A Redundant PLC Control System and Method for Fault Location and Dynamic Reconfiguration

Abstract

This invention relates to the field of automation control technology, specifically to a redundant PLC control system and method for fault location and dynamic reconfiguration. The method includes: collecting operating status data of the main PLC, extracting and constructing a multi-dimensional feature vector; maintaining data synchronization and heartbeat communication between the main PLC and the redundant PLC; deploying a lightweight anomaly detection model on the main PLC to implement real-time fault monitoring, and deploying a deep neural network fault diagnosis model on the host computer to identify the fault type and locate the fault location through two-level joint decision-making; when the main PLC fails, the redundant PLC seamlessly takes over the control task based on the latest synchronization context; after the redundant PLC takes over, it repairs and performs functional testing on the faulty PLC, and after repair, it is configured as a new redundant PLC and synchronization and heartbeat communication are restored, thereby achieving high reliability and dynamic reconfiguration of the PLC system.

Description

Technical Field

[0001] This invention relates to the field of automation control technology, specifically to a redundant PLC control system and method for fault location and dynamic reconfiguration. Background Technology

[0002] In automated control systems, programmable logic controllers (PLCs) are widely used in various industrial settings. However, when the main PLC fails, existing redundant control systems have significant shortcomings in terms of fault identification accuracy, response timeliness, and the continuity of system reconfiguration.

[0003] Existing redundant PLC control systems face challenges in fully guaranteeing the continuity of critical control tasks and system reliability in actual industrial production environments. Specifically, when the main PLC experiences operational abnormalities or malfunctions, it is difficult to accurately pinpoint the type and location of the fault. Furthermore, redundant PLCs lack efficient takeover and recovery methods, as well as precise control restoration capabilities, leading to risks such as response delays, operational interruptions, or loss of status during PLC control handover.

[0004] In view of this, the present invention proposes a redundant PLC control method for fault location and dynamic reconfiguration. Summary of the Invention

[0005] To achieve the above objectives, this invention provides a redundant PLC control system and method for fault location and dynamic reconfiguration, the specific technical solution of which is as follows:

[0006] A redundant PLC control method for fault location and dynamic reconfiguration includes:

[0007] Collect main PLC operating status data, extract main PLC operating status data features, and construct a multi-dimensional feature vector reflecting the main PLC operating status.

[0008] The main PLC and the redundant PLC maintain data synchronization and heartbeat communication. The main PLC periodically sends heartbeat messages to the redundant PLC and periodically transmits control program updates, variable changes and event queue increments to the mirror storage area of ​​the redundant PLC.

[0009] A lightweight anomaly detection model is deployed on the main PLC for real-time fault monitoring, and a deep neural network fault diagnosis model is deployed on the host computer. The fault type is identified through two-level joint decision-making, and the fault location is located based on the fault propagation path analysis.

[0010] When the main PLC fails, the dynamic reconfiguration mechanism is triggered, the redundant PLC takes over the I / O control, continues to execute the control task based on the latest synchronized running context, and sends a switching completion signal to the host computer and records the PLC running status at the time of switching.

[0011] After the redundant PLC takes over, the faulty PLC is maintained. After the faulty PLC is repaired and passes the functional test, the repaired PLC is configured as the new redundant PLC and establishes data synchronization and heartbeat communication with the current master PLC.

[0012] Preferably, the main PLC operating status data is collected, including CPU utilization data, memory usage data, I / O latency data, instruction execution sequence data, and communication error rate data;

[0013] Extract features from the main PLC's operating status data, and construct a multi-dimensional feature vector reflecting the main PLC's operating status from all extracted features.

[0014] Preferably, when the main PLC and the redundant PLC are running simultaneously, a bidirectional heartbeat communication mechanism is established between the main PLC and the redundant PLC, and the main PLC periodically sends heartbeat messages to the redundant PLC; the heartbeat message includes: a hardware identifier field, a running status code field, and a timestamp field;

[0015] While the main PLC and the redundant PLC maintain heartbeat communication, the main PLC and the redundant PLC simultaneously implement an incremental data synchronization strategy; the status changes during the operation of the main PLC are transmitted in real time to the mirror storage area of ​​the redundant PLC, and the status changes include control program updates, variable changes and event queue increments.

[0016] Preferably, the mirror storage area of ​​the redundant PLC adopts a dual-buffered structure, which includes a current running image buffer and an update buffer.

[0017] The redundant PLC performs consistency verification on the received synchronization data, then writes the received synchronization data into the update buffer, and finally completes the buffer switching during the interval of the PLC scan cycle.

[0018] Preferably, a lightweight anomaly detection model is deployed to monitor the main PLC for faults in real time. The lightweight anomaly detection model adopts a multivariate control chart method based on statistical thresholds.

[0019] The lightweight anomaly detection model monitors the constructed multidimensional feature vectors in real time and calculates the Mahalanobis distance of the multidimensional feature vectors to quantify the deviation of the current operating state from the normal baseline.

[0020] When the calculated Mahalanobis distance exceeds the critical value of the chi-square distribution, the lightweight anomaly detection model outputs an abnormal PLC status.

[0021] Preferably, a deep neural network fault diagnosis model is deployed on the host computer of the PLC; the deep neural network fault diagnosis model is a TCN-DBN hybrid model constructed by using a temporal convolutional network (TCN) model and a deep belief network (DBN) model.

[0022] The input layer of the deep neural network fault diagnosis model receives a time-series feature data matrix uploaded in real time by the main PLC. The time-series feature data matrix is ​​a two-dimensional matrix formed by continuously collecting multi-dimensional feature vectors during the operation of the main PLC along the time axis.

[0023] The TCN layer of the TCN model uses a combination of causal convolution and dilated convolution to process temporal feature data. The output of the TCN model is the extracted high-level temporal features.

[0024] The DBN layer of the DBN model receives high-level temporal features extracted by the TCN model and performs unsupervised feature learning and supervised fine-tuning through the stacking of multiple Restricted Boltzmann Machines (RBMs). The visible layer of the first RBM in the DBN model receives the output features of the TCN model and learns the probability distribution of the data through a comparative divergence algorithm. In the DBN model, the hidden layer output of the first RBM serves as the input of the second RBM, and the layers are stacked to form a deep architecture.

[0025] The fault identification process of the deep neural network fault diagnosis model based on the TCN-DBN hybrid model is as follows: the TCN layer extracts temporal features through causal dilated convolution and retains the temporal dynamic information of fault evolution; the DBN layer learns the deep representation of fault modes through layer-by-layer feature abstraction and outputs the probability distribution of each fault type.

[0026] Preferably, a two-level joint decision mechanism is constructed, consisting of a lightweight anomaly detection model and a deep neural network fault diagnosis model;

[0027] The two-level joint decision-making mechanism defines a time window for collaborative decision-making after the lightweight anomaly detection model detects an anomaly.

[0028] Within the time window, the main PLC maintains a dynamically updated anomaly confidence variable. The anomaly confidence is designed using an cumulative approach and sets multiple levels of anomaly confidence thresholds. When different anomaly confidence thresholds are reached, corresponding response measures are triggered.

[0029] Preferably, fault location of the PLC is performed based on the fault propagation path analysis method, and a functional dependency graph of the PLC is established.

[0030] The node set in the PLC's functional dependency graph contains all functional modules, including hardware components such as the CPU core, various I / O units, communication interfaces, and power supply, as well as software functions such as control algorithms, data processing, and human-machine interaction. The set of directed edges E in the functional dependency graph represents the dependencies between nodes, including data flow dependencies, control flow dependencies, and resource sharing dependencies. Each edge is assigned a propagation strength weight, which reflects the probability of a fault propagating from the source node to the target node.

[0031] Preferably, when a PLC anomaly is detected by a lightweight anomaly detection model, all anomaly features are collected to form an observation set;

[0032] A Bayesian inference framework is used to calculate the posterior failure probability of each node. After calculating the posterior failure probability of all nodes, a graph search algorithm is used to trace the propagation path with the highest posterior failure probability. The starting node of the path is the failure source. At the same time, the downstream dependencies of the starting node of the path are analyzed to predict the scope of the failure impact.

[0033] Preferably, the dynamic reconfiguration mechanism is based on two independent detection channels: a model detection channel and a heartbeat monitoring channel. The model detection channel generates a fault trigger signal based on the fault diagnosis results. When the anomaly confidence of the lightweight anomaly detection model exceeds the anomaly confidence threshold and the deep neural network fault diagnosis model confirms that the main PLC has a fault, the heartbeat monitoring channel is implemented in the redundant PLC and determines the operating status of the main PLC by monitoring the reception of the main PLC's heartbeat messages.

[0034] The redundant PLC records the timestamp of the heartbeat message received, and updates the timestamp each time a heartbeat message is received; a heartbeat timeout determination function is defined, and a dynamic jitter tolerance time for the heartbeat timeout determination function is constructed. When the main PLC times out and fails to record a heartbeat message to the redundant PLC, a dynamic reconstruction mechanism is initiated.

[0035] After the redundant PLC completes the takeover of I / O control from the main PLC, the redundant PLC sends a switching completion signal to the host computer. Upon receiving the signal, the host computer updates the topology display of the PLC structure and marks the redundant PLC as the main PLC.

[0036] Preferably, based on the PLC fault types diagnosed by the deep neural network fault diagnosis model, the faults are divided into three categories: software faults, firmware faults, and hardware faults; and corresponding operation and maintenance strategies are adopted according to different fault types.

[0037] After the PLC has been tested and maintained, the PLC that has passed the performance test will be added to the current PLC topology as a new redundant PLC, and at the same time, a synchronization relationship will be re-established with the current master PLC.

[0038] A redundant PLC control system for fault location and dynamic reconfiguration, used to implement the aforementioned redundant PLC control method for fault location and dynamic reconfiguration, includes: a PLC feature extraction module, a PLC interconnection module, a PLC fault diagnosis module, a PLC dynamic reconfiguration module, and a fault PLC operation and maintenance module.

[0039] The PLC feature extraction module collects the main PLC operating status data, extracts the features of the main PLC operating status data, and constructs a multi-dimensional feature vector reflecting the main PLC operating status.

[0040] The PLC interconnection module maintains data synchronization and heartbeat communication between the main PLC and the redundant PLC. The main PLC periodically sends heartbeat messages to the redundant PLC and periodically transmits control program updates, variable changes, and event queue increments to the mirror storage area of ​​the redundant PLC.

[0041] The PLC fault diagnosis module deploys a lightweight anomaly detection model on the main PLC for real-time fault monitoring and a deep neural network fault diagnosis model on the host computer. It identifies the fault type through two-level joint decision-making and locates the fault location based on the fault propagation path analysis.

[0042] When the main PLC fails, the PLC dynamic reconfiguration module triggers a dynamic reconfiguration mechanism, and the redundant PLC takes over the I / O control. Based on the latest synchronized running context, it continues to execute the control task, and at the same time sends a switching completion signal to the host computer and records the PLC running status at the time of switching.

[0043] The faulty PLC maintenance module performs maintenance on the faulty PLC after the redundant PLC takes over. After the faulty PLC is repaired and passes the functional test, the repaired PLC is configured as a new redundant PLC and establishes data synchronization and heartbeat communication with the current main PLC.

[0044] The beneficial effects of this invention are as follows: by extracting multi-dimensional features from the main PLC's operating status data, this invention can comprehensively reflect the operating status of multiple dimensions such as CPU, memory, I / O, program execution, and communication, providing rich and accurate basic data support for anomaly detection and fault diagnosis.

[0045] This invention ensures that the redundant PLC always has access to the latest operating context and control data of the main PLC by implementing data synchronization and heartbeat communication between the main PLC and the redundant PLC. This significantly shortens the data recovery time during main / backup switching and achieves a highly consistent operating state for two or more sets of PLCs, providing a solid foundation for seamless switching and continuous control.

[0046] This invention combines a lightweight anomaly detection model with a deep neural network fault diagnosis model, enabling rapid perception and type identification of PLC faults. The joint decision mechanism improves the response speed and accuracy of detection. Based on fault propagation path analysis, it can achieve precise fault location, providing technical support for timely and effective measures and accurate maintenance.

[0047] When the main PLC fails, this invention automatically triggers a dynamic reconfiguration mechanism, allowing a redundant PLC to seamlessly take over I / O control and continue executing control tasks based on the latest synchronized operating context, ensuring continuous operation of the control system. The switching process is automated and responsive, effectively reducing the risk of system downtime and guaranteeing the continuity and stability of industrial production.

[0048] After the redundant PLC in this invention is taken over, the faulty PLC is then subjected to hierarchical operation and maintenance and automatic repair. After the functional test is completed, the repaired PLC is quickly incorporated into the redundant system to achieve dynamic recovery of redundancy capabilities.

[0049] This invention enables full-dimensional status monitoring, intelligent fault diagnosis, automated and seamless switching, and dynamic redundancy recovery of a primary redundant PLC system. It improves the fault tolerance, response speed, and reliability of the control system, reduces the difficulty of manual maintenance, significantly enhances the safety and availability of industrial automation systems, and meets the continuous control requirements in high-reliability scenarios. Attached Figure Description

[0050] Figure 1 A flowchart of a redundant PLC control method for fault location and dynamic reconfiguration provided by the present invention;

[0051] Figure 2 The flowchart of PLC multi-source data acquisition and feature extraction provided by this invention;

[0052] Figure 3 The flowchart of the PLC hot backup and adaptive synchronization mechanism provided by the present invention;

[0053] Figure 4 The flowchart for PLC fault detection and intelligent diagnosis provided by this invention;

[0054] Figure 5 The flowchart of PLC fault detection triggering and dynamic reconfiguration provided by this invention;

[0055] Figure 6 The present invention provides a structural diagram of a redundant PLC control system for fault location and dynamic reconfiguration. Detailed Implementation

[0056] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0057] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention can also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0058] Secondly, the term "an embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places throughout this specification does not necessarily refer to the same embodiment, nor is it a single embodiment or an embodiment selectively excluded from other embodiments.

[0059] Example 1

[0060] Reference Figure 1 This is the first embodiment of the present invention, which provides a redundant PLC control method for fault location and dynamic reconfiguration.

[0061] Step 1: Collect main PLC operating status data, extract features from the main PLC operating status data, and construct a multi-dimensional feature vector reflecting the main PLC operating status; see [link / reference] Figure 2 This is a flowchart of the PLC multi-source data acquisition and feature extraction process for this step.

[0062] This step utilizes multi-source data acquisition and feature extraction technologies to construct a comprehensive data monitoring system that reflects the operating status of the main PLC. Five key operating status data types are collected at fixed sampling periods through the PLC's built-in monitoring interface and performance counters: CPU utilization data is obtained by reading the PLC processor's task scheduler status register, recording the CPU's busy / idle time ratio within each scan cycle; memory usage data includes the usage of the program storage area, data storage area, and buffer, with the number of bytes used in each area counted through the address mapping table of the memory management unit; I / O latency data is measured by embedding timestamps in the input / output modules to measure the end-to-end delay time from input signal acquisition to output response; instruction execution sequence data records the execution order and execution duration of each functional block in the PLC ladder diagram program, forming the program execution trajectory; and communication error rate data is obtained by adding cyclic redundancy check codes to data frames, and counting the number of detected error bits against the total number of transmitted bits.

[0063] Based on the collected CPU utilization, memory usage, I / O latency, instruction execution sequence, and communication error rate data, multiple operational status features are extracted. For the CPU utilization sequence... , Extract the mean feature for the CPU utilization at the nth sampling time. Variance characteristics and maximum value characteristics ,in, This represents the CPU utilization rate at the i-th sampling time, where n is the number of samples within the sampling window, and max indicates taking the maximum value. The collected CPU characteristics can reflect the average level, fluctuation level, and peak conditions of the CPU load.

[0064] For memory usage sequence , This represents the number of bytes of memory used at the nth sampling time, and the current memory usage feature is extracted. Growth rate characteristics and occupancy characteristics ,in, Indicates the first Number of bytes of memory used at each sampling time. The sampling interval is... The total memory capacity is represented; the collected memory usage characteristics reflect the real-time status and changing trends of memory usage.

[0065] For I / O delay sequence , This represents the delay time of the I / O operation at the nth sampling time, and the average delay feature is extracted. Delayed standard deviation characteristics and timeout count features ,in, Indicates the first The delay time of I / O operation at the next sampling time For indicator functions, The latency threshold is used to quantify the real-time performance and stability of I / O response.

[0066] For instruction execution sequence , Represent the instruction at the nth sampling time, and construct the instruction transfer frequency matrix. , of which elements Indicates from the instruction Transfer to instruction Number of times, This represents a logical AND operation, used to extract the execution ratio feature of the main path. Loop execution count characteristics and abnormal jump characteristics ,in, This is a predefined set of exception jumps; instruction execution characteristics reflect the regularity and abnormal behavior of program execution.

[0067] For a communication error sequence, count the number of error bits within a time window. and total number of transmitted bits Extracting bit error rate features Continuous error-free transmission length characteristics (in For the first (Number of bits transmitted in a continuous error-free segment) and burst error characteristics ;in, and These are the mean and standard deviation of the error interval time, respectively; communication error characteristics can characterize the reliability and interference modes of the communication link.

[0068] All extracted features are combined into a multidimensional feature vector. :

[0069] , This is the transpose of the matrix;

[0070] The constructed multidimensional feature vector comprehensively depicts the operating status of the main PLC in five dimensions: CPU resources, memory resources, I / O performance, program execution, and communication quality.

[0071] This step, by constructing such a structured multidimensional feature representation, can provide rich and complementary state information for subsequent fault detection models, effectively improving the ability to perceive PLC malfunctions and the differentiation of fault modes.

[0072] Step 2: The main PLC and redundant PLC maintain data synchronization and heartbeat communication. The main PLC periodically sends heartbeat messages to the redundant PLC and periodically transmits control program updates, variable changes, and event queue increments to the redundant PLC's mirror storage area; see [link / reference] Figure 3 This is a flowchart of the PLC hot backup and adaptive synchronization mechanism for this step.

[0073] This step ensures seamless switching capabilities when multiple PLCs are operating by establishing a hot backup mechanism and real-time synchronization strategy between the main PLC and redundant PLCs. When both the main PLC and redundant PLCs are running simultaneously, they establish a bidirectional heartbeat communication mechanism through a dedicated redundant communication link. The heartbeat message uses a fixed-format data frame structure containing three key fields: a hardware identifier field representing the PLC's unique serial number and hardware version information, used to identify the legitimacy of the communication peer; a running status code field encoding the current PLC's operating mode, load level, and fault flags, represented using 32-bit binary encoding; and a timestamp field recording the clock value at the time of message transmission, with microsecond-level precision. The heartbeat message transmission cycle... The adaptive heartbeat cycle is dynamically adjusted according to control requirements. This design ensures fault detection sensitivity while avoiding excessive consumption of communication bandwidth.

[0074] While maintaining heartbeat communication between the main PLC and redundant PLCs, both PLCs simultaneously implement an incremental data synchronization strategy; key state changes during the main PLC's operation are transmitted to the redundant PLCs in real time. Control program updates employ a version difference comparison mechanism, with the main PLC maintaining the program version number... When a program modification is detected, the hash value of the modified block is calculated. ,in, This represents the binary code of the e-th program block. This represents a hash algorithm. Only program blocks whose hash values ​​have changed and their offset addresses in the program space are transmitted to reduce the amount of synchronization data. Specifically, variable changes are tracked using a dirty flag technique, assigning a dirty flag to each process variable. When process variables Set when the value changes During the synchronization period Internally, construct the variable update set. , For each index value, the variable index and the new value in the set are packaged and transmitted. After transmission, all dirty flags are cleared. Dirty flag tracking technology can significantly reduce the communication overhead during the synchronization process between the main PLC and redundant PLCs.

[0075] When synchronizing event queues between the main PLC and redundant PLCs, a circular buffer structure is used, with the main PLC maintaining a write pointer. and synchronized pointers Redundant PLC maintains read pointer When a new event is added to the queue, the write pointer follows... Update, in which This represents the queue capacity. The number of events for incremental transmission is... Update after transmission is complete After receiving an event, the redundant PLC updates the read pointer according to the same rules to ensure consistency in event processing.

[0076] To ensure the reliability of data transmission between the main PLC and redundant PLCs, a sequence number is added to each synchronization data packet. and checksum The receiver detects packet loss by sequence number and verifies data integrity by checksum. For detected transmission errors, a retransmission mechanism is triggered. When the retransmission mechanism is triggered, the data receiver sends a retransmission instruction to the data sender. After receiving the instruction, the data sender retransmits the data to the data sender.

[0077] The redundant PLC's mirror storage area employs a dual-buffer structure, comprising a current running image buffer and an update buffer. The redundant PLC verifies the consistency of received synchronization data before writing it to the update buffer. Finally, buffer switching is completed during the PLC scan cycle interval, preventing data update interference with the normal operation of the redundant PLC. Consistency verification of received data in the mirror storage area is ensured through a timestamp verification mechanism, defining a consistency metric. ,in, The system time of the main PLC. For redundant PLC system time, This represents the maximum allowable time deviation. When... hour, The clock synchronization process is triggered when the consistency threshold is reached.

[0078] For example, in a PLC process control system, the heartbeat message sending cycle is set. Milliseconds, synchronization period Milliseconds. When a PID controller parameter on the main PLC is changed from 1.5 to 1.8, the hash value of the change in the corresponding program block is calculated, triggering the synchronous transmission of that program block. Within a synchronization cycle, if 15 process variables change, a variable update set is constructed. This contains 15 index-value pairs, and the packaged data size is 240 bytes. Eight new alarm events are added to the event queue, and the calculation is as follows: Each event occupies 16 bytes, with an incremental transmission of 128 bytes of event data. The total data transmission volume during the entire synchronization process is controlled at the kilobyte level, with a transmission latency of less than 10 milliseconds.

[0079] This step utilizes a designed hot backup and incremental synchronization mechanism to ensure that all critical operating states of the main PLC are mirrored to the redundant PLC in real time, maintaining a high degree of consistency between the two. When the main PLC fails, the redundant PLC can immediately take over control tasks based on the latest synchronization state, achieving millisecond-level seamless switching and greatly improving the availability and reliability of the PLC.

[0080] Step 3: Deploy a lightweight anomaly detection model on the main PLC for real-time fault monitoring, and deploy a deep neural network fault diagnosis model on the host computer. Identify the fault type through two-level joint decision-making, and locate the fault location based on fault propagation path analysis; see [link / reference]. Figure 4 This is a flowchart of the PLC fault detection and intelligent diagnosis process for this step.

[0081] This step constructs a hierarchical fault detection and diagnosis architecture, deploying a lightweight anomaly detection model in the main PLC to achieve millisecond-level fast response, and deploying a deep neural network model in the host computer for accurate fault diagnosis.

[0082] The lightweight anomaly detection model employs a multivariate control chart method based on statistical thresholds. This model is embedded as an independent functional block into the PLC's cyclic scanning task. The core of the model is the multidimensional feature vector constructed in step 1. Real-time monitoring is performed, and the deviation of the current operating state from the normal baseline is quantified by calculating the Mahalanobis distance of the feature vectors. The Mahalanobis distance is defined as... ,in, The mean of the feature vector under normal operating conditions is calculated by collecting historical data from the stable operation phase of the PLC. The covariance matrix reflects the correlation and variation among the features. To reduce computational complexity, Cholesky decomposition is used to decompose the covariance matrix into... ,in Since it is a lower triangular matrix, the matrix inversion operation is transformed into solving two systems of trigonometric equations.

[0083] When the calculated Mahalanobis distance Exceeding the critical value of the chi-square distribution At that time, the lightweight anomaly detection model outputs an abnormal PLC status, where, At the significance level, The feature dimension is [value]. The storage requirements of the lightweight anomaly detection model only include the mean vector, Cholesky decomposition matrix, and threshold parameters. The calculation process mainly involves vector operations and comparisons, which can be completed within a single scan cycle of the PLC, enabling real-time detection of abnormal states.

[0084] A deep neural network fault diagnosis model is deployed on the PLC's host computer. The host computer refers to a computer system located above the PLC that interacts with the PLC via industrial communication protocols. The host computer is usually deployed at the human-machine interface and is used to realize visual monitoring, data recording, alarm management, trend analysis, and remote operation of the PLC-controlled object.

[0085] The deep neural network fault diagnosis model adopts a hybrid architecture of Temporal Convolutional Network (TCN) and Deep Belief Network (DBN). The hybrid architecture of TCN and DBN models is designed for fault mode recognition of PLC time-series feature data.

[0086] The input layer of the deep neural network fault diagnosis model receives a time-series feature data matrix uploaded in real time by the main PLC. ,in, It is a sparse matrix. The time window length, As a feature dimension, the time-series feature data matrix is ​​a multi-dimensional feature vector generated during the operation of the main PLC. A two-dimensional matrix is ​​formed by continuously collecting data along the time axis.

[0087] The TCN layer of the TCN model uses a combination of causal convolution and dilated convolution to process temporal feature data. Causal convolution ensures that the output at the current time step depends only on historical inputs; dilated convolution expands the receptive field without increasing the number of parameters by inserting intervals into the convolution kernel, capturing dependencies over a longer time span. Each TCN block contains two dilated causal convolutional layers, with batch normalization and ReLU activation added between every two dilated causal convolutional layers. Residual connections mitigate the gradient vanishing problem. The output of the TCN model is the extracted high-level temporal features.

[0088] The DBN layer of the DBN model receives features extracted by the TCN model and performs unsupervised feature learning and supervised fine-tuning through stacking multiple Restricted Boltzmann Machines (RBMs). Each RBM contains a visible layer and a hidden layer, with fully connected inter-layer connections but no intra-layer connections. The visible layer of the first RBM receives the output features of the TCN model and learns the probability distribution of the data through a contrastive divergence algorithm.

[0089] In the DBN model, the hidden layer output of the first RBM serves as the input to the second RBM, and these layers are stacked sequentially to form a deep architecture. During the pre-training phase, each RBM is trained independently, learning a hierarchical representation of the input data. The DBN model is then fine-tuned by adding a softmax classifier to the top layer, treating the entire network as a discriminative model, and using labeled fault data for supervised training.

[0090] The fault identification process of the deep neural network fault diagnosis model built on the TCN-DBN hybrid model is as follows: the TCN layer extracts temporal features through causal dilated convolution, preserving the temporal dynamic information of fault evolution; the DBN layer learns a deep representation of fault modes through layer-by-layer feature abstraction, and finally outputs the probability distribution of each fault type. The TCN-DBN hybrid model fully leverages the advantages of TCN in temporal modeling and the capabilities of DBN in feature learning, and can accurately identify complex gradual and sudden faults.

[0091] To address the issue of asynchronous real-time detection between the host computer's diagnostic delay and the PLC's real-time detection, a two-level joint decision mechanism is constructed, consisting of a lightweight anomaly detection model and a deep neural network fault diagnosis model. The core of this mechanism is defining a time window after the lightweight anomaly detection model detects an anomaly. To make collaborative decisions, among which The moment when the anomaly was first detected. This is the maximum time limit for waiting for a response from the host computer.

[0092] In the time window Internally, the main PLC maintains a dynamically updated anomaly confidence variable. Abnormal confidence variables The update rules are as follows ,in, As a confidence growth factor, This is an indicator function that takes the value 1 when an anomaly is detected, and 0 otherwise.

[0093] The confidence level is designed using a cumulative approach to filter out transient interference; the confidence level increases rapidly when anomalies are detected multiple times consecutively. Multiple anomaly confidence thresholds are set, and when… Different response measures are triggered when different thresholds are reached: at low thresholds, only alarm logs are recorded; at medium thresholds, some high-risk operations are restricted; and at high thresholds, preventative protection actions are initiated.

[0094] Upon detecting an anomaly, the main PLC immediately sends a diagnostic request to the host computer. The request data includes complete characteristic data before and after the anomaly, as well as the detection results from a lightweight anomaly detection model. If the host computer completes the task within the maximum time limit... The diagnostic results are returned internally based on the identified fault type and the calculated severity. Adjust the response strategy, among which, For the predefined first The severity weight of each type of failure This represents the corresponding fault probability output by the deep model. If no diagnostic result is received within the time limit, corresponding protective measures are implemented according to the current confidence level. This two-level joint decision mechanism ensures rapid response to sudden faults while fully utilizing the high diagnostic accuracy of the deep model, achieving an optimal balance between speed and accuracy.

[0095] Fault location in PLCs is achieved through fault propagation path analysis, by constructing and analyzing the functional dependencies of the PLCs to achieve precise fault location. A functional dependency graph of the PLCs is then established. , where the set of nodes It includes all functional modules, such as hardware components like the CPU core, various I / O units, communication interfaces, and power supply, as well as software functions like control algorithm units, data processing units, and human-computer interaction. (Directed edge set) This represents the dependencies between nodes, including data flow dependencies, control flow dependencies, and resource sharing dependencies. Each edge is assigned a propagation strength weight, which reflects the likelihood of a fault propagating from the source node to the target node.

[0096] When the lightweight anomaly detection model detects fault symptoms in the PLC, it collects all anomaly features to form an observation set and uses a Bayesian inference framework to calculate the posterior fault probability of each node. After calculating the posterior fault probabilities of all nodes, a graph search algorithm is used to trace the propagation path with the highest posterior fault probability; the starting node of the path is the most likely fault source. Simultaneously, the downstream dependencies of this node are analyzed to predict the potential impact range of the fault, providing guidance for developing fault isolation and recovery strategies.

[0097] For example, in a PLC for an automated assembly line, the feature dimension... Set significance level The threshold is obtained by consulting the chi-square distribution table. At a certain moment, the lightweight anomaly detection model calculates the Mahalanobis distance. Exceeding the threshold triggers anomaly detection. The TCN part of the deep neural network fault diagnosis model contains four TCN blocks, each with two dilated causal convolutional layers. The kernel size is 3, the number of channels is 64, and the dilation rates are 1, 2, 4, and 8, respectively, with a total receptive field covering 15 time steps. The DBN part contains three RBM layers with 256, 128, and 64 hidden units, respectively. The top layer connects to eight output units corresponding to eight fault types. The time window is set to... Milliseconds, confidence growth factor is The confidence thresholds were set as follows: low threshold 0.3, medium threshold 0.6, and high threshold 0.8. After anomalies were detected in six consecutive scan cycles (500 milliseconds per cycle), the confidence level was... Accumulated to If the threshold is exceeded, the PLC initiates output limiting protection. In the 7th cycle, the host computer returns diagnostic results. The TCN-DBN model identifies a hardware fault probability of 0.85 for the I / O module, a fault probability of 0.12 for the communication module, and other fault probabilities all less than 0.01. Based on preset severity weights, for example, an I / O fault weight of 0.8 and a communication fault weight of 0.3, the overall severity is calculated. The fault was confirmed to be of high severity.

[0098] This step, by constructing a hierarchical fault detection and diagnosis architecture for PLCs, achieves a complete functional chain from millisecond-level anomaly perception to precise fault location. A lightweight anomaly detection model ensures immediate response to anomalies, while the TCN-DBN deep model provides accurate fault classification through temporal feature extraction and hierarchical representation learning. A two-level joint decision mechanism effectively coordinates the requirements of real-time performance and accuracy, and fault propagation path analysis further improves the accuracy of fault source location. The entire fault detection and diagnosis system significantly enhances the intelligence level and fault handling capabilities of PLC control.

[0099] Step 4: When the main PLC fails, the dynamic reconfiguration mechanism is triggered. The redundant PLC takes over the I / O control and continues to execute control tasks based on the latest synchronized operating context. Simultaneously, it sends a switching completion signal to the host computer and records the PLC's operating status at the time of switching. (See also...) Figure 5 This is the flowchart for PLC fault detection triggering and dynamic reconfiguration in this step.

[0100] This step establishes a comprehensive fault detection triggering mechanism and dynamic reconfiguration process to ensure a rapid and smooth switchover of control when the main PLC fails.

[0101] The dynamic reconfiguration mechanism requires two independent detection channels: a model detection channel and a heartbeat monitoring channel. The model detection channel generates a fault trigger signal based on the fault diagnosis results from step 3. This occurs when the confidence level of the lightweight anomaly detection model exceeds the anomaly confidence threshold and the deep neural network fault diagnosis model confirms a fault in the main PLC. The heartbeat monitoring channel is implemented on redundant PLCs and determines their operating status by monitoring the reception of heartbeat messages from the main PLC.

[0102] Redundant PLC records heartbeat message reception timestamps The timestamp is updated each time a heartbeat message is received. A heartbeat timeout determination function is defined. ,in, To redundancy PLC time, As the baseline timeout time, For jitter tolerance time, This is an indicator function. Jitter tolerance time. The calculation method is to dynamically adjust based on network conditions. ,in, Tolerance coefficient, This represents the standard deviation of historical heartbeat intervals. The dynamic heartbeat timeout determination design can quickly detect abnormal shutdowns of the main PLC while avoiding misjudgments caused by network jitter.

[0103] When the conditions for dynamic reconfiguration are met, the PLC reconfiguration mechanism is immediately initiated. The first step in the PLC reconfiguration process is the switching of I / O control rights, which is achieved through a hardware arbitrator to transfer control at the physical level. The hardware arbitrator adopts a dual-port design, with the main port connected to the main PLC and the backup port connected to the redundant PLC. Under normal circumstances, the main port is in an active state. When a switching signal is received, the arbitrator executes the port switching sequence: first, it invalidates the output enable signal of the main port, and then waits for a stabilization period. Ensure all ongoing I / O operations are completed; then activate the output enable signal of the spare port and update the internal routing table to map all I / O channels to the redundant PLC. The switching process employs seamless switching technology, maintaining the continuity of the output signal at the moment of switching and avoiding abrupt changes in control output. For analog outputs, the last output value is buffered before switching and immediately restored after switching; for digital outputs, the output state is maintained unchanged through latches.

[0104] After gaining I / O control, the redundant PLC resumes control task execution based on the latest synchronized runtime context. The runtime context includes key information such as the current execution position of the control program, real-time values ​​of all process variables, unprocessed event queues, and timer states. The redundant PLC first reads the program counter from the mirrored memory area. The value is used to locate the last program position executed by the main PLC; then the process variable table is loaded, and the read / write pointer of the event queue is restored to continue processing the events pending in the queue. Based on the constructed context recovery mechanism, the redundant PLC can seamlessly continue execution from the point of interruption of the main PLC, avoiding duplicate execution or omission of control logic.

[0105] After taking over control, the redundant PLC executes subsequent processing tasks. First, it sends a switching completion signal to the host computer, containing the switching time, switching reason code, and current PLC status information. Upon receiving the signal, the host computer updates the PLC topology display, marks the redundant PLC as the master PLC, and records the switching event in the operation log. Second, the redundant PLC takes a snapshot of its complete operating state at the time of switching, including the real-time values ​​of all I / O channels, the internal state of the controller, and the communication link status; the state snapshot is timestamped and stored in non-volatile memory.

[0106] The dynamic reconfiguration mechanism designed in this step enables millisecond-level takeover in the event of a main PLC failure, ensuring the continuity and stability of the production process. Dual fault detection channels improve the reliability of fault identification, a hardware arbitrator guarantees the real-time performance of PLC I / O switching, context recovery based on mirrored storage ensures the continuity of control logic, and a comprehensive status recording mechanism provides a data foundation for subsequent analysis. During the PLC dynamic reconfiguration process, disturbances to the controlled object are minimized, achieving bumpless switching and significantly improving the availability and reliability of the redundant PLC system.

[0107] Step 5: After the redundant PLC takes over, perform maintenance on the faulty PLC. After the faulty PLC is repaired and passes the functional test, the repaired PLC is configured as the new redundant PLC and establishes data synchronization and heartbeat communication with the current master PLC.

[0108] After the redundant PLC successfully takes over the control task, this step implements a tiered operation and maintenance repair strategy for the faulty PLC to ensure that it can be quickly restored and reintegrated into the redundant PLC.

[0109] Based on the diagnosed PLC fault type, the faults are categorized into three types: software faults, firmware faults, and hardware faults. For software faults, including program logic errors, memory leaks, and task deadlocks, a hardware reset strategy is used for repair. The reset process involves writing a reset instruction to the faulty PLC's reset control register, causing the PLC to execute a cold start sequence, clear all volatile memory contents, and reload the operating system and application programs. Reset completion time... ,in, For hardware self-test time, For program loading time, This is the system initialization time.

[0110] For firmware failures, including corrupted firmware, version mismatches, and incorrect configuration parameters, a firmware reload strategy is employed for repair. Firmware reload is implemented through a dedicated programming interface. First, the PLC is switched to programming mode, pausing the execution of all user programs; then, a verified firmware image file is downloaded from the firmware backup server. During the firmware writing process, the power supply voltage is monitored in real time to ensure stable power supply and prevent permanent damage caused by write interruptions. After the firmware update is complete, the PLC performs version verification and functional self-tests to confirm that the firmware has been correctly loaded.

[0111] For hardware failures, such as damaged I / O units, communication interface malfunctions, and power supply anomalies, a hardware replacement strategy is employed for repair. Before hardware replacement, a fault isolation operation is performed by disconnecting the power supply and communication interface of the faulty hardware to prevent the fault from spreading. The replacement process must adhere to hot-swapping specifications. After the new hardware is inserted, the PLC performs hardware identification and configuration. Hardware identification is achieved by reading the hardware identification register. The PLC loads the corresponding driver and configuration parameters based on the identification code. For I / O units, channel mapping and range calibration need to be re-performed. After replacement, hardware functional tests are performed, including channel scanning, response time testing, and accuracy verification, to ensure the new hardware functions correctly.

[0112] After repair, a comprehensive functional test is performed on the faulty PLC, including three levels: basic function testing, performance testing, and stability testing. Basic function testing verifies the correctness of core functions such as CPU arithmetic, memory read / write, I / O control, and communication interfaces. Performance testing evaluates the system's response time, throughput, and resource utilization. Stability testing monitors for performance degradation or abnormal behavior by running standard test programs for extended periods. Only PLCs that pass all tests can be configured as new redundant PLCs.

[0113] The PLC that passes the test is configured as a redundant PLC and needs to establish a synchronization relationship with the currently running master PLC (the original redundant PLC). First, an initial mirror synchronization is performed, copying the complete running image of the master PLC to the new standby PLC. A differential transmission algorithm is used to optimize synchronization efficiency, transmitting only data blocks that differ from the default configuration. After synchronization is complete, a heartbeat communication connection is established, configuring heartbeat parameters including the sending cycle, timeout threshold, and message format. For control structures with multiple redundant PLCs, the priority of each PLC is defined. The priority determines the takeover order of redundant PLCs during master PLC failure switching, ensuring that the optimal PLC always provides control services.

[0114] This step, through the PLC fault repair and recovery process, enables the adoption of the most suitable repair strategy for different types of faults, ensuring both a high success rate and a short repair time. Comprehensive functional testing ensures the reliability of the repaired PLC, and the standardized reconfiguration process allows the repaired PLC to be quickly integrated into the redundant system. The entire operation and maintenance process forms a complete closed loop from fault diagnosis, tiered repair, functional verification to redeployment, restoring the PLC's redundancy capabilities and providing a guarantee for the long-term stable operation of the PLC.

[0115] Example 2

[0116] Reference Figure 6 This is the second embodiment of the present invention, which provides a redundant PLC control system for fault location and dynamic reconfiguration.

[0117] The system includes: a PLC feature extraction module, a PLC interconnection module, a PLC fault diagnosis module, a PLC dynamic reconfiguration module, and a faulty PLC maintenance module.

[0118] The PLC feature extraction module collects the main PLC operating status data, extracts the features of the main PLC operating status data, and constructs a multi-dimensional feature vector reflecting the main PLC operating status.

[0119] The PLC interconnection module maintains data synchronization and heartbeat communication between the main PLC and the redundant PLC. The main PLC periodically sends heartbeat messages to the redundant PLC and periodically transmits control program updates, variable changes, and event queue increments to the mirror storage area of ​​the redundant PLC.

[0120] The PLC fault diagnosis module deploys a lightweight anomaly detection model on the main PLC for real-time fault monitoring and a deep neural network fault diagnosis model on the host computer. It identifies the fault type through two-level joint decision-making and locates the fault location based on the fault propagation path analysis.

[0121] When the main PLC fails, the PLC dynamic reconfiguration module triggers a dynamic reconfiguration mechanism, allowing the redundant PLC to take over I / O control and continue executing control tasks based on the latest synchronized operating context. At the same time, it sends a switching completion signal to the host computer and records the PLC's operating status at the time of switching.

[0122] The faulty PLC maintenance module performs maintenance on the faulty PLC after the redundant PLC takes over. After the faulty PLC is repaired and passes the functional test, the repaired PLC is configured as a new redundant PLC and establishes data synchronization and heartbeat communication with the current main PLC.

[0123] Example 3

[0124] In the embodiments provided by this invention, it should be understood that the disclosed apparatus and method can be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. Furthermore, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Additionally, the coupling or direct coupling or communication connection shown or discussed may be through some communication interface; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0125] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments under the guidance of the present invention without departing from the spirit and scope of the claims. All of these variations are within the protection scope of the present invention.

Claims

1. A redundant PLC control method for fault location and dynamic reconfiguration, characterized in that, include: Collect main PLC operating status data, extract main PLC operating status data features, and construct a multi-dimensional feature vector reflecting the main PLC operating status. The main PLC and the redundant PLC maintain data synchronization and heartbeat communication. The main PLC periodically sends heartbeat messages to the redundant PLC and periodically transmits control program updates, variable changes and event queue increments to the mirror storage area of ​​the redundant PLC. A lightweight anomaly detection model is deployed on the main PLC for real-time fault monitoring, and a deep neural network fault diagnosis model is deployed on the host computer. The fault type is identified through two-level joint decision-making, and the fault location is located based on the fault propagation path analysis. The lightweight anomaly detection model adopts a multivariate control chart method based on statistical thresholds. The lightweight anomaly detection model monitors the constructed multidimensional feature vectors in real time and calculates the Mahalanobis distance of the multidimensional feature vectors to quantify the degree of deviation between the current operating state and the normal baseline. When the calculated Mahalanobis distance exceeds the critical value of the chi-square distribution, the lightweight anomaly detection model outputs an abnormal PLC status. A deep neural network fault diagnosis model is deployed on the host computer of the PLC; the deep neural network fault diagnosis model is a TCN-DBN hybrid model constructed by using a temporal convolutional network (TCN) model and a deep belief network (DBN) model. The input layer of the deep neural network fault diagnosis model receives a time-series feature data matrix uploaded in real time by the main PLC. The time-series feature data matrix is ​​a two-dimensional matrix formed by continuously collecting multi-dimensional feature vectors during the operation of the main PLC along the time axis. The TCN layer of the TCN model uses a combination of causal convolution and dilated convolution to process temporal feature data. The output of the TCN model is the extracted high-level temporal features. The DBN layer of the DBN model receives high-level temporal features extracted by the TCN model and performs unsupervised feature learning and supervised fine-tuning through the stacking of multiple Restricted Boltzmann Machines (RBMs). The visible layer of the first RBM in the DBN model receives the output features of the TCN model and learns the probability distribution of the data through a comparative divergence algorithm. In the DBN model, the hidden layer output of the first RBM serves as the input of the second RBM, and the layers are stacked to form a deep architecture. The fault identification process of the deep neural network fault diagnosis model based on the TCN-DBN hybrid model is as follows: the TCN layer extracts temporal features through causal dilated convolution and retains the temporal dynamic information of fault evolution; the DBN layer learns the deep representation of fault modes through layer-by-layer feature abstraction and outputs the probability distribution of each fault type. A two-level joint decision mechanism combining a lightweight anomaly detection model and a deep neural network fault diagnosis model is constructed. The two-level joint decision-making mechanism defines a time window for collaborative decision-making after the lightweight anomaly detection model detects an anomaly. Within the time window, the main PLC maintains a dynamically updated anomaly confidence variable. The anomaly confidence is designed in an cumulative manner and sets multiple levels of anomaly confidence thresholds. When different anomaly confidence thresholds are reached, corresponding response measures are triggered. When the main PLC fails, the dynamic reconfiguration mechanism is triggered, the redundant PLC takes over the I / O control, continues to execute the control task based on the latest synchronized running context, and sends a switching completion signal to the host computer and records the PLC running status at the time of switching. After the redundant PLC takes over, the faulty PLC is maintained. After the faulty PLC is repaired and passes the functional test, the repaired PLC is configured as the new redundant PLC and establishes data synchronization and heartbeat communication with the current master PLC.

2. The redundant PLC control method for fault location and dynamic reconfiguration according to claim 1, characterized in that, Collect main PLC operating status data, including CPU utilization data, memory usage data, I / O latency data, instruction execution sequence data, and communication error rate data; Extract features from the main PLC's operating status data, and construct a multi-dimensional feature vector reflecting the main PLC's operating status from all extracted features.

3. The redundant PLC control method for fault location and dynamic reconfiguration according to claim 2, characterized in that, When both the main PLC and the redundant PLC are running, a two-way heartbeat communication mechanism is established between the main PLC and the redundant PLC. The main PLC periodically sends heartbeat messages to the redundant PLC. The heartbeat message includes: a hardware identifier field, a running status code field, and a timestamp field. While the main PLC and the redundant PLC maintain heartbeat communication, the main PLC and the redundant PLC simultaneously implement an incremental data synchronization strategy; the status changes during the operation of the main PLC are transmitted in real time to the mirror storage area of ​​the redundant PLC, and the status changes include control program updates, variable changes and event queue increments.

4. The redundant PLC control method for fault location and dynamic reconfiguration according to claim 3, characterized in that, The redundant PLC's mirror storage area adopts a dual-buffered structure, which includes a current running image buffer and an update buffer. The redundant PLC performs consistency verification on the received synchronization data, then writes the received synchronization data into the update buffer, and finally completes the buffer switching during the interval of the PLC scan cycle.

5. The redundant PLC control method for fault location and dynamic reconfiguration according to claim 4, characterized in that, Fault location of PLC is performed based on fault propagation path analysis method, and functional dependency graph of PLC is established. The node set in the PLC's functional dependency graph contains all functional modules, including hardware components such as the CPU core, various I / O units, communication interfaces, and power supply, as well as software functions such as control algorithms, data processing, and human-machine interaction. The set of directed edges E in the functional dependency graph represents the dependencies between nodes, including data flow dependencies, control flow dependencies, and resource sharing dependencies. Each edge is assigned a propagation strength weight, which reflects the probability of a fault propagating from the source node to the target node.

6. The redundant PLC control method for fault location and dynamic reconfiguration according to claim 5, characterized in that, When a PLC anomaly is detected by the lightweight anomaly detection model, all anomaly features are collected to form an observation set. A Bayesian inference framework is used to calculate the posterior failure probability of each node. After calculating the posterior failure probability of all nodes, a graph search algorithm is used to trace the propagation path with the highest posterior failure probability. The starting node of the path is the failure source. At the same time, the downstream dependencies of the starting node of the path are analyzed to predict the scope of the failure impact.

7. The redundant PLC control method for fault location and dynamic reconfiguration according to claim 6, characterized in that, The dynamic reconfiguration mechanism requires two independent detection channels: a model detection channel and a heartbeat monitoring channel. The model detection channel generates a fault trigger signal based on the fault diagnosis results. When the anomaly confidence of the lightweight anomaly detection model exceeds the anomaly confidence threshold and the deep neural network fault diagnosis model confirms that the main PLC has a fault, the model detection channel generates a fault trigger signal. The heartbeat monitoring channel is implemented in the redundant PLC and determines the operating status of the main PLC by monitoring the reception of the main PLC's heartbeat messages. The redundant PLC records the timestamp of the heartbeat message received, and updates the timestamp each time a heartbeat message is received; a heartbeat timeout determination function is defined, and a dynamic jitter tolerance time for the heartbeat timeout determination function is constructed. When the main PLC times out and fails to record a heartbeat message to the redundant PLC, a dynamic reconstruction mechanism is initiated. After the redundant PLC completes the takeover of I / O control from the main PLC, the redundant PLC sends a switching completion signal to the host computer. Upon receiving the signal, the host computer updates the topology display of the PLC structure and marks the redundant PLC as the main PLC.

8. The redundant PLC control method for fault location and dynamic reconfiguration according to claim 7, characterized in that, Based on the PLC fault types diagnosed by the deep neural network fault diagnosis model, the faults are divided into three categories: software faults, firmware faults, and hardware faults; corresponding operation and maintenance strategies are adopted according to different fault types. After the PLC has been tested and maintained, the PLC that has passed the performance test will be added to the current PLC topology as a new redundant PLC, and at the same time, a synchronization relationship will be re-established with the current master PLC.

9. A redundant PLC control system for fault location and dynamic reconfiguration, used to implement the redundant PLC control method for fault location and dynamic reconfiguration as described in any one of claims 1 to 8, characterized in that, include: PLC feature extraction module, PLC interconnection module, PLC fault diagnosis module, PLC dynamic reconfiguration module, and faulty PLC maintenance module; The PLC feature extraction module collects the main PLC operating status data, extracts the features of the main PLC operating status data, and constructs a multi-dimensional feature vector reflecting the main PLC operating status. The PLC interconnection module maintains data synchronization and heartbeat communication between the main PLC and the redundant PLC. The main PLC periodically sends heartbeat messages to the redundant PLC and periodically transmits control program updates, variable changes, and event queue increments to the mirror storage area of ​​the redundant PLC. The PLC fault diagnosis module deploys a lightweight anomaly detection model on the main PLC for real-time fault monitoring and a deep neural network fault diagnosis model on the host computer. It identifies the fault type through two-level joint decision-making and locates the fault location based on the fault propagation path analysis. When the main PLC fails, the PLC dynamic reconfiguration module triggers a dynamic reconfiguration mechanism, and the redundant PLC takes over the I / O control. Based on the latest synchronized running context, it continues to execute the control task, and at the same time sends a switching completion signal to the host computer and records the PLC running status at the time of switching. The faulty PLC maintenance module performs maintenance on the faulty PLC after the redundant PLC takes over. After the faulty PLC is repaired and passes the functional test, the repaired PLC is configured as a new redundant PLC and establishes data synchronization and heartbeat communication with the current main PLC.

Images