrupt signal effective level duration and a timer switch can be realized, and the time synchronization of the three-redundancy flight control computer can be realized through startup synchronization and period synchronization. Three control units using independent clock sources can synchronously send out timing interrupt signals with configurable periods, and the purpose of time synchronization of task nodes of the distributed flight control system is achieved. The technical problem that in the prior art, due to the fact that a redundancy management method and application layer software are highly bound, the software design complexity is increased is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of redundant design synchronization algorithms, and particularly to a method for implementing time synchronization of a triple-redundancy flight control computer. Background Art

[0002] The triple-redundancy flight control computer requires the three computers to process and execute periodic tasks at the same moment. Only on the premise of synchronization, the monitoring and voting of the calculation results by each flight control module are meaningful. The traditional triple-redundancy flight control computer adopts the method of task-level synchronization. The main processor issues tasks, and the three-board uses intelligent serial ports for task distribution and data interaction until all three-machine tasks are completed, and then the next task is started. This will first lead to the result that each node is unified to the slowest clock; secondly, the state of the three machines is transmitted using intelligent serial ports, which will reduce the real-time performance of the system; finally, the redundancy management method and the application layer software are highly bound in this working mode. When designing the application software, it is necessary to consider both the flight control algorithm and the redundancy management and decision-making methods, which increases the complexity of software design and is not conducive to the promotion of standardization, serialization, and generalization. Summary of the Invention

[0003] The present invention provides a method for implementing time synchronization of a triple-redundancy flight control computer, which can solve the technical problem that the redundancy management method and the application layer software are highly bound in the prior art, resulting in an increase in software design complexity.

[0004] According to one aspect of the present invention, there is provided a method for implementing time synchronization of a triple-redundancy flight control computer. Each of the three flight control computers has a synchronous programmable timer module. The timer module includes a counter, a handshake signal generator, a timing interrupt generator, a handshake signal arrival detection sub-module, and a synchronization completion detection sub-module. The method includes:

[0005] S11, when the three flight control computers are in the three-out-of-two working state, after each flight control computer is powered on and reset and initialized, it sends handshake signals to itself and other computers through its own handshake signal generator;

[0006] S12, each flight control computer collects the handshake signals of itself and other computers through its own handshake signal arrival detection sub-module and determines whether each handshake signal is valid, and outputs a valid handshake signal;

[0007] S13, the current flight control computer collects the valid handshake signals output by S12 through the synchronization completion detection sub-module, and determines whether the number of valid handshake signals within the set threshold time is equal to three. If so, it determines that the power-on synchronization is successful, the local handshake signal generator stops sending handshake signals, and the local counter starts periodic counting from 0. If not, it determines that the power-on synchronization fails, reports an error, the local handshake signal generator stops sending handshake signals, and the local counter starts periodic counting from 0;

[0008] S14. When the count value of the local counter reaches the maximum value of the periodic count, the local handshake signal generator sends handshake signals to both the local and other machines.

[0009] S15. The local handshake signal arrival detection sub-module collects the handshake signals of the local and other machines and determines whether each handshake signal is valid, and outputs valid handshake signals.

[0010] S16. The local synchronization completion detection sub-module collects the valid handshake signals output by S15, and determines whether the number of valid handshake signals within the set threshold time is greater than or equal to two. If so, go to S17; if not, go to S18.

[0011] S17. Determine that the cycle synchronization is successful, clear the local counter and enter the next cycle count. The local timing interrupt generator sends a timing interrupt signal of a preset duration, and go to S14.

[0012] S18. Determine that the cycle synchronization fails, report an error, clear the local counter and enter the next cycle count. The local timing interrupt generator sends a timing interrupt signal of a preset duration, and go to S14.

[0013] Furthermore, the method further includes:

[0014] S21. When the three flight control computers are in the master-slave working state, after the three flight control computers are powered on, reset and initialized, the flight control computer acting as the host sends handshake signals to other machines through the local handshake signal generator.

[0015] S22. The flight control computer acting as the slave collects the handshake signals of the host through the local handshake signal arrival detection sub-module and determines whether it is valid, and outputs valid handshake signals.

[0016] S23. The synchronization completion detection sub-module of the slave collects the valid handshake signals output by S22, and determines whether the valid handshake signals within the set threshold time are equal to 1. If so, determine that the power-on synchronization is successful, and the handshake signal generator of the host stops sending handshake signals to other machines. The counters of both the local and the host start periodic counting from 0. If not, determine that the power-on synchronization fails, report an error, and the handshake signal generator of the host stops sending handshake signals to other machines. The counters of both the local and the host start periodic counting from 0.

[0017] S24. When the count value of the host counter reaches the maximum value of the periodic count each time, clear it and enter the next cycle count. The host handshake signal generator sends handshake signals to the slave, and the host timing interrupt generator sends a timing interrupt signal of a preset duration.

[0018] S25. The handshake signal arrival detection sub-module of the slave device collects the handshake signal of the master device and determines whether it is valid, and outputs a valid handshake signal.

[0019] S26. The synchronization completion detection sub-module of the slave device collects the valid handshake signal output by S25, and determines whether the number of valid handshake signals within the set threshold time is equal to 1. If so, it determines that the cycle synchronization is successful, and the counters of both the local device and the master device are cleared and enter the next cycle of counting. The local timing interrupt generator issues a timing interrupt signal with a preset duration. If not, it determines that the cycle synchronization fails, reports an error, the local counters are cleared and enter the next cycle of counting, and the local timing interrupt generators all issue timing interrupt signals with a preset duration.

[0020] Further, the method further includes:

[0021] When the three flight control computers are in the single-machine working state, after each flight control computer is powered on and reset for initialization, its respective counter performs periodic counting. Whenever the count value of the counter reaches the maximum value of the periodic counting, it is cleared and enters the next cycle of counting, and the corresponding timing interrupt generator issues a timing interrupt signal with a preset duration.

[0022] Further, the method further includes:

[0023] Each flight control computer uses the synchronization completion detection sub-module to calculate the first time interval between the time when the local handshake signal is sent and the time when the handshake signals of the other two computers arrive, and determines whether the first time interval is greater than the first threshold. When the first time interval is greater than the first threshold, an error is reported.

[0024] Further, the timer module further includes an other-machine handshake signal timeout detection sub-module, and the method further includes:

[0025] Each flight control computer uses the other-machine handshake signal timeout detection sub-module to calculate the second time interval between two adjacent valid edges of the arriving handshake signal, and determines whether the second time interval is greater than the second threshold. When the second time interval is greater than the second threshold, an error is reported.

[0026] Further, the first threshold is 0.1% of the counter counting cycle, and the second threshold is ±0.5% of the counter counting cycle.

[0027] Further, the method further includes: sending the local handshake signal to the other-machine handshake signal arrival detection sub-module after filtering, and sending the local handshake signal to the local handshake signal arrival detection sub-module after clock compensation. The delay of the clock compensation is equal to the delay of the filtering.

[0028] The beneficial effects of the present invention:

[0029] The present invention uses a three-machine synchronous programmable timer module to configure parameters through the AXI bus and the APB bus, which can realize the setting of the period of the timing interrupt signal, the duration of the effective level of the interrupt signal, and the timer switch. Through power-on synchronization and cycle synchronization, three control units using independent clock sources can synchronously send timing interrupt signals with configurable periods, achieving the purpose of time synchronization of each task node in the distributed flight control system, and overcoming the disadvantages of high system complexity and strong correlation with application software in the traditional triple-redundancy design. The present invention supports the APB bus and AXI bus interfaces, and does not change due to the change of the external processor; it is compatible with triple-redundancy, dual-redundancy, and single-mode systems, can be automatically switched, and has strong versatility; it has the ability to self-check and mutual-check the three-machine timing signals, and has the characteristics of high reliability, high stability, and high real-time; the time synchronization timing is completed by handshake signals, and a self-closed loop is realized internally, which is convenient for user software applications; through the synchronous signal delay chain compensation technology, the key index that the asynchronous degree of the three machines is not greater than 100 ns is realized. The present invention can be completely decoupled from the application layer software, with a self-closed loop internally. The user parameter configuration and status reading do not affect the time synchronization at all, which not only reduces the complexity of software and hardware implementation, but also improves the system fault tolerance; it is compatible with the time synchronization method of the dual-redundancy system and can be directly applied to triple-redundancy, dual-redundancy, and single-machine systems without modification, and can be popularized and applied in high-real-time and high-reliability control occasions such as aircraft control and industrial control. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] The accompanying drawings included are used to provide a further understanding of the embodiments of the present invention, which form a part of the specification, are used to illustrate the embodiments of the present invention, and together with the text description are used to explain the principles of the present invention. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention, and those of ordinary skill in the art can obtain other drawings without creative efforts based on these drawings.

[0031] Figure 1 FIG. shows a schematic structural diagram of a synchronous programmable timer module provided according to a specific embodiment of the present invention;

[0032] Figure 2 FIG. shows a schematic flow diagram of a time synchronization implementation method for a triple-redundancy flight control computer provided according to a specific embodiment of the present invention;

[0033] Figure 3 FIG. shows a power-on synchronization schematic diagram in a two-out-of-three voting working mode provided according to a specific embodiment of the present invention;

[0034] Figure 4 FIG. shows a power-on synchronization schematic diagram in a master-slave working mode provided according to a specific embodiment of the present invention;

[0035] Figure 5Shows the cycle synchronization schematic diagram in the three-out-of-two working mode provided according to a specific embodiment of the present invention;

[0036] Figure 6 Shows the cycle synchronization schematic diagram in the master-slave working mode provided according to a specific embodiment of the present invention;

[0037] Figure 7 Shows the time synchronization waveform diagram in the three-out-of-two working mode provided according to a specific embodiment of the present invention. Detailed implementation manners

[0038] It should be noted that, without conflict, the embodiments in the present application and the features in the embodiments may be combined with each other. The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. The following description of at least one exemplary embodiment is actually only illustrative and in no way limits the present invention and its application or use. Based on the embodiments in the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0039] It should be noted that the terms used herein are only for describing specific implementation manners and are not intended to limit the exemplary implementation manners according to the present application. As used herein, unless otherwise clearly specified in the context, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or their combinations.

[0040] Unless otherwise specifically stated, the relative arrangements of the components and steps, numerical expressions, and numerical values set forth in these embodiments do not limit the scope of the present invention. At the same time, it should be understood that, for the sake of convenience of description, the sizes of the various parts shown in the drawings are not drawn in actual proportional relationships. Technologies, methods, and devices known to those of ordinary skill in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and devices should be regarded as part of the authorized specification. In all the examples shown and discussed here, any specific value should be interpreted as merely exemplary and not as a limitation. Therefore, other examples of the exemplary embodiments may have different values. It should be noted that: like reference numerals and letters denote like items in the following drawings, and thus, once an item is defined in one drawing, it does not need to be further discussed in subsequent drawings.

[0041] According to a specific embodiment of the present invention, a method for realizing time synchronization of a triple-redundancy flight control computer is provided. Each of the three flight control computers has a synchronous programmable timer module. The timer module includes a counter, a handshake signal generator, a timing interrupt generator, a handshake signal arrival detection sub-module, and a synchronization completion detection sub-module. The method includes:

[0042] S11. When the three flight control computers are in a two-out-of-three voting working state, after each flight control computer is powered on and reset for initialization, it sends handshake signals to itself and other computers through its own handshake signal generator.

[0043] S12. Each flight control computer collects the handshake signals of itself and other computers through its own handshake signal arrival detection sub-module and determines whether each handshake signal is valid, and outputs a valid handshake signal.

[0044] S13. The current flight control computer collects the valid handshake signals output in S12 through the synchronization completion detection sub-module, and determines whether the number of valid handshake signals within the set threshold time is greater than or equal to two. If so, it determines that the power-on synchronization is successful, the local handshake signal generator stops sending handshake signals, and the local counter starts periodic counting from 0. If not, it determines that the power-on synchronization fails, reports an error, the local handshake signal generator stops sending handshake signals, and the local counter starts periodic counting from 0.

[0045] S14. When the count value of the local counter reaches the maximum value of periodic counting, the local handshake signal generator sends handshake signals to itself and other computers.

[0046] S15. The local handshake signal arrival detection sub-module collects the handshake signals of itself and other computers and determines whether each handshake signal is valid, and outputs a valid handshake signal.

[0047] S16. The local synchronization completion detection sub-module collects the valid handshake signals output in S15, and determines whether the number of valid handshake signals within the set threshold time is greater than or equal to two. If so, it proceeds to S17. If not, it proceeds to S18.

[0048] S17. It determines that the periodic synchronization is successful, clears the local counter and enters the next cycle of counting, and the local timing interrupt generator sends a timing interrupt signal with a preset duration, and proceeds to S14.

[0049] S18. It determines that the periodic synchronization fails, reports an error, clears the local counter and enters the next cycle of counting, and the local timing interrupt generator sends a timing interrupt signal with a preset duration, and proceeds to S14.

[0050] Further, in the embodiment of the present invention, the method further includes:

[0051] S21. When the three flight control computers are in the master-slave working state, after the three flight control computers are powered on, reset, and initialized, the flight control computer acting as the host sends a handshake signal to other computers through the handshake signal generator of its own computer.

[0052] S22. The flight control computer acting as the slave collects the handshake signal of the host through the handshake signal arrival detection sub-module of its own computer and determines whether it is valid, and outputs a valid handshake signal.

[0053] S23. The synchronization completion detection sub-module of the slave collects the valid handshake signal output by S22, and determines whether the number of valid handshake signals within the set threshold time is equal to 1. If so, it determines that the power-on synchronization is successful, the handshake signal generator of the host stops sending handshake signals to other computers, and the counters of this computer and the host both start periodic counting from 0. If not, it determines that the power-on synchronization fails, reports an error, the handshake signal generator of the host stops sending handshake signals to other computers, and the counters of this computer and the host both start periodic counting from 0.

[0054] S24. When the count value of the host counter reaches the maximum value of periodic counting each time, it is cleared and enters the next cycle of counting. The host handshake signal generator sends a handshake signal to the slave, and the host timing interrupt generator sends a timing interrupt signal with a preset duration.

[0055] S25. The handshake signal arrival detection sub-module of the slave collects the handshake signal of the host and determines whether it is valid, and outputs a valid handshake signal.

[0056] S26. The synchronization completion detection sub-module of the slave collects the valid handshake signal output by S25, and determines whether the number of valid handshake signals within the set threshold time is equal to 1. If so, it determines that the cycle synchronization is successful, the counters of this computer and the host are both cleared and enter the next cycle of counting, and the local timing interrupt generator sends a timing interrupt signal with a preset duration. If not, it determines that the cycle synchronization fails, reports an error, the local counters are both cleared and enter the next cycle of counting, and the local timing interrupt generators both send timing interrupt signals with a preset duration.

[0057] In addition, in the embodiment of the present invention, the method further includes:

[0058] When the three flight control computers are in the single-computer working state, after each flight control computer is powered on, reset, and initialized, their respective counters perform periodic counting. Whenever the count value of the counter reaches the maximum value of periodic counting, it is cleared and enters the next cycle of counting, and the corresponding timing interrupt generator sends a timing interrupt signal with a preset duration.

[0059] Based on the above embodiments, in the embodiments of the present invention, the method further includes: each flight control computer uses the synchronization completion detection sub-module to calculate the first time interval between the time when the local handshake signal is sent and the time when the handshake signals from the other two computers arrive, and determines whether the first time interval is greater than the first threshold. When the first time interval is greater than the first threshold, an error is reported. Further, in the embodiments of the present invention, the timer module further includes an other-computer handshake signal timeout detection sub-module, and the method further includes: each flight control computer uses the other-computer handshake signal timeout detection sub-module to calculate the second time interval between two adjacent valid edges of the received handshake signal, and determines whether the second time interval is greater than the second threshold. When the second time interval is greater than the second threshold, an error is reported. Wherein, the specific values of the first threshold and the second threshold are determined according to the actual situation. As a specific embodiment of the present invention, the first threshold is 0.1% of the counter technical cycle, and the second threshold is ±0.5% of the counter technical cycle. In this way, it is possible to detect whether the working state of the synchronous programmable timer module is normal.

[0060] Further, in the embodiments of the present invention, the method further includes: sending the local handshake signal to the other-computer handshake signal arrival detection sub-module after filtering, and sending the local handshake signal to the local handshake signal arrival detection sub-module after clock compensation, and the delay of the clock compensation is equal to the delay of the filtering. In this way, it is possible to avoid desynchronization caused by the filtering delay.

[0061] To facilitate a clearer understanding of the time synchronization implementation method of the triple-redundancy flight control computer provided by the present invention, the following will take a practical application example to illustrate the above processes in detail. Those skilled in the relevant art should know that this example is only for facilitating a clearer understanding of the time synchronization implementation method of the triple-redundancy flight control computer provided by the present invention, and does not impose any technical limitations on it.

[0062] As Figure 1 shown, the synchronous programmable timer module includes a counter (not shown in the figure), a local handshake signal generator (handshake signal generator), a timing interrupt generator, a handshake signal arrival detection sub-module, an other-computer handshake signal timeout detection sub-module, and a synchronization completion detection sub-module. This synchronous programmable timer module is an APB / AXI bus slave device. Through parameterized configuration and register software setting methods, the processor can set the timing interrupt signal period, the duration of the effective level of the interrupt signal, and the timer switch, so as to configure the control cycle of the flight control computer, and complete the time synchronization of the three-computer control cycle under these configurations. Among them, the minimum unit of the timing interrupt signal period is the cycle synchronization time, which is set according to the number of cycle synchronizations; the duration of the effective level of the interrupt signal is the width of the interrupt effective pulse, with the main clock of the synchronous timer as the minimum unit; the timer switch is used to enable the interrupt signal and is turned on and off by the user.

[0063] The functions of each sub-module in the synchronous programmable timer module are as follows:

[0064] a) Handshake signal arrival detection sub-module

[0065] Detect whether the local handshake signal and the other machine's handshake signal are valid, output a handshake valid signal, and the local handshake signal undergoes a delay equal to the filtering of the other machine's handshake signal.

[0066] b) Other machine handshake signal timeout detection sub-module

[0067] Detect the rising edge interval of the other machine's handshake signal arrival.

[0068] c) Synchronization completion detection sub-module

[0069] Synchronization is divided into two processes: power-on synchronization and periodic synchronization. Power-on synchronization is to prevent the problem of long-term unsynchronization due to excessive phase difference when the three machines enter periodic synchronization. Periodic synchronization is to ensure that each interrupt signal sent can be within a certain error range.

[0070] d) Local handshake signal generator

[0071] During the power-on synchronization stage, after the local reset ends, the handshake signal is valid and waits for the power-on synchronization to end. During the periodic synchronization stage, when the counter accumulates to the corresponding periodic synchronization counting time, the counter is cleared, the local handshake signal is valid, waits for the periodic synchronization to complete, and then the counter starts to accumulate again. After reaching the handshake signal valid time, the local handshake signal is released.

[0072] e) Timing interrupt generator

[0073] When the counter in the handshake signal generator is between (1, T), a valid edge of the timing interrupt is output, where T is the high-level holding time of the timer.

[0074] As Figure 2 shown, after software reset initialization, the working states of the three machines will be detected, including whether there is a host, and whether the initialization of the three machines starts normally, so as to switch the working mode. After power-on synchronization, the three machines will perform periodic synchronization at a predetermined period, and the working states of the three machines will be checked before each periodic synchronization. The working states of the three machines include three-out-of-two working mode, master-slave working mode, and single-machine working mode. When in the three-out-of-two working mode and the master-slave working mode, the synchronization process includes two synchronization stages: power-on synchronization and periodic synchronization. Power-on synchronization is to prevent the problem of long-term unsynchronization due to excessive phase difference when each machine enters periodic synchronization. Periodic synchronization is to ensure that each interrupt signal sent by the three machines of the system can be within a certain error range; when in the single-machine working mode, synchronization is not performed.

[0075] For the three-out-of-two working mode, the power-on synchronization process is as follows: When the system is powered on, the three machines are powered on simultaneously and enter the reset initialization. Each machine sends a handshake signal to the other two machines and simultaneously receives the handshake signals sent by the other two machines. Receiving the handshake signals from the other two machines indicates successful power-on synchronization. The counter starts counting and enters the periodic synchronization stage. Power-on synchronization only runs during system power-on or reset and is only called once, thus eliminating the time-consuming error and excessive phase difference when different channels start. After power-on synchronization is completed, the system transfers to the periodic synchronization stage. Each machine sends a handshake signal to the other two machines and simultaneously collects the handshake signals sent by the other two machines. If the handshake judgment is passed, the timing interrupt signal is set and the timing task is entered. If the handshake signal cannot be collected, the running waiting time is entered, the enable interrupt for this channel is performed, and an error is recorded once. The synchronization program is executed in real time during task execution, thus eliminating the cumulative error of the crystal oscillators between the three channels to ensure that the three channels of the flight control computer can simultaneously transmit, receive, and process data.

[0076] As Figure 3 shown, it is the power-on synchronization process in the three-out-of-two working mode. A is the handshake signal of machine A's FPGA pulled high after reset and pulled low until the end of power-on synchronization. BC are the handshake signals sent by the FPGAs of the other two machines. After filtering, when the handshake signals detect the high levels of the handshake signals of machines A, B, and C, the power-on synchronization is completed. If the acquisition time exceeds 500 ms, an error is reported and it automatically enters the periodic synchronization module. As Figure 5 shown, it is the periodic synchronization process in the three-out-of-two working mode. ABC are the three-machine handshake signals. If two of the handshake signals of machines A, B, and C are detected as valid or both B and C's mutual checks report errors, the periodic synchronization is completed. If the waiting time exceeds the threshold, an error is reported and it automatically enters the periodic synchronization module. Figure 7 It is the time synchronization waveform diagram in the three-out-of-two working mode. Timer_int is the handshake signal and Tim_out is the timing interrupt signal.

[0077] As Figure 4 shown, it is the power-on synchronization process in the master-slave working mode. A is the handshake signal of machine A's FPGA pulled high after reset and pulled low until the end of power-on synchronization. B is the handshake signal sent by machine B's FPGA after reset. After filtering, when the handshake signals detect the high levels of the handshake signals of machines A and B, the power-on synchronization is completed. If the acquisition time exceeds 500 ms, an error is reported and it automatically enters the periodic synchronization module. As Figure 6As shown in the figure, it is the cycle synchronization process in the master-slave working mode. AB is the handshake signal between the two machines. Cycle synchronization differentiates between the master and slave states. If machine A is the master, it only needs to wait until the high level of the handshake signal of machine A for the cycle synchronization to be completed. When machine A is the slave, it needs to wait for the high level of the handshake signal of machine B or the effective fault_x signal within the threshold time for the cycle synchronization to be completed. If the waiting time exceeds the threshold, an error will be reported and it will automatically enter the next cycle synchronization.

[0078] That is to say, the main reasons for the inability to synchronize the three channels of the flight control computer are: the difference in startup time consumption between channels; the cumulative error of the processor reference clock between channels. Therefore, in the design process of the flight control computer synchronization algorithm (three-vote-two working mode, master-slave working mode), for the above two reasons affecting the synchronization between channels, the design of power-on synchronization and cycle synchronization is adopted respectively to eliminate them. The synchronization algorithm runs throughout the operation process of the entire flight control system. Its general idea can be summarized as follows: The three machines achieve three-machine time synchronization through handshake signals and counters. When the system works in the three-machine state, whenever the count reaches the maximum value of the cycle count, handshake synchronization is performed by the method of three-vote-two for the handshake signals. When the handshake signals of two or more of the three machines are valid, the synchronization is successful, the counter is cleared and enters the next cycle count. If the synchronization fails within the set threshold time, an error will be reported, the counter is cleared and enters the next cycle count. When the system works in the two-machine state, when the host machine counts to the maximum value of the configured cycle count, it sends a handshake signal to the slave machine and enters the next cycle. The slave machine corrects its own count according to the handshake signal of the host machine. If the handshake signal of the host machine is not detected within the set threshold time, the slave machine synchronization fails, an error is reported, and the counter is cleared and enters the next cycle count. When the counter is cleared, the interrupt signal is set and automatically released after the effective level time configured by the user.

[0079] In addition, when the system works in the single-machine state, after the counters of each computer count to the maximum value of the configured cycle count, they are cleared and enter the next cycle. When the counter is cleared, the interrupt signal is set and automatically released after the effective level time configured by the user.

[0080] Furthermore, the time synchronization implementation method provided by the present invention also includes a self-check and mutual-check process. Specifically, when the three machines work in the cycle synchronization state, self-check and mutual-check are performed in each cycle. The self-check detects whether the time from the issuance of the local handshake signal to the arrival of the handshake signals of the other two machines times out. The timeout time is 0.1% of the synchronization cycle and is adjusted according to the different crystal oscillator accuracies selected. The mutual-check is to use the local source clock to time the two adjacent valid edges of the arriving handshake signal to determine whether it times out. The timeout time is ±0.5% of the synchronization cycle. If the handshake signals of the other two machines both time out, it will run in the single-machine operation mode and publish the mutual-check timeout error status to the processor until the handshake signals of the other two machines do not time out, then it resumes running in the three-vote-two mode or the master-slave mode.

[0081] In addition, since the handshake signal of other machines is an external input signal, it needs to pass through a digital filter before use, which will cause a delay in the input handshake signal. Therefore, when the local machine judges the validity of its own handshake signal, a compensation equal to the filtering delay is performed, that is, clock compensation is performed to avoid out-of-sync caused by the filtering delay.

[0082] In summary, the main steps of the time synchronization implementation method of the triple-redundancy flight control computer provided by the present invention can be referred to Figure 2 the flowchart of. The timer working mode is divided into three-judge-two, master-slave, and single-machine operation modes, and is automatically switched by collecting the working state of the system: when the system works in the three-judge-two mode, the cycle of the three-machine timing interrupt signal is unified to the clock at the intermediate speed; when the system works in the master-slave mode, the clock is based on the host machine, and the slave machine corrects to the host machine; when operating in single-machine mode, when the system works in the single-machine mode, a periodic timing interrupt signal is generated by its own independent clock source. The timer supports automatic switching of the working mode during redundancy degradation and upgrade, and has the functions of self-checking the periodic timing interrupt signal of the local machine and detecting abnormalities in the interrupt signals of other machines. When the clock signals of any one machine or two machines fail, the phase and cycle of the control period signal of the non-faulty machine will not change suddenly, thus not affecting the control operation after the fault, which is the fault-tolerant basis of the redundant design. The specific implementation manners of each step have been described in detail in the foregoing embodiments, and will not be elaborated herein one by one. Those skilled in the relevant art should know that this example is only an application method to help understand the time synchronization implementation method of the triple-redundancy flight control computer provided by the present invention, and does not make any limitation thereto.

[0083] The beneficial effects of the present invention:

[0084] The present invention uses a three-machine synchronous programmable timer module to configure parameters through the AXI bus and the APB bus. It can achieve the setting of the cycle of the timing interrupt signal, the duration of the effective level of the interrupt signal, and the timer switch. Through power-on synchronization and cycle synchronization, three control units using independent clock sources can synchronously send timing interrupt signals with configurable cycles, achieving the purpose of time synchronization of each task node in the distributed flight control system, and overcoming the disadvantages of high system complexity and strong correlation with application software in the traditional triple-redundancy design. The present invention supports the APB bus and AXI bus interfaces and does not change due to the change of the external processor; it is compatible with triple-redundancy, dual-redundancy, and single-mode systems, can be automatically switched, and has strong versatility; it has the ability to self-check and mutual-check the three-machine timing signals, and has the characteristics of high reliability, high stability, and high real-time performance; the time synchronization timing is completed by the handshake signal, and an internal self-closed loop is realized, which is convenient for user software applications; through the synchronous signal delay chain compensation technology, the key index that the asynchronous degree of the three machines is not greater than 100 ns is achieved. The present invention can achieve complete decoupling from the application layer software, with an internal self-closed loop. The user parameter configuration and status reading do not affect the time synchronization at all, which not only reduces the complexity of software and hardware implementation but also improves the system fault tolerance; it is compatible with the time synchronization method of the dual-redundancy system and can be directly applied to triple-redundancy, dual-redundancy, and single-machine systems without modification, and can be popularized and applied in high-real-time and high-reliability control occasions such as aircraft control and industrial control.

[0085] For the sake of convenience in description, spatial relative terms, such as "above", "on top of", "on the upper surface", "upper", etc., may be used herein to describe the spatial position relationship of one device or feature to other devices or features as shown in the figures. It should be understood that the spatial relative terms are intended to encompass different orientations in use or operation in addition to the orientation depicted in the figures. For example, if the device in the figures is inverted, the device described as "above" or "on top of" other devices or structures will then be oriented "below" or "beneath" the other devices or structures. Thus, the exemplary term "above" can include both the orientations of "above" and "below". The device may also be oriented in other different ways (rotated 90 degrees or at other orientations), and corresponding interpretations of the spatial relative descriptions used herein will be made.

[0086] In addition, it should be noted that the use of terms such as "first" and "second" to limit components is only for the convenience of distinguishing the corresponding components. Without additional statements, the above terms have no special meanings, so they cannot be construed as limiting the protection scope of the present invention.

[0087] The above are only the preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included within the protection scope of the present invention.

Claims

1. A method for realizing time synchronization of a triple-redundant flight control computer, characterized in that: The three flight control computers are all provided with a synchronous programmable timer module, wherein the timer module includes a counter, a handshake signal generator, a timer interrupt generator, a handshake signal arrival detection submodule and a synchronization completion detection submodule. The method includes: S11, when the three flight control computers are in the three-judgment-two working state, after each flight control computer is powered on, reset and initialized, it sends a handshake signal to itself and other computers through its own handshake signal generator; S12, each flight control computer collects the handshake signals of the local computer and other computers through its own handshake signal arrival detection submodule and determines whether each handshake signal is valid, and outputs a valid handshake signal; S13, the current flight control computer collects the valid handshake signal output by S12 through the synchronization completion detection submodule, and determines whether the number of valid handshake signals within the set threshold time is equal to three. If yes, it is determined that the power-on synchronization is successful, the local handshake signal generator stops sending handshake signals, and the local counter starts periodic counting from 0. If not, it is determined that the power-on synchronization fails, an error is reported, the local handshake signal generator stops sending handshake signals, and the local counter starts periodic counting from 0; S14, when the count value of the local counter reaches the maximum value of the periodic count, the local handshake signal generator sends a handshake signal to the local machine and the other machine; S15, the local handshake signal arrival detection submodule collects the local and other handshake signals and determines whether each handshake signal is valid, and outputs a valid handshake signal; S16, the local synchronization completion detection submodule collects the valid handshake signal output by S15, and determines whether the number of valid handshake signals within the set threshold time is greater than or equal to two, if yes, then go to S17, if no, then go to S18; S17, judging that the cycle synchronization is successful, the local counter is cleared to enter the next cycle counting, the local timing interrupt generator sends a timing interrupt signal of a preset duration, and then goes to S14; S18, judging that the cycle synchronization fails, reporting an error, the local counter is cleared to enter the next cycle counting, the local timing interrupt generator sends a timing interrupt signal of a preset duration, and going to S14.

2. The method according to claim 1, characterized in that The method further comprises: S21, when the three flight control computers are in the master-slave working state, after the three flight control computers are powered on and reset and initialized, the flight control computer as the master sends a handshake signal to the other computers through the handshake signal generator of the local computer; S22, the flight control computer as the slave collects the handshake signal of the host through the handshake signal arrival detection submodule of the local computer and determines whether it is valid, and outputs a valid handshake signal; S23, the synchronization completion detection submodule of the slave collects the valid handshake signal output by S22, and determines whether the valid handshake signal within the set threshold time is equal to 1. If yes, it is determined that the power-on synchronization is successful, and the handshake signal generator of the host stops sending handshake signals to the other machine, and the counters of the local machine and the host both start counting periodically from 0. If no, it is determined that the power-on synchronization fails, an error is reported, and the handshake signal generator of the host stops sending handshake signals to the other machine, and the counters of the local machine and the host both start counting periodically from 0. S24, when the count value of the host counter reaches the maximum value of the periodic count each time, it is reset to enter the next period count, the host handshake signal generator sends a handshake signal to the slave, and the host timing interrupt generator sends a timing interrupt signal of a preset duration; S25, the handshake signal arrival detection submodule of the slave collects the handshake signal of the host and determines whether it is valid, and outputs a valid handshake signal; S26, the synchronization completion detection submodule of the slave collects the valid handshake signal output by S25, and determines whether the valid handshake signal within the set threshold time is equal to 1. If so, it is determined that the cycle synchronization is successful, and the counters of the local and host are cleared to enter the next cycle counting, and the local timing interrupt generator sends a timing interrupt signal of a preset duration. If not, it is determined that the cycle synchronization has failed, an error is reported, and the local counters are cleared to enter the next cycle counting, and the local timing interrupt generator sends a timing interrupt signal of a preset duration.

3. The method according to claim 1, characterized in that The method further comprises: When the three flight control computers are in a stand-alone working state, after each flight control computer is powered on and reset and initialized, its respective counter performs periodic counting. Whenever the count value of the counter reaches the maximum value of the periodic counting, it is cleared to enter the next cycle counting, and the corresponding timing interrupt generator sends a timing interrupt signal of a preset duration.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: Each flight control computer uses the synchronization completion detection submodule to respectively calculate the first time interval between the time when the local handshake signal is sent and the time when the handshake signals to the other two aircraft arrive, and determines whether the first time interval is greater than a first threshold, and reports an error when the first time interval is greater than the first threshold.

5. The method according to claim 4, characterized in that The timer module also includes a handshake signal timeout detection submodule for another machine, and the method also includes: Each flight control computer uses the other machine handshake signal timeout detection submodule to calculate the second time interval between two adjacent valid edges of the incoming handshake signal, and determines whether the second time interval is greater than a second threshold, and reports an error when the second time interval is greater than the second threshold.

6. The method according to claim 5, characterized in that The first threshold is 0.1% of the counter counting period, and the second threshold is ±0.5% of the counter counting period.

7. The method according to claim 1, characterized in that The method also includes: filtering the local handshake signal and sending it to the other machine handshake signal arrival detection submodule, performing clock compensation on the local handshake signal and sending it to the local handshake signal arrival detection submodule, and the clock compensation delay is equal to the filtering delay.

Images