Clock synchronization method and device between redundancies of redundancy computer and redundancy computer

Abstract

The invention relates to an inter-redundancy clock synchronization method and device of a redundancy computer and the redundancy computer, relates to the field of computers, and solves the technical problems of poor fault-tolerant capability and low synchronization precision of an existing inter-redundancy clock synchronization mechanism of the redundancy computer. The method comprises the following steps: step S100, determining whether other redundancies in a redundancy computer do not send a first synchronization signal to the redundancy or not according to a first synchronization timer, if so, outputting a synchronization failure result, and otherwise, entering step S200; step S200, determining a first target redundancy which has sent a first synchronization signal to the redundancy in the remaining redundancies according to a second synchronous timer; step S300, determining whether all first target redundancies do not send second synchronization signals to the redundancies or not according to the first synchronous timer, and if not, entering step S400; and step S400, determining a second target redundancy which has sent a second synchronization signal to the redundancy in all the first target redundancies according to the second synchronous timer.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and device for synchronizing redundant clocks between redundant computers and the redundant computers. Background Art

[0002] Redundant computers typically require high-precision clock synchronization to align the times between multiple redundant nodes and ensure that each node's task cycle begins at the same time. Traditionally, synchronization between redundant nodes in redundant computers is performed using software. Specifically, the software in each node pulls its synchronization output signal high and low and monitors the high and low levels of its synchronization input to determine the synchronization time point, ultimately achieving clock synchronization between the nodes.

[0003] Traditional software-based inter-redundancy clock synchronization has the following problems:

[0004] 1. There is no fault tolerance mechanism. In the traditional synchronization method, if one redundancy fails to send a synchronization signal on time, the synchronization process of all redundancies will fail.

[0005] 2. Poor synchronization accuracy. Since the software operates the external I / O port slowly and the response time is uncertain, the final synchronization accuracy is poor.

[0006] 3. Traditional synchronization methods will occupy extra processor resources.

[0007] In typical applications of redundant flight control computers such as flight control systems, the synchronization accuracy, fault tolerance and consumption of processor resources will seriously affect the mission cycle, system performance and system fault tolerance of the flight control system. Summary of the Invention

[0008] In view of the above analysis, the embodiments of the present invention aim to provide a redundant computer inter-redundancy clock synchronization method, device and redundant computer to solve the technical problems of poor fault tolerance and low synchronization accuracy of the existing redundant computer inter-redundancy clock synchronization mechanism.

[0009] In a first aspect, an embodiment of the present invention provides a method for synchronizing clocks between redundant computers, comprising the following steps:

[0010] Step S100: starting a first synchronization timer and determining, based on the first synchronization timer, whether the remaining redundancies in the redundant computer have not sent a first synchronization signal to the current redundancy computer; if so, outputting a synchronization failure result; otherwise, proceeding to step S200;

[0011] Step S200: closing the first synchronization timer and starting a second synchronization timer, and determining, according to the second synchronization timer, a first target margin among the remaining margins that has sent the first synchronization signal to the current margin;

[0012] Step S300: re-starting the first synchronization timer and determining whether all the first target margins have not sent the second synchronization signal to the current margin according to the first synchronization timer; if so, outputting a synchronization failure result; otherwise, proceeding to step S400;

[0013] Step S400: Turn off the first synchronization timer again and start the second synchronization timer again, and determine the second target margin among all the first target margins that have sent the second synchronization signal to the current margin based on the second synchronization timer, wherein the second target margin is the margin that has successfully synchronized with the current margin.

[0014] Based on a further improvement of the above method, step S100 includes:

[0015] Starting a first synchronization timer and outputting a first synchronization output signal of the current redundancy to the other redundancy;

[0016] If the current redundancy receives the first synchronization signal sent by any of the remaining redundancies before the first synchronization timer reaches the end of the timing, the process proceeds to step S200; otherwise, a synchronization failure result is output.

[0017] Based on a further improvement of the above method, determining, according to the second synchronization timer, the first target margin of the remaining margins that has sent the first synchronization signal to the current margin in step S200 includes:

[0018] Step 201: If the current margin receives the first synchronization signal from any new margin among the remaining margins before the second synchronization timer reaches its end, the new margin is recorded as the first target margin and the process proceeds to step 202;

[0019] Step 202: Clear the second synchronization timer and restart the timing, and enter step 201 until the second synchronization timer reaches the timing end.

[0020] Based on a further improvement of the above method, step S300 includes:

[0021] Restarting the first synchronization timer and outputting the second synchronization output signal of the current margin to all the first target margins;

[0022] If the current margin receives the second synchronization signal sent by any margin among all the first target margins before the first synchronization timer reaches the end of the timing, the process proceeds to step S400; otherwise, a synchronization failure result is output.

[0023] Based on a further improvement of the above method, the determining, according to the second synchronization timer, the second target margins of all the first target margins that have sent the second synchronization signal to the current margin in step S400 includes:

[0024] Step 401: If the current margin receives the second synchronization signal from any new margin among all the first target margins before the second synchronization timer reaches its end, the new margin is recorded as the second target margin and the process proceeds to step 402.

[0025] Step 402: Clear the second synchronization timer and restart the timing, and enter step 401 until the second synchronization timer reaches the timing end.

[0026] Based on a further improvement of the above method, the first synchronization timer includes a first timer, the second synchronization timer includes a plurality of second timers, and determining the first target margin among the remaining margins that has sent the first synchronization signal to the current margin according to the second synchronization timer in step S200 includes:

[0027] Step 210: If the current margin receives the first synchronization signal from any new margin among the remaining margins before the i-th second timer reaches its end, the new margin is recorded as the first target margin and the process proceeds to step 220, where the initial value of i is 1.

[0028] Step 220: close the i-th second timer and open the i+1-th second timer, and proceed to step 210 until the (N-1)-th second timer reaches the end of timing, where N is the number of redundancies.

[0029] Based on a further improvement of the above method, the first synchronization timer includes a first timer, the second synchronization timer includes a plurality of second timers, and determining the second target margin of the remaining margins that has sent the second synchronization signal to the current margin according to the second synchronization timer in step S400 includes:

[0030] Step 410: If the current margin receives the second synchronization signal from any new margin among all the first target margins before the i-th second timer reaches the end of the timing, the new margin is recorded as the second target margin and the process proceeds to step 420, where the initial value of i is 1.

[0031] Step 420: close the i-th second timer and open the i+1-th second timer, and proceed to step 410 until the (N-1)-th second timer reaches the end of timing, where N is the number of redundancies.

[0032] Based on a further improvement of the above method, the first synchronization timer includes a first timer, and the second synchronization timer includes a second timer.

[0033] In a second aspect, an embodiment of the present invention provides a flight control system, wherein the flight control system is a redundant computer, each redundancy comprising:

[0034] a central processing unit (CPU), wherein the CPU operates according to a clock signal;

[0035] A programmable logic device, wherein the programmable logic device is in communication with the central processing unit;

[0036] The programmable logic device is used to execute the method for synchronizing clocks between redundant computers according to any one of the first aspects of the embodiments of the present invention so as to keep the clock signals between the redundant computers synchronized.

[0037] In a third aspect, an embodiment of the present invention provides a redundant computer inter-redundancy clock synchronization device, comprising:

[0038] a first determining module configured to start a first synchronization timer and determine, based on the first synchronization timer, whether all other redundancies in the redundancy computer have not sent a first synchronization signal to the current redundancy computer; if so, output a synchronization failure result; otherwise, call a second determining module;

[0039] a second determining module configured to stop the first synchronization timer and start a second synchronization timer, and determine, according to the second synchronization timer, a first target margin among the remaining margins that has sent the first synchronization signal to the current margin;

[0040] a third determining module configured to restart the first synchronization timer and determine, based on the first synchronization timer, whether all the first target margins have not sent the second synchronization signal to the current margin; if so, output a synchronization failure result; otherwise, call the fourth determining module;

[0041] The fourth determination module is configured to turn off the first synchronization timer again and start the second synchronization timer again, and determine, based on the second synchronization timer, a second target margin among all the first target margins that has sent the second synchronization signal to the current margin, wherein the second target margin is a margin that has successfully synchronized with the current margin.

[0042] Compared with the prior art, the present invention can achieve at least one of the following beneficial effects:

[0043] 1. The present invention realizes partial synchronization function by setting two different timeout timers and controlling their opening, closing and clearing operations at appropriate times, and has strong fault tolerance.

[0044] 2. The solution of the present invention uses a field-programmable logic device (FPGA) to implement the synchronization function. By offloading the synchronization task to the hardware FPGA, it releases processor resources and significantly improves the synchronization accuracy.

[0045] In the present invention, the above-mentioned technical solutions can be combined with each other to achieve more preferred combinations. Other features and advantages of the present invention will be described in the following description, and some advantages will become apparent from the description or be learned through practice of the present invention. The objectives and other advantages of the present invention can be realized and obtained through the contents particularly pointed out in the description and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The accompanying drawings are only used for the purpose of illustrating specific embodiments and are not to be considered as limiting the present invention. Throughout the drawings, the same reference symbols denote the same components.

[0047] Figure 1 The system block diagram of the traditional redundant computer inter-redundancy clock synchronization mechanism is shown.

[0048] Figure 2 The system block diagram of the redundant inter-computer clock synchronization mechanism according to an embodiment of the present invention is shown.

[0049] Figure 3 A flow chart of a method for synchronizing redundant clocks between redundant computers according to an embodiment of the present invention is shown.

[0050] Figure 4 Another flow chart of a method for synchronizing redundant clocks between redundant computers according to an embodiment of the present invention is shown.

[0051] Figure 5 The figure shows a schematic structural diagram of a redundant computer inter-redundancy clock synchronization device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0052] The preferred embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, and are not used to limit the scope of the present invention.

[0053] Figure 1 The system block diagram of the traditional redundant computer inter-redundancy clock synchronization mechanism is shown in FIG. Figure 1As shown, the redundant computer has three redundancies, each redundancy represents a computing system, each redundancy includes a central processing unit ("CPU"), and the processors of the three redundancies are Figure 1 They are marked as "CPU0", "CPU1" and "CPU2" respectively.

[0054] The following describes a conventional method for synchronizing clocks between redundant computers, taking the synchronization of the first redundant computer (i.e., "CPU0") to the second redundant computer ("CPU1") and the third redundant computer ("CPU2") as an example. The conventional method for synchronizing clocks between redundant computers includes the following steps:

[0055] 1. The software on CPU0 pulls up its own output synchronization signal at the synchronization start time;

[0056] 2. The software on CPU0 detects the wraparound of its own output signal and whether the synchronization signals of other redundancy inputs are pulled high;

[0057] 3. After the software on CPU0 detects that the synchronization signals of other redundancies are all pulled high, the software on CPU0 will pull the synchronization signal of its own redundancy output low, otherwise it will output the result of synchronization failure;

[0058] 4. The software on CPU0 detects whether its own output signal wraps around and the synchronization signals of other redundancy inputs are pulled low;

[0059] 5. After the software on CPU0 detects that the synchronization signals of other redundancy inputs are all pulled low, the software updates the system time and the synchronization is completed. Otherwise, the result of synchronization failure is output.

[0060] It should be noted that the method steps for synchronizing CPU1 to CPU2 and CPU0 and CPU2 to CPU0 and CPU1 are the same as the above steps.

[0061] From the above description, it can be seen that in the traditional method of clock synchronization between redundant computers, CPU0 needs to detect the synchronization signals of all other redundant computers to complete clock synchronization. Therefore, there are only two synchronization results for CPU0: one is that clock synchronization is completed with all redundant computers, and the other is that clock synchronization is not completed with any redundant computers. Figure 2 FIG1 shows a system block diagram of a redundant computer inter-redundancy clock synchronization mechanism according to an embodiment of the present invention. Figure 2 As shown, the redundant computer has three redundancies, each of which includes a central processing unit ("CPU"). The processors of the three redundancies are Figure 2In the figures, they are labeled "CPU0," "CPU1," and "CPU2," respectively. Furthermore, each redundant computer in the redundant computer includes a programmable logic device ("FPGA") that communicates and interconnects with the central processing unit. The programmable logic device includes a first synchronization timer and a second synchronization timer. The first synchronization timer can be one or more first timers, and the second synchronization timer can be one or more second timers. The first timer and the second timer can be the same or different types of timers.

[0062] The following describes a method for synchronizing clocks between redundant computers in one embodiment of the present invention, taking the first redundant computer (i.e., "CPU0") as an example. The method for synchronizing clocks between redundant computers in this embodiment includes the following steps:

[0063] 1. At the preset synchronization start time or when CPU0 issues a synchronization command, the clock synchronization process begins. First, FPGA0 sets the synchronization signal it outputs to each remaining device to a high level and simultaneously starts a first timer.

[0064] 2. If the first timer reaches the end of the timing and no synchronization high level is detected from any other redundancy, the synchronization process is exited and the synchronization task is declared a failure.

[0065] 3. If any other timer sends a synchronous high level before the first timer reaches the end of the timing, the first timer is turned off and a second timer is started at the same time;

[0066] 4. If any other device detects a synchronous high level before the second timer reaches the end of the timing, the second timer is cleared and the timing is restarted;

[0067] 5. If it is detected that all other margins have sent a synchronous high level before the second timer reaches the end of the timing, go to step 7;

[0068] 6. If the second timer reaches the end of the time, go to step 7;

[0069] 7. All margins for successfully sending the synchronization high level are recorded, FPGA0 sets its own output synchronization level to a low level, and restarts the first timer;

[0070] 8. If the first timer reaches the end of the timing and no synchronization low level is detected from any other redundancy, the synchronization process is exited and the synchronization task is declared failed;

[0071] 9. If any other timer is detected to have issued a synchronous low level before the first timer reaches the end of the timing, the first timer is turned off and the second timer is turned on again;

[0072] 10. If any other device sends out a synchronous low level before the second timer reaches the end of the timing, the second timer is cleared and the timing is restarted;

[0073] 11. If it is detected that all the margins recorded in step 7 have sent a synchronous low level before the second timer reaches the end of the timing, the synchronization is completed, a completion interrupt is sent to the CPU, and the synchronization status is reported. The margin that has been successfully synchronized is the margin recorded in step 7.

[0074] 12. If the second timer reaches the end of the timing, the synchronization ends, the current margin that has sent a low level is recorded, a completion interrupt is sent to the CPU, and the synchronization status is reported. The intersection of the recorded margin that has sent a low level and the margin recorded in step 7 is the margin for successful synchronization.

[0075] Figure 3 FIG. 5 is a flow chart showing a method for synchronizing clocks between redundant computers according to the above embodiment. Figure 3 As shown, the process includes:

[0076] 1. First, determine whether the synchronization time has arrived. If so, send a synchronization high level and start the first timer at the same time. Otherwise, continue to determine whether the synchronization time has arrived.

[0077] 2. Determine whether the first timer has timed out. If so, synchronization fails and the processor interrupt notification synchronization status is reported. Otherwise, proceed to the next step.

[0078] 3. Determine whether other redundancies have emitted a synchronous high level; if so, turn off the first timer and turn on the second timer, otherwise return to the previous step;

[0079] 4. Determine whether the second timer has timed out. If so, record the margin of successfully sending the synchronous high level, send the synchronous low level, start the first timer again, and proceed to step 7. Otherwise, proceed to the next step.

[0080] 5. Determine whether a new margin is detected to have issued a synchronous high level. If so, restart the second timer and proceed to the next step.

[0081] 6. Determine whether all other margins have sent a synchronous high level. If so, record the margin that successfully sent a synchronous high level and send a synchronous low level and start the first timer again and go to step 7. Otherwise, go to step 4.

[0082] 7. Determine whether the first timer has timed out. If so, synchronization fails and the processor interrupt notification synchronization status is reported. Otherwise, proceed to the next step.

[0083] 8. Determine whether other redundancies have issued a synchronous low level; if so, turn off the first timer and turn on the second timer, otherwise return to the previous step;

[0084] 9. Determine whether the second timer has timed out. If so, record the margin for successfully sending the synchronization low level and intersect it with the previously recorded margin set for sending the synchronization high level. This intersection is the set of margins for successful synchronization and proceed to step 12. Otherwise, proceed to the next step.

[0085] 10. Determine whether a new margin is detected to have issued a synchronous low level. If so, restart the second timer and proceed to the next step.

[0086] 11. Determine whether all previously recorded margins for sending synchronization high levels have already sent synchronization low levels. If so, record the margins for successfully sending synchronization low levels and intersect them with the previously recorded margins for sending synchronization high levels. This intersection is the set of successfully synchronized margins and proceed to step 12. Otherwise, proceed to step 9.

[0087] 12. Report processor interrupt and notify synchronization status.

[0088] The following describes a method for synchronizing clocks between redundant computers in another embodiment of the present invention, taking the first redundant computer (i.e., "CPU0") as an example. The method for synchronizing clocks between redundant computers in this embodiment includes the following steps:

[0089] 1. At the preset synchronization start time or when CPU0 issues a synchronization command, the clock synchronization process begins. First, FPGA0 sets the synchronization signal it outputs to each remaining device to a high level and simultaneously starts a first timer.

[0090] 2. If the first timer reaches the end of the timing and no synchronization high level is detected from any other redundancy, the synchronization process is exited and the synchronization task is declared a failure.

[0091] 3. If any other timer sends a synchronous high level before the first timer reaches the end of the timing, the first timer is turned off and the first second timer is started at the same time;

[0092] 4. If any other redundancy is detected to have issued a synchronous high level before the xth second timer reaches the end of the timing, the xth second timer is turned off and the x+1th second timer is turned on at the same time, and the initial value of x is 1;

[0093] 5. If in the xth max Before the second timer reaches the end of the timing, it is detected that all other margins have sent a synchronous high level, and then the process goes to step 7, where x maxEqual to N-1, N is the number of redundant computers;

[0094] 6. If the xth max When the second timer reaches the end of the timing, go to step 7;

[0095] 7. All margins for successfully sending the synchronization high level are recorded, FPGA0 sets its own output synchronization level to a low level, and restarts the first timer;

[0096] 8. If the first timer reaches the end of the timing and no synchronization low level is detected from any other redundancy, the synchronization process is exited and the synchronization task is declared failed;

[0097] 9. If any other timer is detected to have issued a synchronous low level before the first timer reaches the end of the timing, the first timer is turned off and the first and second timers are turned on again;

[0098] 10. If any other timer is detected to have issued a synchronous low level before the xth second timer reaches the end of the timing, the xth second timer is turned off and the x+1th second timer is turned on at the same time. The initial value of x is 1.

[0099] 11. If in the xth max Before the second timer reaches the end of the timing, it is detected that all the margins recorded in step 7 have sent the synchronization low level, the synchronization is completed, a completion interrupt is sent to the CPU, and the synchronization status is reported. The margin that has been successfully synchronized is the margin recorded in step 7.

[0100] 12. If the xth max When the second timer reaches the end of the timing, the synchronization ends, the margin of the current low level that has been sent is recorded, a completion interrupt is sent to the CPU, and the synchronization status is reported. The intersection of the recorded margin of the low level that has been sent and the margin recorded in step 7 is the margin for successful synchronization.

[0101] Figure 4 FIG. 1 is a flow chart showing a method for synchronizing clocks between redundant computers according to an embodiment of the present invention. Figure 4 As shown, the redundant computer inter-redundancy clock synchronization method includes:

[0102] Step S100: Start the first synchronization timer and determine whether the other redundancies in the redundancy computer have not sent the first synchronization signal to the current redundancy computer according to the first synchronization timer. If so, output the result of synchronization failure. Otherwise, go to step S200.

[0103] In this embodiment, the first synchronization timer may be a first timer.

[0104] In this embodiment, the first synchronization signal can be the above combination Figure 2 A high level signal in the described embodiments.

[0105] The above has been combined Figure 2 The “determining whether all other redundancies in the redundancy computer have not sent the first synchronization signal to the current redundancy computer according to the first synchronization timer” in this embodiment has been explained and will not be repeated here.

[0106] Step S200: the first synchronization timer is closed and the second synchronization timer is started, and a first target margin among the remaining margins that has sent the first synchronization signal to the current margin is determined according to the second synchronization timer.

[0107] In this embodiment, the second synchronization timer can be one second timer or multiple second timers. Figure 2 The “determining, according to the second synchronization timer, the first target margin among the remaining margins that has sent the first synchronization signal to the current margin” in this embodiment has been explained and will not be repeated here.

[0108] Step S300: Start the first synchronization timer again and determine whether all first target margins have not sent the second synchronization signal to the current margin according to the first synchronization timer. If so, output a synchronization failure result; otherwise, go to step S400.

[0109] In this embodiment, the second synchronization signal can be the above combination Figure 2 A low level signal in the described embodiment.

[0110] The above has been combined Figure 2 The “determining, according to the first synchronization timer, whether all first target margins have not sent the second synchronization signal to the current margin” in this embodiment has been explained and will not be repeated here.

[0111] Step S400: The first synchronization timer is turned off again and the second synchronization timer is started again. The second target margins among all first target margins that have sent the second synchronization signal to the current margin are determined according to the second synchronization timer, wherein the second target margin is the margin that has successfully synchronized with the current margin.

[0112] In this embodiment, the second synchronization timer can be one second timer or multiple second timers. Figure 2 The “determining, according to the second synchronization timer, the second target margins among all the first target margins that have sent the second synchronization signal to the current margin” in this embodiment has been explained and will not be repeated here.

[0113] Figure 5FIG. 1 shows a redundant computer clock synchronization device according to an embodiment of the present invention. Figure 5 As shown, the redundancy inter-computer clock synchronization device of this embodiment includes: a first determination module 501, configured to start a first synchronization timer and determine, based on the first synchronization timer, whether all remaining redundancies in the redundancy computer have not sent a first synchronization signal to the current redundancy; if so, output a synchronization failure result; otherwise, call a second determination module; a second determination module 502, configured to stop the first synchronization timer and start a second synchronization timer, and determine, based on the second synchronization timer, a first target redundancy among the remaining redundancies that has sent the first synchronization signal to the current redundancy; a third determination module 503, configured to restart the first synchronization timer and determine, based on the first synchronization timer, whether all first target redundancies have not sent a second synchronization signal to the current redundancy; if so, output a synchronization failure result; otherwise, call a fourth determination module; a fourth determination module 504, configured to again stop the first synchronization timer and restart the second synchronization timer, and determine, based on the second synchronization timer, a second target redundancy among all first target redundancies that has sent the second synchronization signal to the current redundancy, wherein the second target redundancy is a redundancy that has successfully synchronized with the current redundancy.

[0114] It should be understood that Figure 5 The modules and references in the device record Figure 4 Therefore, the operations and features described above for the method are also applicable to Figure 5 The devices and modules contained therein are not described in detail here.

[0115] An embodiment of the present invention further provides a flight control system, which is a redundant computer, each redundancy including:

[0116] a central processing unit, which operates according to a clock signal;

[0117] A programmable logic device, wherein the programmable logic device is in communication with the central processing unit;

[0118] The programmable logic device is used to execute any one of the above-described methods for synchronizing clocks between redundant computers in accordance with the present invention so as to keep clock signals between the redundant computers synchronized.

[0119] Compared with the prior art, the embodiments of the present invention can achieve at least one of the following beneficial effects:

[0120] 1. The present invention realizes partial synchronization function by setting two different timeout timers and controlling their opening, closing and clearing operations at appropriate times, and has strong fault tolerance.

[0121] 2. The solution of the present invention uses a field-programmable logic device (FPGA) to implement the synchronization function. By offloading the synchronization task to the hardware FPGA, it releases processor resources and significantly improves the synchronization accuracy.

[0122] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or replacements that can be easily conceived by any technician familiar with this technical field within the technical scope disclosed by the present invention should be covered by the scope of protection of the present invention.

Claims

1. A method for synchronizing redundant clocks between redundant computers, characterized in that: The steps include: Step S100: starting a first synchronization timer and determining, based on the first synchronization timer, whether the remaining redundancies in the redundant computer have not sent a first synchronization signal to the current redundancy computer; if so, outputting a synchronization failure result; otherwise, proceeding to step S200; Step S200: closing the first synchronization timer and starting a second synchronization timer, and determining, according to the second synchronization timer, a first target margin among the remaining margins that has sent the first synchronization signal to the current margin; Step S300: re-starting the first synchronization timer and determining whether all the first target margins have not sent the second synchronization signal to the current margin according to the first synchronization timer; if so, outputting a synchronization failure result; otherwise, proceeding to step S400; Step S400: Turn off the first synchronization timer again and start the second synchronization timer again, and determine the second target margin among all the first target margins that have sent the second synchronization signal to the current margin based on the second synchronization timer, wherein the second target margin is the margin that has successfully synchronized with the current margin.

2. The method according to claim 1, characterized in that The step S100 includes: Starting a first synchronization timer and outputting a first synchronization output signal of the current redundancy to the other redundancy; If the current redundancy receives the first synchronization signal sent by any of the remaining redundancies before the first synchronization timer reaches the end of the timing, the process proceeds to step S200; otherwise, a synchronization failure result is output.

3. The method according to claim 1, characterized in that The determining, according to the second synchronization timer, of the first target margin of the remaining margins that has sent the first synchronization signal to the current margin in step S200 includes: Step 201: If the current margin receives the first synchronization signal from any new margin among the remaining margins before the second synchronization timer reaches its end, the new margin is recorded as the first target margin and the process proceeds to step 202; Step 202: Clear the second synchronization timer and restart the timing, and enter step 201 until the second synchronization timer reaches the timing end.

4. The method according to claim 1, wherein The step S300 includes: Restarting the first synchronization timer and outputting the second synchronization output signal of the current margin to all the first target margins; If the current margin receives the second synchronization signal sent by any margin among all the first target margins before the first synchronization timer reaches the end of the timing, the process proceeds to step S400; otherwise, a synchronization failure result is output.

5. The method according to claim 1, characterized in that The determining, according to the second synchronization timer, of the second target margins of all the first target margins that have sent the second synchronization signal to the current margin in step S400 includes: Step 401: If the current margin receives the second synchronization signal from any new margin among all the first target margins before the second synchronization timer reaches its end, the new margin is recorded as the second target margin and the process proceeds to step 402. Step 402: Clear the second synchronization timer and restart the timing, and enter step 401 until the second synchronization timer reaches the timing end.

6. The method according to claim 1, characterized in that The first synchronization timer includes a first timer, the second synchronization timer includes a plurality of second timers, and determining the first target margin of the remaining margins that has sent the first synchronization signal to the current margin according to the second synchronization timer in step S200 includes: Step 210: If the current margin receives the first synchronization signal from any new margin among the remaining margins before the i-th second timer reaches its end, the new margin is recorded as the first target margin and the process proceeds to step 220, where the initial value of i is 1. Step 220: close the i-th second timer and open the i+1-th second timer, and proceed to step 210 until the (N-1)-th second timer reaches the end of timing, where N is the number of redundancies.

7. The method according to claim 1, characterized in that The first synchronization timer includes a first timer, the second synchronization timer includes a plurality of second timers, and the determining, according to the second synchronization timer, in step S400, of the second target margin of the remaining margins that has sent the second synchronization signal to the current margin includes: Step 410: If the current margin receives the second synchronization signal from any new margin among all the first target margins before the i-th second timer reaches the end of the timing, the new margin is recorded as the second target margin and the process proceeds to step 420, where the initial value of i is 1. Step 420: close the i-th second timer and open the i+1-th second timer, and proceed to step 410 until the N-1-th second timer reaches the end of timing, where N is the number of redundancies.

8. The method according to claim 1, characterized in that The first synchronization timer includes a first timer, and the second synchronization timer includes a second timer.

9. A flight control system characterized by: The flight control system is a redundant computer, each redundancy includes: a central processing unit (CPU), wherein the CPU operates according to a clock signal; A programmable logic device, wherein the programmable logic device is in communication with the central processing unit; The programmable logic device is used to execute the redundant inter-computer clock synchronization method according to any one of claims 1 to 8 so as to keep the clock signals between the redundant computers synchronized.

10. A redundant computer clock synchronization device, characterized in that: include: a first determining module configured to start a first synchronization timer and determine, based on the first synchronization timer, whether all other redundancies in the redundancy computer have not sent a first synchronization signal to the current redundancy computer; if so, output a synchronization failure result; otherwise, call a second determining module; a second determining module configured to stop the first synchronization timer and start a second synchronization timer, and determine, according to the second synchronization timer, a first target margin among the remaining margins that has sent the first synchronization signal to the current margin; a third determining module configured to restart the first synchronization timer and determine, based on the first synchronization timer, whether all the first target margins have not sent the second synchronization signal to the current margin; if so, output a synchronization failure result; otherwise, call the fourth determining module; The fourth determination module is configured to turn off the first synchronization timer again and start the second synchronization timer again, and determine, based on the second synchronization timer, a second target margin among all the first target margins that has sent the second synchronization signal to the current margin, wherein the second target margin is a margin that has successfully synchronized with the current margin.

Images