Full-link double-software-hardware redundancy control system of hydraulic station

Abstract

The invention discloses a hydraulic station full-link dual-software-hardware redundancy control system which is characterized by comprising dual-software-hardware redundancy and a redundancy control switching mechanism, the dual-software-hardware redundancy comprises two sets of hardware, and the two sets of software can be switched mutually during use; the dual software and hardware redundancy comprises sensor redundancy, data acquisition module redundancy, control module redundancy, control mechanism redundancy, human-computer interface redundancy, data storage redundancy and communication redundancy; the redundancy control switching mechanism comprises a switching execution mechanism and switching arbitration logic, whether switching is carried out or not is judged according to the switching arbitration logic, and dual software and hardware are switched through the switching execution mechanism. The invention provides a first dual-channel software and hardware deep redundancy architecture covering full links of perception-decision-execution-man-machine interaction-storage, and solves the core problem of undisturbed switching of hydraulic control.

Description

TECHNICAL FIELD

[0001] The present application relates to a kind of hydraulic station full-link dual software and hardware redundancy control system, belong to control system technical field. BACKGROUND

[0002] Industry demand background (1) high reliability requirement of hydraulic system: key equipment in key basic field, including flood control facilities, hydraulic ship lock, regulating lock, drainage pump hydraulic gate, etc., rely on hydraulic station to provide power, single point failure can lead to whole machine downtime, safety accident, influence flood control, drainage or huge loss.

[0003] (2) the shortcomings of existing redundancy scheme: Partial redundancy: current scheme is mostly concentrated in controller or network single-point redundancy (such as PLC dual-computer hot backup), which does not cover sensors, signal chains, actuators and other full links, and there are fault blind areas.

[0004] Software and hardware coupling defects: hardware redundancy but single-point software operation, or software redundancy but relying on the same hardware platform, with high common cause failure risk.

[0005] Large switching disturbance: traditional master-slave switching requires manual intervention or takes a long time (seconds), and fluid inertia in hydraulic system is easy to cause pressure / flow mutation, leading to equipment vibration or process interruption.

[0006] Fault diagnosis lag: lack of multi-channel data cross-validation, high fault misjudgment rate, and unable to quickly isolate fault modules.

[0007] (3) existing technology gap: current technology only realizes controller and communication redundancy, and does not solve sensor and actuator redundancy. Software fault-tolerant algorithm is used in existing technology, but it relies on a single hardware platform, which lacks physical reliability. SUMMARY

[0008] The technical problem to be solved by the present application is to solve the problem of disturbance-free switching of hydraulic system.

[0009] To solve the above technical problems, the technical scheme of the present application provides a kind of hydraulic station full-link dual software and hardware redundancy control system, characterized by including dual software and hardware redundancy and redundancy control switching mechanism, dual software and hardware redundancy is two sets of hardware and two sets of software respectively can be switched when using each other, dual software and hardware redundancy includes sensor redundancy, data acquisition module redundancy, control module redundancy, control mechanism redundancy, man-machine interface redundancy, data storage redundancy, communication redundancy;Redundancy control switching mechanism includes switching execution mechanism and switching arbitration logic, whether switching is judged according to switching arbitration logic, and dual software and hardware are switched through switching execution mechanism.

[0010] Preferably, the dual software and hardware redundancy switching meets the state synchronization mechanism: real-time state synchronization of controller operation results, output instruction states, and key parameter set values between the master and standby systems, ensuring that the standby system can seamlessly take over after switching.

[0011] Preferably, the switching arbitration logic triggers the switching based on the conditions of hardware fault diagnosis signals, software heartbeat loss, data validity check failure, key signal out-of-tolerance, and manual forced switching.

[0012] Preferably, the switching execution mechanism implements a physical layer dedicated hardware switching switch / relay array fast switching logic and a redundant communication channel sending switching instructions.

[0013] Preferably, the dual software and hardware redundancy ensures that the faulty module is effectively isolated during switching; the dual software and hardware redundancy switching mode supports automatic switching, manual switching, test switching, and remote forced switching modes.

[0014] Preferably, the sensor redundancy installs multiple independent sensors at the same measurement point and selects effective signals through median selection, weighted average, and confidence-based selection. The data acquisition module redundancy includes two independent acquisition hardware and software processes; the acquisition strategy, data caching, and synchronization provide two sets of data to the control module. The control module redundancy includes two independent PLC controllers, which are the master and standby controllers, and two sets of control software that independently run using different algorithms; the coordination mechanism of the master and standby controllers: the master controller outputs in real time, the standby controller maintains a "hot standby" state, receives inputs in real time, synchronously calculates, but does not output execution instructions, and ensures that the master and standby program parameters are synchronized. The control mechanism redundancy drives different control ports of the same execution mechanism through redundant analog / digital output modules, controls the final execution element with complete redundancy, and ensures that single-channel failure does not affect the final action. The human-machine interface redundancy includes independent operation station hardware and independent HMI software. The data storage redundancy includes dual-server independent data storage hardware, independently running database software services, and shared database storage to achieve quasi-real-time synchronization of data. The communication redundancy uses dual network cards, dual switches, and dual communication media at the physical layer, and an industrial Ethernet protocol that supports redundancy at the protocol layer; when detecting communication failure, it realizes seamless switching of the communication link.

[0015] Preferably, the sensors include pressure sensors, flow sensors, temperature sensors, and liquid level sensors.

[0016] Preferably, each of the dual software and hardware redundancies is placed in different locations, physically isolated, provided with independent power supply for the redundancy channel, and the master and standby control software is implemented in different programming languages and different algorithms to achieve the same function, and different brands / models of devices are used.

[0017] Preferably, each of the redundancies is monitored in real time and self-diagnosed for failure; the data consistency of the two redundant sensors / channels is compared, the control command and the feedback signal are compared, and the cross-validation technology of comparing the predicted value with the measured value by using the mathematical model is used to determine the failure.

[0018] Preferably, the dual software and hardware redundancies include a sensor layer, a signal conversion layer, a data acquisition layer, a control decision layer, a switching execution layer, a human-computer interaction layer, a data storage layer, and a communication link designed with completely independent and functionally equivalent dual-channel redundancies; the sensor layer, the signal conversion layer, the data acquisition layer, the control decision layer, the switching execution layer, and the human-computer interaction layer are connected to the communication link; the sensor layer is connected to the signal conversion layer through a double-physical-signal connection; the signal conversion layer is connected to the data acquisition layer through a redundant digital signal; the data acquisition layer is connected to the control decision layer through a dual-channel data stream; the control decision layer is connected to the execution mechanism layer through a redundant control instruction; the data acquisition layer and the data storage layer are connected to each other; the data storage layer and the control decision layer are connected to each other; and the human-computer interaction layer and the control decision layer are connected to each other.

[0019] The present application proposes the first dual-channel software and hardware deep redundancy architecture covering the whole link of "perception-decision-execution-human-computer interaction-storage", and solves the core problem of hydraulic control, i.e. non-disturbance switching.

[0020] Compared with the prior art, the present application has the following beneficial effects: (1) Full-link deep redundancy: The present application systematically covers all key links of the hydraulic control system from the perception layer (sensor) to the execution layer (control mechanism) to the management layer (HMI, storage) with hardware redundancy and software redundancy. It is not only a simple controller dual-machine hot standby, but also a complete ecosystem with high fault tolerance. The overall effect of the combination of "full-link software and hardware dual redundancy + intelligent non-disturbance switching + common cause resistance design", rather than the redundancy of a single module.

[0021] (2) Intelligent non-disturbance switching technology: The present application proposes a fast, reliable and non-disturbance redundancy switching mechanism. The comprehensive arbitration algorithm is combined with millisecond-level special hardware switching circuit / logic and software switching instruction. The state (set value, output value, intermediate variable, historical data) of the master and standby control modules is efficiently and real-timely synchronized, ensuring the continuity of the control command and the non-mutation of the hydraulic system pressure and flow in the switching moment.

[0022] (3) Common-cause fault resistance design: By adopting a combination of physical isolation, independent power supply and software diversity, the probability of common-cause faults is significantly reduced and the overall reliability of the redundant system is improved.

[0023] (4) Intelligent fault diagnosis based on cross-validation: By utilizing the multi-channel data generated by redundant channels, and through innovative data fusion and cross-comparison algorithms (consistency check, residual analysis, confidence assessment), faster and more accurate fault location and isolation can be achieved, reducing false alarms and missed alarms.

[0024] (5) High reliability assurance for hydraulic control: Specifically optimized for the characteristics of hydraulic systems (fast response, large inertia, and serious consequences of failure) to ensure that the system can still maintain core hydraulic functions in the event of single or even multi-point failures, avoid equipment downtime or safety accidents, and significantly improve the operational safety and availability of the hydraulic station. Attached Figure Description

[0025] Figure 1 This is an overall architecture diagram of a hydraulic station full-link dual hardware and software redundancy control system. Detailed Implementation

[0026] To make the present invention more apparent and understandable, preferred embodiments are described in detail below with reference to the accompanying drawings.

[0027] This invention provides a full-link dual hardware and software redundancy control system for a hydraulic station, which includes dual hardware and software redundancy and a redundancy control switching mechanism. The dual hardware and software redundancy means that two sets of hardware and two sets of software can switch between each other during use. The dual hardware and software redundancy includes sensor redundancy, data acquisition module redundancy, control mechanism redundancy, human-machine interface redundancy, data storage redundancy, and communication redundancy. The redundancy control switching mechanism includes switching actuators and switching arbitration logic. The switching arbitration logic determines whether to switch, and the dual hardware and software are switched through the switching actuators.

[0028] (1) Overall system architecture: like Figure 1As shown, the topology of the whole system, all key links (sensor layer, signal conversion layer, data acquisition layer, control decision layer, switching execution layer, human-computer interaction layer, data storage layer, communication link) adopt completely independent and functionally equivalent dual-channel redundant design, the data acquisition layer, the control decision layer, the human-computer interaction layer and the data storage layer are connected to the communication link (i.e. communication network) respectively, the sensor layer is connected to the signal conversion layer through double physical signals, the signal conversion layer is connected to the data acquisition layer through redundant digital signals, the data acquisition layer is connected to the control decision layer through double-channel data flow, the control decision layer is connected to the execution mechanism layer (i.e. switching execution layer) through redundant control instructions, the data acquisition layer and the data storage layer are connected to each other, the data storage layer and the control decision layer are connected to each other, and the human-computer interaction layer and the control decision layer are connected to each other. Among them, the data storage layer is connected to the communication network through redundant digital signals, and the human-computer interaction layer is connected to the communication network through redundant digital signals.

[0029] Among them, the hardware redundancy (two independent devices / boards / controllers / network interfaces / storage devices, etc. on the physical) and software redundancy (two independent running acquisition programs, control algorithms, HMI software, database systems) coexist.

[0030] (2) Redundant control switching mechanism: Switching arbitration logic: based on hardware fault diagnosis signal, software heartbeat loss, data validity check failure, key signal out-of-tolerance, manual forced switching and other conditions, comprehensive judgment switching; Switching execution mechanism: realize the physical layer dedicated hardware switching switch / relay array fast switching logic, and the redundant communication channel sends the switching instruction, realizes the fast, non-disturbance switching, guarantees that the hydraulic station runs without interruption or with minimal fluctuation.

[0031] State synchronization mechanism: the controller operation result, output instruction state and key parameter set value between the master and standby systems are synchronized in real time, so that the standby system can seamlessly take over after switching.

[0032] Fault isolation: ensure that the fault module is effectively isolated during switching to prevent affecting the healthy module.

[0033] Switching mode: support automatic switching, manual switching, test switching, remote forced switching mode.

[0034] (3) Fault diagnosis and health management: The system of the application realizes real-time monitoring and self-diagnosis of faults of sensors, modules, communication links and software processes. The consistency of data of two redundant sensors / channels is compared, the control instruction and the feedback signal are compared, and the cross-validation technology of comparing the predicted value with the measured value by using a mathematical model is used to determine the fault. Fault information recording, grading (warning, error, serious fault) and reporting mechanism.

[0035] (4) Specific implementation of the structure and interaction of each redundant module: Sensor redundancy: Multiple independent sensors (such as pressure, flow, temperature, and liquid level) are installed at the same measuring point, and the effective signal is selected by median selection, weighted averaging, or confidence level.

[0036] Redundancy in the data acquisition module: Two independent sets of acquisition hardware and software processes. Acquisition strategy, data buffering, and synchronous provision of two sets of data to the control module.

[0037] Control module redundancy: Two independent PLC controller hardware sets and two independent control software sets using different algorithms. Master / standby controller coordination mechanism: The master controller outputs in real time, while the standby controller maintains a "hot standby" state (receiving input in real time, performing synchronous calculations, but not outputting execution instructions), ensuring synchronization of master and standby program parameters.

[0038] Redundancy in control mechanism: By using redundant analog / digital output modules to drive different control ports of the same actuator, the final actuators such as motor drivers are controlled in a completely redundant manner, ensuring that a single-path failure does not affect the final action.

[0039] Redundancy in human-machine interface: Independent operator station hardware and independent HMI software prevent conflicting commands from being issued by two operator stations at the same time, and realize the synchronization and mutual exclusion of operation commands.

[0040] Data storage redundancy: Dual servers with independent data storage hardware and independently running database software services, and shared database storage to achieve near real-time data synchronization.

[0041] Communication redundancy: The physical layer uses dual network cards, dual switches, and dual communication media, while the protocol layer uses an industrial Ethernet protocol that supports redundancy, enabling seamless switching of communication links when communication faults are detected.

[0042] (5) Design to resist common-cause failures: To prevent a single cause of simultaneous failure of multiple redundant units, reduce the risk of common-cause failures, place redundant modules in different locations with physical isolation, provide independent power supplies for redundant channels, use different programming languages ​​and algorithms for the main and backup control software to achieve the same function, and use different brands / models of components.

[0043] The redundancy of each module is as follows:

[0044] Switching trigger conditions: Fault comprehensive score = α × hardware status + β × data deviation + γ × algorithm confidence; automatic switching occurs when the score exceeds the threshold, and manual emergency switching is also supported.

[0045] Here, α represents a veto power for hardware status failures, enabling the switching process. β handles data deviation sampling levels; small deviations do not trigger a switch, while larger deviations are considered based on the algorithm's confidence level. Switching occurs if the deviation is within the confidence range, and not if it's outside. The deviation switching value is continuously optimized within a certain range based on historical records, while the confidence level is continuously optimized within a certain range based on product reliability and accumulated time. β and γ represent their respective weights when deviations are large.

[0046] Intelligent and seamless switching mechanism ensures: real-time synchronization of the backup controller, using incremental synchronization (Δ compression transmission); consistency of key parameters: pressure setpoint, PID integral term, valve opening; hydraulic inertia compensation, with feedforward commands injected at the moment of switching to offset fluid inertia.

[0047] Cross-validation process for fault diagnosis based on redundant data: Sensor layer: median filtering + residual analysis (|P1-P2|>ΔP_max→alarm); Control layer: comparison of dual controller outputs (instruction difference>5%→start arbitration algorithm); Execution layer: comparison of instruction feedback and model prediction (out of tolerance→mark actuator fault). Enhanced tolerance for single-point / multi-point faults.

[0048] Where P1 is sensor A or calculated data, P2 is sensor B or calculated data, and ΔP_max is the maximum permissible deviation of the sensor or calculated data. If the deviation is too large, it indicates that at least one data point is problematic. If the deviation is small, the average value is taken. Out of tolerance means that the predicted value exceeds the normal range from the actual value. Since the predicted value has been validated through long-term operation and calculation, its reliability is high. It is highly likely that the actual value does not reflect the true data due to some possible malfunction.

[0049] Design to withstand common-cause failures: Sensors / controllers are spatially isolated with a spacing of >1m; power supply is isolated.

[0050] Software diversity: The main channel and the backup channel use different control algorithms and different communication protocols.

[0051] The hydraulic cylinder position control workflow after adopting the system of this invention is as follows: Normal state: Sensors A / B acquire position signals → conversion modules A / B independently digitize → acquisition software performs dual-channel verification; main controller (MPC algorithm) calculates instructions → drives actuator A; backup controller (fuzzy PID) calculates synchronously but does not output.

[0052] Fault switching: The diagnostic module detects that the main controller's memory overflows (scoring exceeds the limit), and the switching unit transfers control to the backup controller within 5ms; the backup controller injects an inertia compensation command (based on hydraulic cylinder speed prediction), and the position fluctuation is <±0.1mm (traditional solution >±1mm).

[0053] Fault recovery: After the main controller is reset, it automatically synchronizes the status of the standby controller and is reintegrated into the redundancy pool after a 20-second online test.

[0054] The system availability of this invention is improved from 99.9% to 99.999% (annual downtime <5 minutes); switchover time <10ms, pressure fluctuation <2%; common-cause failure rate reduced to 10%. -7 / Hour.

Claims

1. A full-link dual hardware and software redundancy control system for a hydraulic station, characterized in that, It includes dual hardware and software redundancy and a redundancy control switching mechanism. Dual hardware and software redundancy means that two sets of hardware and two sets of software can switch between each other during use. Dual hardware and software redundancy includes sensor redundancy, data acquisition module redundancy, control module redundancy, control mechanism redundancy, human-machine interface redundancy, data storage redundancy, and communication redundancy. The redundancy control switching mechanism includes switching actuators and switching arbitration logic. The switching arbitration logic determines whether to switch and switches the dual hardware and software through the switching actuators.

2. The hydraulic station end-to-end dual hardware and software redundancy control system as described in claim 1, characterized in that, The aforementioned dual hardware and software redundancy switching satisfies a state synchronization mechanism: the controller calculation results, output command status, and key parameter settings between the primary and backup systems are synchronized in real time to ensure that the backup system can seamlessly take over after the switch.

3. The hydraulic station end-to-end dual hardware and software redundancy control system as described in claim 1, characterized in that, The switching arbitration logic is based on conditions such as hardware fault diagnosis signals, software heartbeat loss, data validity verification failure, critical signal deviation, and forced switching by human intervention, and makes a comprehensive judgment on switching.

4. The hydraulic station end-to-end dual hardware and software redundancy control system as described in claim 1, characterized in that, The aforementioned switching actuator implements a dedicated hardware switching switch / relay array for the physical layer, enabling rapid switching logic and sending switching commands via redundant communication channels.

5. A hydraulic station end-to-end dual hardware and software redundancy control system as described in claim 1, characterized in that, The dual hardware and software redundancy ensures that faulty modules are effectively isolated during switching; the dual hardware and software redundancy switching modes support automatic switching, manual switching, test switching, and remote forced switching modes.

6. The hydraulic station end-to-end dual hardware and software redundancy control system as described in claim 1, characterized in that, The aforementioned Sensor redundancy: Multiple independent sensors are installed at the same measurement point, and valid signals are selected through median selection, weighted averaging, or confidence level. Redundancy in the data acquisition module: Two independent sets of acquisition hardware and software processes; acquisition strategy, data buffering, and synchronous provision of two sets of data to the control module; Redundancy of control modules: Two independent PLC controllers, namely the main controller and the backup controller, and two sets of control software that run independently using different algorithms; the coordination mechanism of the main and backup controllers: the main controller outputs in real time, and the backup controller maintains a "hot standby" state, receiving input in real time, calculating synchronously, but not outputting execution instructions, to ensure that the program parameters of the main and backup controllers are synchronized; Control mechanism redundancy: By using redundant analog / digital output modules to drive different control ports of the same actuator, the final actuator element is controlled in a completely redundant manner, ensuring that a single-path failure does not affect the final action; Redundancy in human-machine interface: independent operator station hardware and independent HMI software; Data storage redundancy: Dual servers with independent data storage hardware and independently running database software services, and shared database storage to achieve near real-time data synchronization; Communication redundancy: The physical layer uses dual network cards, dual switches, and dual communication media, while the protocol layer uses an industrial Ethernet protocol that supports redundancy, enabling seamless switching of communication links when communication faults are detected.

7. A hydraulic station end-to-end dual hardware and software redundancy control system as described in claim 6, characterized in that, The sensors include pressure sensors, flow sensors, temperature sensors, and liquid level sensors.

8. The hydraulic station end-to-end dual hardware and software redundancy control system as described in claim 1, characterized in that, The redundant components in the dual hardware and software redundancy are placed in different locations and physically isolated, providing independent power supplies for the redundant channels. The main and backup control software use different programming languages ​​and algorithms to achieve the same function and use different brands / models of devices.

9. The hydraulic station end-to-end dual hardware and software redundancy control system as described in claim 1, characterized in that, The redundant processes are monitored in real time and self-diagnosed for faults; the consistency of data from two redundant sensors / channels is compared, control commands and feedback signals are compared, and cross-validation techniques such as using mathematical models to compare predictions and measured values ​​are used to determine faults.

10. A full-link dual hardware and software redundancy control system for a hydraulic station as described in claim 1, characterized in that, The aforementioned dual hardware and software redundancy includes a sensor layer, signal conversion layer, data acquisition layer, control decision layer, switching execution layer, human-machine interaction layer, data storage layer, and communication link, all designed with completely independent and functionally equivalent dual-channel redundancy. Each of these layers is connected to the communication link. The sensor layer is connected to the signal conversion layer via dual physical signals. The signal conversion layer is connected to the data acquisition layer via redundant digital signals. The data acquisition layer is connected to the control decision layer via dual-channel data streams. The control decision layer is connected to the execution mechanism layer via redundant control commands. The data acquisition layer and data storage layer are interconnected. The data storage layer and control decision layer are interconnected. The human-machine interaction layer and control decision layer are interconnected.

Images