Dual-redundancy design method for virtual controller VDPU

Abstract

The invention relates to the technical field of industrial distributed control system architecture, and discloses a dual-redundancy design method for a virtual controller VDPU, which comprises the following steps of: deployment of a four-network-port redundant network architecture: dividing four physical network ports into two groups of independent channels, and simultaneously configuring a network link automatic switching mechanism, the working states of the four network ports are monitored in real time, then double isolation of a physical layer and a protocol layer is achieved, and an independent heartbeat transmission channel is established; main / standby heartbeat monitoring and switching control: the main / standby controller periodically interacts state information packets through a special heartbeat channel, and establishes a three-level fault determination mechanism at the same time to perform seamless main / standby switching; a multi-mode data synchronization mechanism is implemented, namely initialization synchronization, increment synchronization during operation and exception recovery synchronization are started, separation of heartbeat signals and data synchronization can be realized through two groups of independent channels, and the fault-tolerant capability and the switching efficiency of the system are improved, so that the operation stability of the system is guaranteed.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial distributed control system architecture, and in particular to a dual-redundancy design method for a virtual controller (VDPU). Background Art

[0002] In industrial control systems, redundancy technology is widely used to improve system reliability, continuity, security, and fault tolerance, becoming a key technology for ensuring stable operation of industrial processes. Dual redundancy ensures seamless takeover of a backup controller in the event of a primary controller failure. It has been widely adopted in various industrial control systems, particularly in sectors such as petrochemicals, electric power, and transportation, where real-time performance and reliability are crucial.

[0003] Traditional controller redundancy architectures typically consist of a primary and a backup controller, with heartbeat signals and data synchronization performed over a network link. The heartbeat signal monitors the primary controller's status in real time. If the primary controller experiences a failure (e.g., hardware failure, network outage, operating system crash), a failover mechanism is triggered, with the backup controller immediately taking over control to ensure stable system operation. Data synchronization ensures that the backup controller has access to the latest control data and system status information, allowing it to resume processing tasks immediately after taking over.

[0004] However, traditional dual-redundancy systems rely on a single network link for heartbeat signal transmission and data synchronization, making them susceptible to network bandwidth, latency, and failures. When the network is heavily loaded, this can cause heartbeat signal delays or loss, inefficient data synchronization, and potentially lead to false switching mechanisms or system interruptions. This severely impacts system reliability and continuity, making it difficult to meet production control needs in complex and disruptive industrial environments.

[0005] To this end, virtualization technology has been gradually introduced into distributed control systems (DCS) in recent years, with virtual controllers (Virtual Distributed Processing Units, or VDPUs) emerging as a novel solution. Virtual controllers emulate hardware functions in software, running on general-purpose computing platforms. They enable flexible system redundancy, offering greater scalability and flexible deployment. However, existing virtual controller redundancy designs often rely on the redundant architecture of traditional controllers, still suffering from issues such as heartbeat signals and data synchronization sharing the same network channel, resulting in low switching efficiency and high false positive rates.

[0006] This paper proposes an improved dual-redundant virtual controller design, which realizes the separation of heartbeat signal and data synchronization through four independent network channels, improves the system's fault tolerance and switching efficiency, and ensures the reliability and stability of system operation. Summary of the Invention

[0007] (1) Technical problems solved In response to the shortcomings of the existing technology, the present invention provides a dual-redundancy design method for a virtual controller (VDPU), which has the advantages of high fault tolerance, efficient switching, and strong anti-interference ability. It solves the problems of low switching efficiency and high misjudgment rate caused by the heartbeat signal and data synchronization sharing the same network channel in traditional dual-redundancy systems, as well as the impact of network bandwidth, delay and failure on system reliability and continuity in complex industrial environments.

[0008] (2) Technical solution To achieve the above object, the present invention provides the following technical solution: a dual-redundancy design method for a virtual controller VDPU, comprising the following steps: Step 1: Deploy a four-port redundant network architecture: Divide the four physical network ports into two independent channels, configure an automatic network link switching mechanism, monitor the working status of the four network ports in real time, and implement dual isolation between the physical layer and the protocol layer. Finally, establish an independent heartbeat transmission channel. Step 2: Active / standby heartbeat monitoring and switching control: The active / standby controllers periodically exchange status information packets through a dedicated heartbeat channel, and establish a three-level fault determination mechanism to perform seamless active / standby switching; Step 3: Implementation of the multi-mode data synchronization mechanism: startup initialization synchronization, runtime incremental synchronization, and exception recovery synchronization.

[0009] Preferably, the two groups of independent channels are: the first group is dedicated to heartbeat signal transmission, establishing a bidirectional redundant heartbeat link between the active and standby controllers; the second group is dedicated to control data and synchronization information transmission, realizing high-speed data channels and backup channels.

[0010] Preferably, the automatic network link switching mechanism is configured: when a failure of any network port or link is detected, the channel where the backup network port is located is automatically enabled to maintain communication.

[0011] Preferably, the active and standby controllers periodically exchange status information packets through a dedicated heartbeat channel, including controller role identification, process health status code and task execution progress mark.

[0012] Preferably, the three-level fault judgment mechanism is: when the first heartbeat is lost, link diagnosis will be automatically triggered; when two consecutive heartbeats are lost, standby machine pre-activation will be automatically started; when three consecutive heartbeats are not responded, the host is judged to be faulty.

[0013] Preferably, the seamless master-slave switching includes: a. freezing the host process and generating a memory snapshot; b. synchronizing real-time status data through a dedicated data channel; c. reconstructing the control context after the standby machine takes over and updating the topology relationship broadcast; d. automatically downgrading to a hot standby node after the original host recovers.

[0014] Preferably, the startup of the initialization synchronization includes: initiating a full data request when the standby machine starts, obtaining the POU configuration file and CRC check code of the host, adopting a differential synchronization strategy, only transmitting the configuration file that does not match the CRC, and completing the offline page data mirror construction and operating environment preloading.

[0015] Preferably, the operation of the incremental synchronization includes: a. host maintenance double buffer: real-time data buffer, configuration change buffer; b. implementation of periodic synchronization and event-triggered synchronization dual mode: (1) Cycle synchronization: compress and transmit real-time data difference packets; (2) Event triggering: Instant synchronization of key operations; c. Adopting CRC32+ACK response mechanism: triggering data packet retransmission when the backup machine fails to verify, and activating the abnormal recovery process when three consecutive transmission failures occur.

[0016] Preferably, the abnormal recovery synchronization: when the network is interrupted, the breakpoint resume is started, and the data is completed based on the sequence number. When the hardware fails to switch, the emergency synchronization mode is enabled and the key control parameters are transmitted first.

[0017] Preferably, the design elements of the design method include: a dual-channel physical isolation mechanism, an intelligent data synchronization strategy, and a multi-level fault-tolerant architecture.

[0018] Compared with the prior art, the present invention provides a dual-redundancy design method for a virtual controller VDPU, which has the following beneficial effects: 1. The present invention ensures the stability and real-time performance of heartbeat signals and data transmission by designing independent heartbeat signal channels and data transmission channels. The separated network architecture can reduce the impact of network interference on heartbeat monitoring and reduce the probability of misjudgment, thereby improving data transmission efficiency and ensuring that the system can maintain stable master-slave switching and timely data synchronization under high load conditions.

[0019] 2. The redundancy strategy of the present invention can jointly realize offline file synchronization and incremental real-time synchronization, automatically synchronize the basic offline data of the active and standby controllers when the system starts, ensure the consistency of the active and standby controllers after startup, and reduce the risks and configuration time brought by manual operation; during operation, the consistency of real-time data is maintained through real-time incremental synchronization to reduce the network bandwidth occupancy, so that the standby controller has the ability to take over at any time point, ensuring the seamlessness of the fault switching process and the stability of the system's continuous operation. Offline synchronization is equivalent to a one-time full data backup, while real-time synchronization is a continuous incremental data update. The combination of the two can not only avoid the risk of data loss caused by relying solely on real-time synchronization, but also reduce the network pressure caused by each full synchronization. This strategy can not only improve the data transmission efficiency under high load conditions, but also enhance the reliability of system fault switching, making it suitable for industrial control systems with complex networks and high real-time requirements.

[0020] 3. The present invention enhances the fault tolerance of the system through the redundant design of four network ports. When a certain network port or network link fails, it can automatically switch to other network ports to continue to maintain heartbeat signals and data transmission, ensuring the continuous operation of the system and enabling the system to adapt to complex network environments, thereby enhancing the stability and security of the overall system and reducing the risk of downtime due to network failures. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 This is a design diagram of a four-network port architecture in an embodiment of the present invention.

[0022] Figure 2 This is a flow chart of the heartbeat monitoring mechanism in an embodiment of the present invention.

[0023] Figure 3 This is a synchronization flow chart during startup in an embodiment of the present invention.

[0024] Figure 4 This is a synchronization flow chart in operation in an embodiment of the present invention.

[0025] Figure 5 Flowchart of a dual-redundancy design method for a virtual controller VDPU in an embodiment of the present invention. DETAILED DESCRIPTION

[0026] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0027] See also Figures 1 to 5As shown, a dual-redundancy design method for a virtual controller VDPU is provided. The implementation process of the method is as follows: S1. Design a four-port architecture (see the four-port architecture design diagram for details). Figure 1 ), by separating the heartbeat signal from data transmission, and using independent network channels for redundant transmission of data and heartbeat respectively, the purpose is to effectively improve the stability, fault tolerance and data transmission efficiency of the system. The specific operations are as follows: S1.1. Establish an independent heartbeat transmission channel: The system is equipped with two dedicated heartbeat signal transmission network ports. One of the heartbeat signal transmission network ports can prevent the transmission of the heartbeat signal from being interfered with by data transmission, and the other heartbeat signal transmission network port can ensure the stability and real-time performance of the heartbeat signal. Using both channels simultaneously can reduce the probability of heartbeat signal loss due to network congestion or delay, as well as the system's misjudgment caused by temporary network interruption, thereby avoiding unnecessary active-standby switching. S1.2. Establish an independent data transmission channel: The system is equipped with two other network ports for transmitting control data and synchronization information to ensure that the transmitted data is not interfered with by the heartbeat signal, thereby achieving efficient transmission of large amounts of data and ensuring real-time data synchronization; The advantages are: through the independent heartbeat channel, the operating status of the main controller can be accurately monitored, thereby reducing the possibility of misjudgment and false triggering, and the independent data channel can ensure that the data can be updated synchronously between the main and standby controllers, so that the standby controller can seamlessly continue to control when taking over the task, thereby ensuring the continuity of the system.

[0028] S1.3. Design redundant network links: The system divides the four network ports into two groups, one for heartbeat signal transmission and the other for data synchronization. The design of redundant network links ensures that even if one network port or one group of links fails, the system can still maintain normal heartbeat and data transmission through other network channels, thereby avoiding the occurrence of single point failures, improving the system's fault tolerance, and enabling the system to cope with various emergencies such as network congestion, insufficient bandwidth, and physical connection interruption.

[0029] The advantages are: by separating the heartbeat signal from data transmission, the system can improve the accuracy of heartbeat detection and the efficiency of data transmission; the dual redundant design can improve the system's fault tolerance under high load and complex network environments, making it suitable for industrial control systems with extremely high requirements for reliability and real-time performance.

[0030] Compared with the traditional method, the separation of the heartbeat signal and data transmission in the present invention has the following beneficial effects: Traditional redundant systems usually use a single network channel or a dual-network port architecture to transmit heartbeat signals and synchronize data. When problems such as network congestion, insufficient bandwidth or link interruption occur, heartbeat monitoring and data synchronization will be affected. A large network load will cause the heartbeat signal to be lost, and the system will misjudge the status of the main controller, triggering unnecessary master-slave switching, and even causing the system to crash. At the same time, network delays and bandwidth limitations will also affect the real-time performance of data synchronization, resulting in the device controller being unable to obtain the latest system status and thus unable to take over the task in time. The present invention can ensure the stability and real-time performance of heartbeat signals and data transmission by designing independent heartbeat signal channels and data transmission channels. The separated network architecture will reduce the impact of network interference on heartbeat monitoring, thereby reducing the probability of misjudgment and improving data transmission efficiency, to ensure that the system can maintain stable master-slave switching and timely data synchronization under high load conditions.

[0031] S2. Establishment of heartbeat monitoring mechanism (for the heartbeat monitoring mechanism flow chart, please refer to Figure 2 ): After starting the VDPU, a heartbeat transmission channel will be established between the active and standby controllers. The background program interface will be called periodically to detect the running status of the other node. Once the node status changes, the active and standby VDPUs will be switched immediately. The specific steps are as follows: S2.1. Periodic heartbeat signal transmission: The active and standby controllers periodically send heartbeat signals to each other. The heartbeat signals contain the operating status information of the controllers, such as the current working status (active or standby) and the task execution status. S2.2, Receive Heartbeat: The active and standby controllers monitor the heartbeat signal returned from the peer device to confirm whether the peer device is in normal working condition; S2.3, Fault Detection: If the heartbeat signal of the master controller is not detected for three consecutive times, the master controller is considered to have failed, and the master-slave switchover process is immediately triggered. At the same time, an alarm is issued to the user and the abnormal status is saved in the alarm log; S2.4, Master-Slave Switchover: Immediately halt the master controller's task processing and synchronize its current operational data (including real-time page data, I / O data, intermediate variables, and calculation results) with the standby controller to ensure the standby machine is updated to the latest control state. After the standby machine officially takes over the master's tasks, it begins sending heartbeat signals to notify other modules (such as the communication module and the alarm module) that the master-slave switchover is complete. All communication and control tasks will be handled by the standby machine (the new master). Once the original master returns to normal, it can rejoin the system and monitor the new master's operational status as a standby machine. At this time, the master and standby controllers continue to maintain synchronization through the heartbeat mechanism.

[0032] S3. Establish a data synchronization mechanism: The system ensures data consistency between the active and standby controllers through synchronization at startup and during operation. The specific process is as follows: S3.1. Synchronization at startup (For the synchronization flow chart at startup, see Figure 3 ): After the standby VDPU starts, it first requests its configuration file and data list (such as POU files and offline page data) from the primary VDPU. It compares the POU-CRC list information returned by the primary VDPU and determines the files that need to be synchronized. This ensures that the standby machine's offline page data and initial operating status are consistent with those of the primary machine after startup, allowing the standby machine to immediately take over tasks in the event of a primary failure. The specific steps are as follows: (1) Data request: After the standby machine is started, it establishes the first startup data synchronization thread and actively requests the host machine to synchronize the POU configuration file and real-time data; (2) Data comparison: The standby machine compares the CRC values of the POU files sent by the host machine one by one to determine which data needs to be synchronized; (3) Data transmission: The standby machine receives the required POU files and data from the host machine, and completes the synchronization of offline page data and initial real-time data (such as calculation results); S3.2, Synchronization in Operation (For the synchronization flow chart in operation, please refer to Figure 4 ): When the system is in normal operation, the main controller and the standby controller will periodically synchronize real-time page data and offline page data to keep all configurations, files, data, and status of the main and standby machines consistent. This ensures that the standby machine can seamlessly connect to the current control state when taking over the main machine tasks, avoiding errors caused by data asynchrony. Among them, data synchronization adopts incremental synchronization, that is, only the changed data is transmitted to reduce network bandwidth usage; - Offline page data synchronization: When the host computer downloads or deletes POU files, the host computer will forward these commands to the standby computer for synchronization; - Real-time data synchronization: During operation, the master machine periodically sends real-time data (such as IO data, set value data, intermediate variables, etc.) to the standby machine, which then updates its own status after receiving it. The specific steps are as follows: (1) Data acquisition: After the system is started, the data synchronization buffers are initialized on the master and slave machines respectively, and a data synchronization service thread is created. The master collects the current real-time data (such as IO data, value setting data, and intermediate variables) and saves it in the corresponding value setting and IO buffers; (2) Data transmission: The host sends real-time data to the standby machine periodically through a synchronization thread based on a fixed time period or a trigger event; (3) Data reception: The standby machine receives data from the host machine through the synchronous service thread and stores it in the corresponding buffer, updating its own real-time page data and operating status; (4) Data Verification: During data transmission, the standby machine performs a CRC check on the received data to ensure data integrity. If the standby machine successfully receives and processes the data, it sends a confirmation message to the host machine to confirm successful synchronization. If the standby machine fails to receive the data (for example, data loss or transmission error), it sends an error message and the host machine attempts to resend the data. (5) Exception handling: If a data transmission anomaly is detected during the synchronization process (such as multiple transmission failures), a system alarm will be triggered and corresponding recovery measures will be taken (such as restarting the synchronization thread or performing master-slave switching).

[0033] Compared with the traditional data synchronization method, the data synchronization method of the present invention has the following beneficial effects: Traditional dual-redundancy strategies usually rely on a single real-time data synchronization. After the control system is started, the configuration information needs to be manually downloaded to the primary controller and the backup controller respectively. Since this strategy is highly dependent on the real-time network, it is easy to cause data synchronization lags in the case of network jitter or insufficient bandwidth, affecting the efficiency of fault switching. At the same time, traditional full real-time synchronization occupies a large network bandwidth and has low synchronization efficiency. Therefore, in the case of system restart or network instability, inconsistency between the primary and backup controllers is likely to occur. The redundant strategy of the present invention jointly realizes offline file synchronization and incremental real-time synchronization, and automatically synchronizes the basic offline data of the primary and backup controllers (such as configuration information, historical data, configuration files, etc.) when the system starts, ensuring the consistency of the primary and backup controllers after startup, thereby reducing manual operation. During operation, real-time incremental synchronization is used to maintain the consistency of real-time data (such as control instructions, sensor data, operation information, etc.) to reduce network bandwidth usage, so that the standby controller has the ability to take over at any time, ensuring the seamlessness of the fault switching process and the stability of the system's continuous operation. Offline synchronization is equivalent to a one-time full data backup, while real-time synchronization is a continuous incremental data update. The combination of the two can not only avoid the risk of data loss caused by relying solely on real-time synchronization, but also reduce the network pressure caused by each full synchronization. This strategy can not only improve data transmission efficiency under high load conditions, but also enhance the reliability of system fault switching, making it suitable for industrial control systems with complex networks and high real-time requirements.

[0034] The fault tolerance of the method of the present invention is compared with that of the traditional method, and the enhancement is as follows: Fault tolerance of traditional methods: Traditional dual-redundancy systems typically rely on a single network or simple hardware redundancy mechanisms. Once a network port or a network link fails, communication between the active and standby controllers will be affected. This is especially true in industrial sites with complex network environments and high levels of interference. The system's fault tolerance often fails to meet actual requirements, significantly reducing system availability and stability. Fault tolerance of the method of the present invention: The present invention enhances the fault tolerance of the system through the redundant design of four network ports. When a certain network port or network link fails, it can automatically switch to other network ports to continue to maintain heartbeat signals and data transmission, ensuring the continuous operation of the system and enabling the system to adapt to complex network environments, thereby enhancing the stability and security of the overall system and reducing the risk of downtime due to network failures.

[0035] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and alterations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A dual-redundancy design method for a virtual controller VDPU, characterized in that: The following steps are involved: Divide the four physical network ports into two groups of independent channels, configure an automatic network link switching mechanism, monitor the working status of the four network ports in real time, and then achieve dual isolation of the physical layer and protocol layer, and establish an independent heartbeat transmission channel; The main controller and the backup controller periodically exchange status information packets through an independent heartbeat transmission channel, and at the same time establish a three-level fault judgment mechanism to achieve seamless switching between the main controller and the backup controller; Start initialization synchronization, runtime incremental synchronization, and exception recovery synchronization between the primary and backup controllers.

2. A dual-redundancy design method for a virtual controller VDPU according to claim 1, characterized in that: The two groups of independent channels are: the first group is dedicated to heartbeat signal transmission, establishing a bidirectional redundant heartbeat link between the active and standby controllers; the second group is dedicated to control data and synchronization information transmission, realizing high-speed data channels and backup channels.

3. The dual-redundancy design method for a virtual controller VDPU according to claim 1, characterized in that: The automatic switching mechanism of the configured network link: when a failure of any network port or link is detected, the channel where the backup network port is located is automatically enabled to maintain communication.

4. The dual-redundancy design method for a virtual controller VDPU according to claim 1, characterized in that: The active and standby controllers periodically exchange status information packets through a dedicated heartbeat channel, including controller role identification, process health status code and task execution progress mark.

5. The dual-redundancy design method for a virtual controller VDPU according to claim 1, characterized in that: The three-level fault judgment mechanism is as follows: when the first heartbeat is lost, link diagnosis is automatically triggered; when two consecutive heartbeats are lost, standby machine pre-activation is automatically started; when three consecutive heartbeats are not responded, the host is judged to be faulty.

6. A dual-redundancy design method for a virtual controller VDPU according to claim 1, characterized in that: The seamless master-slave switching includes: a. Freeze the host process and generate a memory snapshot; b. Synchronize real-time status data through a dedicated data channel; c. After the standby machine takes over, it reconstructs the control context and updates the topology broadcast; d. After the original host is restored, it is automatically downgraded to a hot standby node.

7. The dual-redundancy design method for a virtual controller VDPU according to claim 1, characterized in that: The startup of the initialization synchronization includes: initiating a full data request when the standby machine starts, obtaining the POU configuration file and CRC check code of the host, adopting a differential synchronization strategy, only transmitting the configuration file that does not match the CRC, and completing the offline page data mirror construction and operating environment preloading.

8. The dual-redundancy design method for a virtual controller VDPU according to claim 1, characterized in that: The operation of the incremental synchronization includes: a. The host maintains a double buffer: a real-time data buffer and a configuration change buffer; b. Implement dual-mode periodic synchronization and event-triggered synchronization: (1) Cycle synchronization: compress and transmit real-time data difference packets; (2) Event triggering: Instant synchronization of key operations; c. When the backup machine verification fails, the data packet retransmission is triggered, and three consecutive transmission failures activate the abnormal recovery process.

9. The dual-redundancy design method for a virtual controller VDPU according to claim 1, characterized in that: The abnormal recovery synchronization: when the network is interrupted, the breakpoint resume transmission is started, and the data is supplemented based on the sequence number. When the hardware fails to switch, the emergency synchronization mode is enabled and the key control parameters are transmitted first.

10. The dual-redundancy design method for a virtual controller VDPU according to claim 1, characterized in that: The design elements of the design method include: dual-channel physical isolation mechanism, intelligent data synchronization strategy and multi-level fault-tolerant architecture.

Images