Multi-modular redundancy computer system level time synchronization method and synchronization device

Abstract

The embodiment of the invention provides a time synchronization method and synchronization device for a multimode redundancy computer system level, and the method comprises the steps: each module has a handshake pulse receiving moment and a handshake pulse generating moment at the same time in a preset synchronization time period, which indicates that the two modules are used as a target module when the handshake synchronization is successful; acquiring a handshake pulse receiving moment and a handshake pulse generating moment of the target module from a handshake synchronization sub-module of the target module through a clock phase locking synchronous control state machine of the target module; a clock phase difference of each target module is determined through a timer comparison output logic unit of each target module according to a handshake pulse receiving moment and a handshake pulse generating moment of the target module; and adopting a synchronization pulse to adjust a square wave signal for timing the local clock of the target module according to the phase difference, so that the phase of the clock of the target module is synchronized. And the time synchronization of the flight control computer with multimode system level redundancy is realized.

Description

Technical Field

[0001] This invention relates to the field of system time synchronization, and more specifically to a time synchronization method and device at the level of a multimodal redundant computer system. Background Technology

[0002] In the current context of commercial spaceflight, large rockets are highly sensitive to the reliability, computing performance, and cost of shipborne computers. In particular, complex recovery missions require the use of real-time operating systems to reduce the difficulty of software development and maintenance, while simultaneously meeting the requirements of high reliability and low cost. This necessitates the use of commercial off-the-shelf industrial-grade processors with triple redundancy.

[0003] In the process of developing this invention, the applicant discovered at least the following problems in the prior art:

[0004] Most existing commercial spacecraft-borne computers still use high-level, highly reliable military-grade components, making single-CPU operation extremely costly. The main reason is the difficulty in handling the synchronization problem between three independent systems. Traditional triple-redundant computer systems, due to the presence of arbitrators, are also costly, have complex architectures, and consume significant power.

[0005] Most off-the-shelf industrial-grade embedded processors are software real-time rather than hardware real-time. Hardware real-time CPUs are expensive and difficult to develop, and usually can only run on a single chip with dual cores locked-step. High reliability of a single chip means the use of high-grade components, but high-grade components are expensive, and there are few types of chips that meet the requirements. Summary of the Invention

[0006] This invention provides a time synchronization method and device at the level of a multi-modal redundant computer system, which can solve the technical problems in the prior art.

[0007] To achieve the above objectives, in a first aspect, embodiments of the present invention provide a time synchronization method at the level of a multi-mode redundant computer system. The multi-mode redundant computer system includes multiple independent modules, each module including a CPU and a field-programmable gate array (FPGA) electrically connected to the CPU. The FPGA includes a multi-mode phase-locked frequency synthesizer, which includes a handshake synchronization unit, a clock phase-locked synchronization control state machine, a timer comparison output logic unit, and a system time counter.

[0008] The handshake synchronization unit includes a pulse generation logic subunit;

[0009] The aforementioned time synchronization method at the multi-modal redundancy computer system level includes:

[0010] According to the pre-set time window, the CPU of each module sends a synchronization request instruction to the handshake synchronization unit of the module itself, and the pulse generation logic subunit of each module generates a handshake pulse signal and sends it to other modules.

[0011] For each module, if the counter in the synchronization unit of the module has both the handshake pulse reception time and its own handshake pulse generation time within the preset synchronization time period, then it is determined that the module has successfully synchronized with the module whose handshake pulse is issued at the handshake pulse reception time, and the module that has successfully synchronized is taken as the target module.

[0012] For each target module, the handshake pulse reception time and the handshake pulse generation time of the target module are obtained from the counter of the handshake synchronization unit of the target module through the clock phase-locked synchronization control state machine of the target module itself, and the handshake synchronization unit of each target module generates a synchronization pulse.

[0013] The clock phase difference between each target module is determined by comparing the timer output logic unit of each target module with the handshake pulse reception time and the handshake pulse generation time of the target module itself. The phase adjustment time of the square wave signal is determined by the clock phase difference between each target module and the count of the combined counter. Based on the phase adjustment time of the square wave signal, the phase of the square wave signal used for timing by the target module is adjusted by the timer comparison output logic unit using a synchronization pulse, so that the phase of the square wave signal of all target modules is synchronized.

[0014] The square wave signal of the target module is counted starting from 0 using the counters of all target modules.

[0015] Secondly, embodiments of the present invention provide a time synchronization device at the level of a multi-mode redundant computer system. The multi-mode redundant computer system includes multiple independent modules, each module including a CPU and a field-programmable gate array (FPGA) electrically connected to the CPU. The FPGA includes a multi-mode phase-locked frequency synthesizer, which includes a handshake synchronization unit, a clock phase-locked synchronization control state machine, a timer comparison output logic unit, and a counter. The handshake synchronization unit includes a pulse generation logic subunit. Wherein:

[0016] Each module's CPU sends a synchronization request command to the module's local handshake synchronization unit according to a pre-set time window.

[0017] The pulse generation logic subunit of each module is used to generate handshake pulse signals and send them to other modules;

[0018] If, within a preset synchronization time period, the counter in the synchronization unit of each module simultaneously has the handshake pulse reception time and its own handshake pulse generation time, then it is determined that the module has successfully synchronized with the handshake pulse issued at the handshake pulse reception time.

[0019] The clock phase-locked synchronization control state machine of the target module obtains the handshake pulse reception time and the handshake pulse generation time of the target module from the counter of the handshake synchronization unit of the target module itself. Here, the target module refers to the module that has successfully completed the handshake.

[0020] The handshake synchronization unit of the target module has a pulse generation logic subunit, which is used to generate synchronization pulses;

[0021] The timer comparison output logic unit of each target module is used to determine the clock phase difference between each target module based on the handshake pulse reception time and the handshake pulse generation time of the target module itself, determine the phase adjustment time of the square wave signal based on the clock phase difference between each target module and the count of the combined counter, and adjust the phase of the square wave signal used for timing by the target module's local clock using the timer comparison output logic unit according to the phase adjustment time of the square wave signal, so that the phase of the square wave signal of all target modules is synchronized.

[0022] The counter is also used to count the local square wave signal starting from 0 while synchronizing the phase of the square wave signal of all target modules.

[0023] Thirdly, embodiments of the present invention provide a multi-mode redundant computer system, including multiple independent modules, each module including the aforementioned handshake device for time synchronization of the multi-mode redundant computer system.

[0024] Fourthly, embodiments of the present invention provide a rocket including the aforementioned multi-mode redundant computer system.

[0025] The above technical solution has the following beneficial effects:

[0026] This method utilizes a handshake synchronization unit for periodic synchronous handshakes. It also obtains the clock phase difference between the target module and other modules based on the handshake pulse reception time and the target module's own handshake pulse generation time. A timer comparison output logic unit uses a synchronization pulse to adjust the phase of the square wave signal used for timing by the target module's own clock, ensuring phase synchronization of the square wave signals of all target modules. The algorithm is simple and effective, consumes minimal logic resources, guarantees high reliability, and has been thoroughly verified through practical experiments. This method effectively solves the problems of high system cost, complex architecture, and high power consumption. Attached Figure Description

[0027] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 This is a flowchart of a time synchronization method at the level of a multi-modal redundant computer system according to an embodiment of the present invention;

[0029] Figure 2 This is a system block diagram of an embodiment of the present invention;

[0030] Figure 3 This is a synchronous phase-locked frequency synthesizer shown in module A of this invention, including some working logic;

[0031] Figure 4 This is a state transition diagram of the state machine of the multimode phase-locked frequency synthesizer according to an embodiment of the present invention;

[0032] Figure 5 This is the actual synchronization pulse waveform in an embodiment of the present invention;

[0033] Figure 6 The timing simulation waveforms of this invention illustrate the synchronous reset phase after power-on.

[0034] Figure 7 This is a partial circuit block diagram of a multi-mode redundant computer system for time synchronization according to an embodiment of the present invention;

[0035] Figure 8 This is a logic state transition diagram according to an embodiment of the present invention;

[0036] Figure 9 This is a timing simulation waveform of the three-machine synchronization process from the perspective of the on-duty aircraft in an embodiment of the present invention;

[0037] Figure 10 This is a simulated waveform of a handshake timeout in a C module of an embodiment of the present invention. Detailed Implementation

[0038] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0039] The technical terms used in the embodiments of this invention are defined as follows:

[0040] SoC: System on Chip. A complete circuit system is integrated on a single chip, which typically includes a CPU, some peripherals, memory, and sometimes FPGA resources.

[0041] FPGA: Field Programmable Gate Array.

[0042] like Figure 1 and Figure 3 As shown, in conjunction with embodiments of the present invention, a time synchronization method at the level of a multi-mode redundant computer system is provided. The multi-mode redundant computer system includes multiple independent modules, each module including a CPU and a field-programmable gate array (FPGA) electrically connected to the CPU. The FPGA includes a multi-mode phase-locked frequency synthesizer, which includes a handshake synchronization unit, a clock phase-locked synchronization control state machine, a timer comparison output logic unit, and a system time counter. The handshake synchronization unit includes a pulse generation logic subunit.

[0043] The aforementioned time synchronization method at the multi-modal redundancy computer system level includes:

[0044] S101: According to the pre-set time window, the CPU of each module sends a synchronization request instruction to the handshake synchronization unit of the module itself, and the pulse generation logic subunit of each module generates a handshake pulse signal and sends it to other modules.

[0045] S102: For each module, if the counter in the synchronization unit of the module has both the handshake pulse receiving time and its own handshake pulse generating time within the preset synchronization time period, then it is determined that the module has successfully synchronized with the module that issued the handshake pulse corresponding to the handshake pulse receiving time, and the module that successfully synchronized is taken as the target module.

[0046] S103: For each target module, the handshake pulse reception time and the handshake pulse generation time of the target module are obtained from the counter of the handshake synchronization unit of the target module through the clock phase-locked synchronization control state machine of the target module itself, and the handshake synchronization unit of each target module generates a synchronization pulse.

[0047] S104: The timer comparison output logic unit of the target module determines the clock phase difference between each target module based on the handshake pulse reception time and the handshake pulse generation time of the target module itself. Based on the clock phase difference between each target module and the count of the counter, the phase adjustment time of the square wave signal is determined. Based on the phase adjustment time of the square wave signal, the timer comparison output logic unit uses a synchronization pulse to adjust the phase of the square wave signal used for timing by the clock of the target module itself, so that the phase of the square wave signal of all target modules is synchronized.

[0048] S105: Count the square wave signal of the target module itself starting from 0 using the counters of all target modules.

[0049] For multi-mode redundant computer systems, there are at least three modes, and the number is odd. Since each computer system is independent and the CPU does not run in lockstep, the operations within a process cannot be strictly synchronized. Therefore, in order to ensure the time consistency of critical instructions or hard actions, each computer system needs to achieve time synchronization at the system level.

[0050] In existing technologies, an arbitrator is typically used to broadcast synchronization time pulses or synchronization instructions to a multi-modal redundant computer system to ensure time synchronization. To ensure the reliability of the arbitrator, at least two arbitrators are required. The reliability of the computer system is ensured by switching the arbitrator through voting among the various computer systems. Therefore, the overall system cost is high, the architecture is complex, and the power consumption is large.

[0051] In this embodiment of the invention, during system-level time synchronization via a hardware-layer handshake synchronization unit, the CPUs of each module send synchronization request commands within a pre-set time window. A handshake synchronization unit is used to perform a handshake before time synchronization. Specifically, the pulse generation logic subunit of each module generates a handshake pulse signal and sends it to other modules. The module that successfully synchronizes with the module that issued the handshake pulse at the time of receiving the handshake pulse is designated as the target module. The purpose of the handshake is to notify other modules that subsequent time synchronization is required.

[0052] Once the handshake synchronization is successful, the time synchronization operation steps for each module can proceed. First, after successful handshake synchronization, a synchronization pulse is generated in the handshake synchronization unit of each target module. Simultaneously, the timer comparison output logic unit of each target module determines the clock phase difference between each target module based on the handshake pulse reception time and the handshake pulse generation time of the target module itself. Based on the clock phase difference between the target modules and the counter count, the phase adjustment time of the square wave signal is determined. According to the phase adjustment time of the square wave signal, the phase of the square wave signal used for timing by the target module's local clock is adjusted by the synchronization pulse through the timer comparison output logic unit, thus synchronizing the phases of the square wave signals of all target modules.

[0053] In this embodiment of the invention, a handshake synchronization unit is used to perform periodic synchronous handshakes. At the same time, the clock phase difference between the target module and other modules can be obtained based on the handshake pulse reception time and the handshake pulse generation time of the target module itself. The timer comparison output logic unit uses the synchronization pulse to adjust the phase of the square wave signal used for timing by the local clock, so that the phase of the square wave signal of all target modules is synchronized and the synchronization clock will not produce glitches or phase changes.

[0054] From the underlying hardware (FPGA-based) to the operating system software, strict frequency and phase locking of multi-mode clock synchronization is achieved, thereby ensuring the time consistency of critical instructions or hard actions. This enables mission-level time synchronization and lock-step execution of critical instructions in a triple-redundant computer, as well as ensuring that tasks within a process move in the same direction. The time synchronization accuracy between them can be guaranteed within plus or minus one operating clock cycle.

[0055] The algorithm is simple and effective, consumes minimal logic resources, ensures high reliability, and has been thoroughly verified through practical experiments. It effectively solves the problems of high system cost, complex architecture, and high power consumption. At the hardware level, it guarantees strict consistency of the underlying time synchronization, eliminating the need for an arbitration module compared to other solutions, thus avoiding the need for voting to select a clock for synchronization.

[0056] Any commercial spot processor uses a time synchronization method based on multi-mode redundant computer system level to realize a real-time multi-mode redundant computer system, which can be used in instruments and equipment in aerospace, medical instruments, mining, nuclear industry and other fields.

[0057] It can be reused in the design process of any computer system that requires multi-mode synchronization. Synchronization includes software-level synchronization and hardware logic-level synchronization, including the control of all synchronization signals such as synchronization clocks and synchronization timing.

[0058] Preferably, S104: By comparing the output logic unit of the timer on each target module, the clock phase difference of each target module is determined based on the handshake pulse reception time and the handshake pulse generation time of the target module. The phase adjustment time of the square wave signal is determined based on the clock phase difference of each target module and the count of the system time counter, including:

[0059] S104-1: By comparing the output logic unit of the timer on each target module, the clock phase difference between each target module is determined based on the handshake pulse reception time and the handshake pulse generation time on the target module itself.

[0060] S104-2: For the target module with the slowest rising edge determined by the clock phase difference, the moment when the clock phase-locked synchronization control state machine jumps to the start of synchronization is directly taken as the start time of the new cycle of the square wave signal.

[0061] S104-3: For other target modules, combining the system timer counter count and the clock phase difference, adjust the output comparison value in the timer comparison output logic unit of the target module. This output comparison value represents the count value in the square wave signal of the target module, and the count value corresponds to the start time of the new cycle of the square wave signal of the slowest target module. That is, the comparison value is the phase adjustment time of the square wave signal of the target module.

[0062] Periodic synchronous handshakes are performed using a handshake synchronization unit. Simultaneously, the clock phase difference between the target module and other target modules can be obtained based on the handshake pulse reception time and the target module's own handshake pulse generation time. This determines the specific timing for phase adjustment, such as adjusting the rising edge occurrence time, and subsequently determines the output comparison value within the timer comparison output logic unit. The output comparison value is then adjusted to change the phase of the square wave signal in the target module, ensuring that all target modules have the same phase, thus achieving time synchronization.

[0063] For output comparator register adjustment, this adjustment occurs when the value of the frequency divider counter is at its maximum value. At this time, the value of the output comparator register is adjusted to the sum of the current value and the latched value of the error counter after synchronization is completed. If the sum is greater than the maximum value of the frequency divider counter, the maximum count value of the frequency divider counter will be subtracted.

[0064] Preferably, S104-2: By comparing the output logic unit of the timer on each target module, the clock phase difference between each target module is determined based on the handshake pulse reception time and the handshake pulse generation time on the target module itself, including:

[0065] For the target module with the slowest rising edge, when the clock phase-locked loop synchronization control state machine jumps to the start synchronization, the synchronization pulse of the target module is used to directly adjust the square wave signal of the target module to zero and directly output the rising edge. At the same time, the timer comparison output logic unit inside the target module counts the square wave signal period from 0.

[0066] S104-3: For other target modules, based on the system time counter count and the clock phase difference, adjust the output comparison value in the timer comparison output logic unit of the target module. This output comparison value represents the count value within the period of the square wave signal of the target module, and the count value corresponds to the start time of the new period of the square wave signal of the slowest target module, including:

[0067] For each other target module, the output comparison value is compared with the count value of the timer comparison output logic unit of the target module through the clock output comparison register of the target module. When the count value of the timer comparison output logic unit is equal to the output comparison value, the square wave signal of the target module is adjusted to the start time of a complete cycle by the synchronization pulse of the target module and the rising edge is started to be output, so that the phase of the square wave signal output by the timer comparison output logic unit of all target modules is synchronized. At the same time, the timer comparison output logic unit in each other target module starts counting the square wave signal cycle from 0.

[0068] Specifically, when the rising edge of the square wave signal occurs in each cycle, the timer comparison output logic unit starts counting from zero until the end of one cycle of the square wave signal, at which point the counting ends and the count reaches the upper limit value; then it is cleared and the counting starts again for a new cycle.

[0069] The output comparison value is compared with the count value of the timer comparison output logic unit of the target module through the clock output comparison register. When the count value of the timer comparison output logic unit is equal to the output comparison value, it means:

[0070] The output comparison value is a value between zero and the upper limit of the count. When the clock output comparison register detects that the count value of the timer comparison output logic unit during the counting process of one cycle of the square wave signal is equal to the output comparison value, it indicates that the count value of the timer comparison output logic unit is equal to the output comparison value. At this time, it is also the time to adjust the rising edge of the square wave signal of the target module. Specifically, the synchronization pulse of the target module is used to adjust the square wave signal of the target module to the beginning time of a complete cycle and start outputting the rising edge, and restart a cycle.

[0071] At this point, all target modules have achieved time synchronization, and this time synchronization operation is complete. The clock adjustment of each target module differs by ±1 system clock cycle, which is within one clock cycle (one cycle of the square wave signal) before and after each target module.

[0072] By adjusting the output comparison value in the timer comparison output logic unit, the phase of the square wave signal used for clock timing is further adjusted to compensate and correct the phase deviation of the clocks of each module, ensuring phase locking of the clocks between each module (i.e., the phase of the square wave signal), and finally achieving step locking (i.e., time synchronization).

[0073] By using the square wave signal of the slowest target module as a reference, the square wave signals of the other faster target modules are adjusted to the rising edge output time of the slowest target module, so that the clock adjustment of each target module differs by ±1 system clock cycle.

[0074] Preferably, the time synchronization method at the multi-modal redundant computer system level further includes:

[0075] S106: At least one frequency of the clock is set via a clock divider counter, which is used by the timer comparison output logic unit to generate a square wave signal output frequency based on the selected frequency. Setting at least one frequency for the clock can satisfy counting for different clocks. The selected frequency is the same for all modules.

[0076] The clock divider timer is used to generate a low-resolution clock, such as a period of 1ms; based on this low-resolution clock, a control cycle interrupt, such as 20ms, can be generated. This low-resolution clock can also be used as a timing reference for the system tick timer and the system time counter.

[0077] The clock divider counter is a free-running counter that continuously accumulates counts of the operating clock. Its maximum value is calculated based on the clock cycle of the lower-resolution clock and the clock cycle of the module's operating clock. For example, with a 10ns operating clock cycle and a 1ms lower-resolution clock cycle, 1ms / 10ns equals 1000. Therefore, the maximum count value of the clock divider counter is 1000 counts from 0 to 999. Furthermore, the clock divider counter will continuously cycle from 0 to 999 and 999 back to 0 indefinitely.

[0078] Preferably, the time synchronization method at the level of a multi-modal redundant computer system further includes:

[0079] S107: For each target module, the control period interrupt generation logic unit sends the square wave signal output by the timer comparison output logic unit to the system time counter and the system tick timer simultaneously, and notifies the system time counter and the system tick timer of their respective count upper limit values. The timing period of the system time counter or the timing period of the system tick timer is determined by the corresponding count upper limit value.

[0080] S108: The system time counter and the system tick timer use the same counting frequency to accumulate counts of the square wave signal. The system time counter is used to represent the time of each target module, and the system tick timer is used to provide synchronous periodic interrupt counting and periodic reset counting for the operating system served by each module.

[0081] The system time of a module can be obtained from the value of the system time counter. The clock frequency corresponding to this system time counter is relatively low, typically one control cycle (e.g., 20ms) of the rocket's attitude control algorithm. The control cycle for time synchronization of each module is also provided by this clock for the control algorithm.

[0082] The system tick timer provides periodic interrupt counts and periodic reset counts for various operating systems (such as a rocket's operating system). It is used for task scheduling and precise delays across these operating systems (the delay functions provided by each module's operating system are consistent). That is, after the tick timers of each module are synchronized, they operate synchronously, and the operating system's task scheduling can also be synchronized across modules. Furthermore, because of its precise delays, it contributes to the macroscopic consistency of task scheduling at the system level in the three-module system. It can also be used to control the timing of some software programs.

[0083] Preferably, the system time counter includes a low-resolution clock and a high-resolution clock. The low-frequency clock counts the square wave signal using a first counting frequency lower than a preset frequency threshold. The high-resolution clock counts the square wave signal within one cycle of the low-resolution clock (starting from the rising edge of the low-frequency clock and ending at the next rising edge) using an interpolation method. The high-resolution clock counter is reset and restarted when the rising edge of the square wave signal appears in each cycle, thus serving the high-precision timing task in the application.

[0084] Preferably, the multimode phase-locked frequency synthesizer further includes a reset signal generation logic unit;

[0085] The aforementioned time synchronization method at the multi-modal redundancy computer system level further includes:

[0086] S109: When each module is powered on for the first time, the reset signal generation logic unit of each module generates a continuous high-level signal (≥1) to perform self-test operation of each module. After the self-test operation is completed, each module enters the handshake synchronization operation for time synchronization. After that, the CPU of each module sends a synchronization request instruction to the handshake synchronization unit of the module itself.

[0087] After powering on each module for the first time, perform a self-test on each module to ensure that each module can work properly, so that the equipment (such as a rocket) containing each module can operate.

[0088] Preferably, one of the multiple independent modules is the on-duty unit, and the other modules are backup units; the handshake synchronization unit includes a pulse generation logic subunit and a pulse edge detection subunit; the multi-mode phase-locked frequency synthesizer also includes a delay timer;

[0089] S109: Upon initial power-on of each module, a continuous high-level signal is generated by the reset signal generation logic unit of each module to perform a self-test. After the self-test is completed and all modules are operating normally, each module enters a time synchronization handshake operation, including:

[0090] S109-1: If the pulse edge detection subunit of the current machine receives a continuous high-level signal (i.e., 1) from the standby machine, it is determined that the counterclockwise reset of the corresponding standby machine is valid.

[0091] S109-2: If the pulse edge detection subunit of the first standby unit receives a continuous high-level signal sent by the current standby unit, and the pulse edge detection subunit of the next standby unit receives a continuous high-level signal sent by the previous standby unit (i.e., 1), until the pulse edge detection subunits of all standby units receive a continuous high-level signal sent by the previous standby unit, then the clockwise reset is deemed valid; this process is very fast, and is the delay of the high-level signal propagating in the device;

[0092] S109-3: After both clockwise and counterclockwise resets are completed, the delay timer will start accumulating from 0 to the set value for a delay. When the delay is completed, it indicates that the pre-reset was successful and all modules can operate normally, and the self-test operation ends. This delay process is used to ensure that all hardware of each module is ready and can work normally.

[0093] S109-4: The state of the clock phase-locked loop synchronization control state machine is switched from waiting for reset handshake to waiting for synchronization reset, and each module enters the time synchronization handshake synchronization operation. Otherwise, if a synchronization error occurs, the module with the synchronization error needs to be checked until it can work normally.

[0094] When using each module for the first time, after powering it on, each module will perform a self-test to ensure that each module can work properly, so that the equipment (such as a rocket) containing each module can operate.

[0095] Preferably, such as Figure 4 As shown, this time synchronization method at the multi-modal redundancy computer system level also includes:

[0096] S110: While waiting for synchronization reset, a synchronization request instruction will be sent to each module handshake synchronization module. Then, the handshake synchronization operation will be entered first, and the handshake will be waited for each module to complete (handshake successful).

[0097] S120: After successful handshake synchronization on the module itself, the state of the clock phase-locked loop synchronization control state machine is switched to idle, indicating successful synchronization reset, and subsequent time synchronization operations can proceed. Upon successful handshake, a strict time synchronization pulse will be generated, indicating successful synchronization reset, meaning the time synchronization operation steps can then be performed. After initial power-on and successful synchronization reset, the system tick timer, system time counter, and clock divider counter will start operating simultaneously.

[0098] S130: After that, the timer comparison output logic unit of each target module will determine the clock phase difference between each target module based on the handshake pulse reception time and the handshake pulse generation time of the target module itself, and determine the phase adjustment time of the square wave signal based on the clock phase difference between each target module and the count of the counter.

[0099] S140: When the adjustment timer comparison output logic unit in each target module adjusts the output comparison value of the target module according to the clock phase difference between each target module, that is, the timer comparison output is successful; the state of the clock phase-locked synchronization control state machine is switched to start synchronization, and a synchronization request instruction is sent to the synchronization handshake unit.

[0100] S150: If each target module completes the rising edge adjustment at the rising edge of the synchronization pulse adjustment square wave signal, the synchronization is successful through the handshake synchronization unit, and the state of the clock phase-locked synchronization control state machine is sequentially switched to synchronized and idle.

[0101] S160: If at least one module times out of synchronization, the state of the clock phase-locked loop synchronization control state machine jumps to synchronization error.

[0102] S170: If one of the target modules times out during synchronization, meaning no rising edge adjustment was performed, it indicates a synchronization error. Each time a synchronization error occurs, the synchronization error monitoring counter increments by 1. If the module experiences intermittent synchronization errors, the timeout error counter within the clock phase-locked synchronization control state machine of the target module is cleared. If the module experiences continuous synchronization errors, and the synchronization error count exceeds the error threshold before another synchronization error occurs, a module bypass will be triggered, setting the module as a bypass. Modules set as bypasses will no longer participate in subsequent synchronization handshakes. Bypassing does not affect the output of the synchronization clock (no glitches, no additional clock jitter).

[0103] The clock-locked loop synchronization control state machine uses one-hot encoding, which has a certain fault tolerance capability. Other encoding methods, such as Gray code, can also be used.

[0104] The register unit is used to store the state within the clock phase-locked loop (PLL) synchronization control state machine.

[0105] Preferably, the handshake synchronization unit further includes a pulse edge detection subunit corresponding to other modules;

[0106] Preferably, S101: According to a pre-set time window, each module's CPU sends a synchronization request instruction to the module's local handshake synchronization unit, and each module's pulse generation logic subunit generates a handshake pulse signal and sends it to other modules, including:

[0107] S101-1: According to the pre-set time window, the CPU of each module sends a synchronization request instruction to the handshake synchronization unit of each module (i.e., the module itself is the module, which is the industry common term).

[0108] S101-2: Each module generates a handshake pulse signal through its own pulse generation logic subunit and sends the handshake pulse signal to other modules;

[0109] S102: For each module, if the counter in the synchronization unit of that module simultaneously has both the handshake pulse reception time and its own handshake pulse generation time within the preset synchronization time period, then it is determined that the module's handshake synchronization with the handshake pulse issued at the handshake pulse reception time is successful, including:

[0110] S102-1: When the handshake pulse signal of the corresponding module is detected by the pulse edge detection subunit of the corresponding module in the local unit of each module, the handshake pulse reception time is recorded.

[0111] S102-2: For each module, within a preset synchronization time period, the module simultaneously has a handshake pulse reception time and its own handshake pulse generation time, indicating that the module's handshake synchronization with the module corresponding to the handshake pulse reception time is successful in this handshake.

[0112] Multiple independent modules constitute an odd number of sets, such as three sets, which are typically designated as Module A, Module B, and Module C by default. Figure 7 The interconnections between the three modes are shown. The circuit logic of the three modes is the same, and the algorithm logic block diagram of the A mode (i.e., the A mode SoC) is also shown. In the A mode, the handshake synchronization unit has two transmit pulse interfaces (to send handshake pulse signals to the B mode and the C mode respectively: A→B handshake pulse signal and A→C handshake pulse signal) and two receive pulse interfaces (to receive the handshake pulse signals sent by the B mode and the C mode respectively: B→A handshake pulse signal and C→A handshake pulse signal).

[0113] The tri-mode CPU sends synchronization request commands within a pre-defined time window, which are then transmitted to the AXI interface of the handshake synchronization unit via the AXI bus. The AXI interface is standardized and can parse different types of commands, thus easily obtaining the internal state of each module. Additionally, the CPU's configured parameters (including pulse width, handshake timeout, filter parameters, and handshake result status) can be sent to the handshake synchronization unit, and the CPU can receive status updates from the handshake synchronization unit. Other interface protocols, such as 8080, can also be used.

[0114] After the handshake synchronization unit of each module performs a handshake with the handshake synchronization unit of other modules, the start time of a three-mode time synchronization is determined based on the time difference between the pulses during the handshake. This adjusts the square wave signals used for timing in each module, ultimately achieving three-mode time synchronization.

[0115] Compared to existing technologies, this invention implements inter-mode handshake synchronization logic using hardware logic. The handshake method is simple and reliable, without complex protocols, has low logic resource consumption, low cost, and is fast, ending immediately upon success. This also speeds up subsequent time synchronization. The smaller the time difference between the handshake pulse signals sent by the three modes, the faster the handshake process completes, greatly improving the efficiency of handshake synchronization, saving CPU time, and reducing the time overhead caused by handshake synchronization.

[0116] Preferably, the handshake synchronization unit further includes the same number of counters as the modules, the counters including a local counter and a receive counter corresponding to each of the other modules;

[0117] Preferably, in S102, it further includes:

[0118] S102-3: The local counter records the moment the handshake pulse is generated by this module and continuously counts to record the duration after the handshake pulse is sent; the pulse generation logic subunit generates a handshake pulse signal and controls the local receiver counter to start counting by notifying the logic state machine, indicating that the module has started sending a handshake pulse signal. S102-3 and S102-1 are basically performed simultaneously.

[0119] In S102-1, the handshake pulse reception time is recorded, including:

[0120] By using a receiver counter corresponding to other modules, the system records the moment a handshake pulse signal is received upon detection by another module, and continuously counts to record the duration after the handshake pulse is sent. The circuit of the pulse edge detection subunit is used to detect the rising edge of the handshake pulse signal; then, it notifies the logic state machine to control the corresponding receiver counter to start counting, indicating that a handshake pulse signal from another module has been received.

[0121] Since each module synchronizes by sending handshake pulses to and receiving handshake pulses from other modules, a receiver counter corresponding to each module can record the receiving time of the corresponding module's handshake pulse. Because the handshake pulse transmission speed is extremely fast, the receiving time of the corresponding module's handshake pulse is the same as the occurrence time of the corresponding module's handshake pulse. Therefore, the time difference between the corresponding module and the module's own handshake pulse can be determined based on the difference between the receiving time and the occurrence time of the handshake pulse on the module itself. Furthermore, the phase adjustment of the module's own square wave signal can be set according to the frequency and width of the square wave signal used for timing. Of course, it can also record the module's handshake timeout.

[0122] Preferably, the handshake synchronization unit includes a logic state machine connected to the pulse generation logic subunit;

[0123] In S101-1, the CPU of each module sends a synchronization request signal to the handshake synchronization unit of each module, including:

[0124] Each module's CPU sends a synchronization request signal to its local logic state machine. When the logic state machine is idle, it notifies the local pulse generation logic subunit to generate a handshake pulse signal.

[0125] The logic state machine is used for the handshake logic function within this module. The logic state machine can use one-hot encoding, which has a certain fault tolerance capability, or it can use other encodings such as Gray code.

[0126] Preferably, before S101, the method further includes:

[0127] The CPU sets the width of the handshake pulse signal to be no less than a width threshold, and the width of the handshake pulse is adjustable. The purpose is to ensure that the module receiving the handshake pulse can accurately identify the handshake pulse to be received.

[0128] Preferably, the handshake synchronization unit further includes an odd number of redundant debouncing filters disposed before each of the pulse edge detection subunits and connected to the pulse edge detection unit;

[0129] Preferably, in S102, it further includes:

[0130] S102-4: The handshake pulse signals sent by other modules are received by the odd-numbered sets of debouncing filters, and the handshake pulse signals are denoised and debounced to obtain the corresponding debouncing pulse signals. The purpose of the debouncing filters is to debouncing the input handshake pulse signals to ensure reliable reception of the handshake pulse signals and improve anti-interference capability.

[0131] S102-5: After each set of debounce filters undergoes a vote by raising hands, if half of the sets of debounce filters obtain the same debounce pulse signal, the debounce pulse signal is used as the detection pulse signal, and the detection pulse signal is used to input to the pulse edge detection subunit.

[0132] S102-4 and S102-5 are executed before S102-1.

[0133] Within each module, at least three sets of debounce filters are located before each pulse edge detection subunit and connected to the pulse edge detection unit, for use in a two-out-of-three voting process to improve reliability.

[0134] Preferably, S102-4: The handshake pulse signals sent by other modules are received through an odd number of sets of the debouncing filters, and the handshake pulse signals are denoised and debounced to obtain corresponding debouncing pulse signals, including:

[0135] Each set of debouncing filters integrates the handshake pulse signals sent by other modules. When the integrated value exceeds the upper limit threshold, the integrated value is kept at the upper limit threshold, and the output value is marked as 1, where 1 indicates a high level.

[0136] Once the integral value falls below the lower threshold, the integral value is maintained at the lower threshold, and the output value is marked as 0, where 0 represents a low level.

[0137] The output value is used as a debounce pulse signal.

[0138] Each module contains at least three sets of debouncing filters for a 2-out-of-3 voting mechanism. This means that the integrators in the three sets of debouncing filters will refresh their integral values ​​in real time with triple modulo redundancy. This is to address single-event flips caused by single-event events if only one set of debouncing pulse signals is used. This is because if a bit in the counter flips, the value of the counter that counts the integral will change abruptly, which may cause the state of the output debouncing pulse signal to change abruptly, affecting the accuracy of the subsequent pulse edge detection subunit in detecting the handshake pulse signal.

[0139] Preferably, it further includes:

[0140] S170: After receiving handshake pulse signals from other modules for a set duration, the flag indicating that the handshake pulse signal was received in the logic state machine is cleared, and the corresponding receive counter is also cleared, thus eliminating all operations related to invalid handshakes. This indicates that the handshake is complete. Ending the handshake process early will allow the system to proceed to the time synchronization step sooner, improving the speed of time synchronization. Alternatively,

[0141] S180: After the current handshake synchronization, the flag indicating that the handshake pulse signal was received in the logic state machine is cleared, and the corresponding receive counter is also cleared. This indicates that the handshake synchronization was successful, and the time synchronization step can proceed. Additionally, the logic state is put into an idle state to await the next handshake.

[0142] Preferably, it further includes:

[0143] S190: If any module does not receive a handshake pulse signal from another module within the preset synchronization time period, the other module will time out. If multiple timeouts occur consecutively, the other module will be bypassed by operating the corresponding register through software, indicating that the other module has malfunctioned.

[0144] S210: If any module fails to send a handshake pulse signal to other modules within a preset number of synchronization attempts, the module that fails to send a handshake pulse signal to other modules will time out. If multiple timeouts occur consecutively, the corresponding register will be controlled, and the other module will be bypassed, indicating that the other module has malfunctioned.

[0145] The fault-bypass module does not need to participate in the subsequent time synchronization work. Other modules perform time synchronization work and participate in the work after time synchronization, such as parsing instructions, generating instructions, and sending instructions.

[0146] Preferably, it further includes:

[0147] S220: If the CPU of the module sends a synchronization request signal to the logic state machine of the module, the logic state machine is in the start synchronization state. At this time, the pulse generation logic subunit of the module generates a handshake pulse signal. If the receive counters corresponding to other modules are all less than the timeout threshold, the module immediately enters the waiting synchronization state. Otherwise, it enters the timeout state. After entering the timeout state, it immediately returns to the idle state.

[0148] S230: If the handshake pulse generation time of the module itself is within the timeout threshold, and if the handshake pulse reception time of the handshake synchronization pulse signal sent by the module to other modules is within the timeout threshold, and the logic state machine has a flag signal for the handshake pulse signal sent by other modules; then it indicates that the handshake synchronization in the waiting synchronization state is successful; if the handshake synchronization is successful, the logic state machine will jump to the handshake synchronization completed state and the idle state in sequence.

[0149] S240: If the handshake pulse generation time of the module exceeds the timeout threshold, or if the handshake pulse reception time of the module receiving the handshake synchronization pulse signal sent by any other module exceeds the timeout threshold, it indicates that the handshake synchronization with any other module has timed out while waiting for synchronization.

[0150] A multimodal redundant computer system comprises multiple independent modules, each running a completely identical program. Due to factors such as self-clock frequency deviations between modules, CPU branch prediction failures, and random operating system scheduling, the three systems cannot operate in strict synchronization. Strict synchronization is required at critical nodes (e.g., when sending external instructions). Each program periodically performs a handshake synchronization unit to maintain macroscopic consistency, achieving strict synchronization after the handshake. Therefore, the handshake synchronization unit requires a state machine logic to control this process. The logic state transition diagram is implemented using a logic state machine, such as... Figure 8 As shown, the logical state includes five states: Idle, Start Synchronization, Waiting for Synchronization, Synchronization Timeout, and Synchronization Complete. The following example will still focus on Module A.

[0151] 1. The state of the logic state machine is idle.

[0152] When the logic state machine is in an idle state, it waits to receive a synchronization request instruction. Upon receiving the synchronization request instruction from the CPU, the logic state machine immediately jumps to the state of starting synchronization.

[0153] 2. The state of the logic state machine is "Start Synchronization".

[0154] Upon initial power-on, the logic state machine will enter a waiting synchronization state. If none of the modules have timed out, it will command the pulse generation logic subunit to send handshake pulse signals to the other two modules. The state machine will then transition to the waiting synchronization state and wait for responses from modules B and C. From the second power-on onwards, whenever the logic state machine is idle, it can command the pulse generation logic subunit to send handshake pulse signals to the other two modules.

[0155] For module A, this process involves two scenarios. First, module A starts operating earlier than module B, module C, or one of them. Therefore, when module A sends its handshake pulse signal, module B, module C, or one of them has not yet sent their handshake pulse signals. Second, when module A starts operating later than module B, module C, or one of them, module A has already received the handshake pulse signals from module B, module C, or one of them when it sends its own. The local counter of module A begins counting after receiving the synchronization request command and sending the handshake pulse signal.

[0156] When module A receives the handshake pulse signal from module C, the synchronization handshake unit of module A starts counting from the receiver counter corresponding to module C, "the counter in module A used to receive signals from module C." After module A receives the handshake pulse signal from module B, the counter in module A used to receive signals from module B starts counting. Both counters remain until the synchronization timeout ends or synchronization is completed, at which point they are cleared and stop accumulating. If module B, module C, or any of these modules times out after synchronization has begun, the system immediately jumps to the synchronization timeout state.

[0157] Since the time of receiving the handshake pulse signal is random for the A-mode, it may occur before or after the A-mode generates the handshake pulse signal. Therefore, when the A-mode receives the handshake pulse, the "counter in the A-mode for receiving the C-mode" must record the handshake pulse reception time.

[0158] Similarly, when a handshake pulse signal from mode B to mode A is detected, the flag BtoA_OK is recorded as 1, and when a handshake pulse signal from mode C to mode A is detected, the flag CtoA_OK is recorded as 1.

[0159] For the generation of handshake pulse signals, if the counter values ​​from module C to module A and from module B to module A are both less than the timeout threshold of the timeout register (OVERTIME_REG, located within the register group), the pulse generation logic subunit will issue a handshake pulse signal. The pulse width can be specified by relevant parameters. A width threshold is set as the lower limit for the handshake pulse signal, aiming to ensure that the other two modules can reliably receive the handshake pulse signal from module A. If the handshake pulse signal has not yet ended, but the handshake between modules has been completed (i.e., the interval between handshake pulse signals initiated by at least two of the three modules is less than the handshake pulse width), the corresponding pulse generation logic subunit will immediately set its output to a low level. This is to ensure that the handshake synchronization process is completed as quickly as possible, thereby ensuring the reception of subsequent time synchronization pulses, improving the efficiency of the subsequent time synchronization process, and reducing the time overhead of the time synchronization process.

[0160] 3. The state of the logic state machine is waiting for synchronization.

[0161] In the waiting synchronization state, the determination of successful synchronization of A mode is that successful synchronization of A mode requires the following conditions to be met simultaneously: the handshake pulse reception time recorded by the local counter of A mode is less than the timeout threshold.

[0162] And meet one of the following conditions: the handshake pulse reception time of the counter used to receive the C mode in mode A is less than the timeout threshold, or the handshake pulse reception time of the counter used to receive the B mode in mode A is less than the timeout threshold.

[0163] And meet one of the following conditions: the handshake pulse signal sent from B mode to A mode is marked as 1, indicating that B mode is fault-bypassed;

[0164] And it must meet one of the following conditions: the handshake pulse signal sent from mode C to mode A is marked as 1, and mode C is fault-bypassed.

[0165] After all three modes have successfully completed the handshake and synchronization, or if one of the modes is faulty and bypassed, the logic state machine will jump to the synchronization completed state and then return to the idle state.

[0166] The determination of synchronization timeout status in the waiting synchronization state can be made if one of the following conditions is met: the handshake pulse reception time of the counter used to receive the C mode in mode A is not less than the timeout threshold; the handshake pulse reception time of the counter used to receive the B mode in mode A is not less than the timeout threshold; or the handshake pulse reception time recorded by the local counter of mode A is not less than the timeout threshold.

[0167] If none of the other modules have timed out, the module is still in the state of waiting for synchronization.

[0168] 4. The state of the logic state machine is synchronization timeout.

[0169] For module A, a synchronization timeout means that at least one other module experiences a synchronization timeout, and one of all modules experiences a timeout. After a synchronization timeout, three scenarios exist: synchronization with both modules B and C fails (including simultaneous or singular occurrences of module B bypass failure and module C bypass failure), module B synchronization fails while module C synchronization succeeds or bypasses, or module C synchronization fails while module B synchronization succeeds or bypasses. When a synchronization timeout occurs while waiting for synchronization, the logic state machine transitions to the synchronization timeout state.

[0170] In the case of synchronization timeout, if both B-mode and C-mode synchronization fail, the following steps will be taken:

[0171] When the handshake pulse signal sent from mode C to mode A is marked as 0 (invalid) and the handshake pulse signal sent from mode B to mode A is marked as 0 (invalid), if the fault bypass flag of mode B is valid, the synchronization status of mode B is recorded as discarded; otherwise, it is recorded as timeout. If the fault bypass flag of mode B is valid, the synchronization status of mode C is recorded as discarded; otherwise, it is recorded as timeout.

[0172] In the case of synchronization timeout, the handling of C-mode failure and B-mode success or bypass:

[0173] If the handshake pulse reception time of the counter used to receive the B mode in mode A is not less than the timeout threshold, and the fault bypass flag of mode B is valid, then the synchronization status of mode B is recorded as discarded; otherwise, it is recorded as timeout. Otherwise, if the handshake pulse reception time of the counter used to receive the B mode in mode A is less than the timeout threshold, and the fault bypass flag of mode B is valid, then the synchronization status of mode B is recorded as discarded; otherwise, it is recorded as successful synchronization.

[0174] Handling of B-mode failure and C-mode success or bypass in timeout state:

[0175] If the handshake pulse reception time of the counter used to receive the C mode in mode A is not less than the timeout threshold, and the fault bypass flag of mode C is valid, then the synchronization status of mode C is recorded as discarded; otherwise, it is recorded as timeout. Otherwise, if the handshake pulse reception time of the counter used to receive the C mode in mode A is less than the timeout threshold, and the fault bypass flag of mode C is valid, then the synchronization status of mode C is recorded as discarded; otherwise, it is recorded as successful synchronization.

[0176] 5. Completed simultaneously

[0177] If all handshakes are successful, synchronization is complete, and the system enters an idle state. The synchronization completion status will be simultaneously updated in the synchronization status register within the register.

[0178] In conjunction with embodiments of the present invention, a time synchronization device at the level of a multi-mode redundant computer system is provided. The multi-mode redundant computer system includes multiple independent modules, each module including a CPU and a field-programmable gate array (FPGA) electrically connected to the CPU. The FPGA includes a multi-mode phase-locked frequency synthesizer, which includes a handshake synchronization unit, a clock phase-locked synchronization control state machine, a timer comparison output logic unit, and a counter. The handshake synchronization unit includes a pulse generation logic subunit. Wherein:

[0179] Each module's CPU sends a synchronization request command to the local handshake synchronization unit according to a pre-set time window.

[0180] The pulse generation logic subunit of each module is used to generate handshake pulse signals and send them to other modules;

[0181] If, within a preset synchronization time period, the counter in the synchronization unit of each module simultaneously has the handshake pulse reception time and its own handshake pulse generation time, then it is determined that the module has successfully synchronized with the handshake pulse issued at the handshake pulse reception time.

[0182] The target module's clock phase-locked synchronization control state machine obtains the handshake pulse reception time and the handshake pulse generation time from the counter of the handshake synchronization unit of the local machine. Here, the target module refers to the module that has successfully completed the handshake.

[0183] The handshake synchronization unit of the target module has a pulse generation logic subunit, which is used to generate synchronization pulses;

[0184] The timer comparison output logic unit of each target module is used to determine the clock phase difference between each target module based on the handshake pulse reception time and the handshake pulse generation time of the local unit, determine the phase adjustment time of the square wave signal based on the clock phase difference between each target module and the count of the combined counter, and adjust the phase of the square wave signal of the local unit using a synchronization pulse through the timer comparison output logic unit according to the phase adjustment time of the square wave signal, so that the phase of the square wave signal of all target modules is synchronized.

[0185] The counter is also used to count the local square wave signal starting from 0 while synchronizing the phase of the square wave signal of all target modules.

[0186] Preferably, the timer comparison output logic unit of each target module is specifically used for:

[0187] The clock phase difference between each target module is determined based on the handshake pulse reception time and the handshake pulse generation time of the local machine.

[0188] For the target module with the slowest rising edge determined by the clock phase difference, the time when the square wave signal is synchronized is directly taken as the start time of the new cycle of the square wave signal.

[0189] For other target modules, the output comparison value in the timer comparison output logic unit of the target module is adjusted by combining the count of the system time counter and the clock phase difference. The output comparison value represents the count value in the period of the square wave signal of the target module, and the count value corresponds to the start time of the new period of the square wave signal of the slowest target module.

[0190] Preferably, the time synchronization device at the level of a multi-modal redundant computer system further includes:

[0191] The timer comparison output logic unit of the target module with the slowest rising edge is used to directly adjust the square wave signal of the target module to zero and directly output the rising edge when the clock phase-locked synchronization control state machine jumps to the start synchronization. At the same time, it counts the square wave signal period from 0.

[0192] The clock output compare register of each other target module is used to compare the output compare value of the target module with the count value of the timer compare output logic unit of the target module; the clock output compare register belongs to the system time counter;

[0193] The timer comparison output logic unit of each other target module is used to adjust the square wave signal of the target module to the start time of a complete cycle and start outputting a rising edge when the count value of the timer comparison output logic unit is equal to the output comparison value, so that the phase of the square wave signal output by the timer comparison output logic unit of all target modules is synchronized; at the same time, the counting of the square wave signal cycle starts from 0.

[0194] Preferably, the time synchronization device at the multi-mode redundant computer system level further includes:

[0195] A clock divider counter is used to set at least one frequency of a clock.

[0196] The timer compare output logic unit is used to generate the output frequency of a square wave signal based on the selected frequency; wherein, the clock selected frequency is the same for all modules.

[0197] Preferably, the time synchronization device at the level of a multi-modal redundant computer system further includes:

[0198] The control cycle interrupt generation logic unit of each target module is used to simultaneously send the square wave signal output by the timer comparison output logic unit to the system time counter and the system tick timer, and notify the system time counter and the system tick timer of their respective count upper limit values. The timing period of the system time counter or the timing period of the system tick timer is determined by the corresponding count upper limit value.

[0199] Both the system time counter and the system tick timer use the same counting frequency to accumulate counts of the square wave signal. The system time counter is used to represent the time of each target module, and the system tick timer is used to provide synchronous periodic interrupt counting and periodic reset counting for the operating system served by each module.

[0200] Preferably, the system time counter includes a low-resolution clock and a high-resolution clock, wherein:

[0201] The low-frequency clock counting refers to using a first counting frequency lower than a preset frequency counting threshold to accumulate and count the square wave signal.

[0202] The high-resolution clock refers to the clock that uses interpolation to accumulate and count the square wave signal within one cycle of the square wave signal of the low-resolution clock, and simultaneously resets the counter of the high-resolution clock to zero and starts counting again when the rising edge of the square wave signal appears in each cycle.

[0203] Preferably, the multimode phase-locked frequency synthesizer further includes a reset signal generation logic unit;

[0204] The reset signal generation logic unit of each module is used to generate a continuous high-level signal after each module is powered on for the first time to perform the module's self-test operation until the self-test operation is completed. After the self-test operation is completed, each module enters the time synchronization handshake synchronization operation.

[0205] Preferably, one of the multiple independent modules is the on-duty unit, and the other modules serve as backup units; the handshake synchronization unit includes a pulse generation logic subunit and a pulse edge detection subunit; the multi-mode phase-locked frequency synthesizer also includes a delay timer; wherein:

[0206] The pulse edge detection subunit of the standby machine is used to determine whether the counterclockwise reset of the corresponding standby machine is valid when a continuous high-level signal is received from the standby machine.

[0207] If the pulse edge detection subunit of the first standby machine receives a continuous high-level signal sent by the current machine, and the pulse edge detection subunit of the next standby machine receives a continuous high-level signal sent by the previous standby machine, until all standby machines' pulse edge detection subunits receive a continuous high-level signal sent by the previous standby machine, then the clockwise reset is deemed valid.

[0208] The delay timer is used to start accumulating from 0 to a set value for a delay after both clockwise and counterclockwise resets are completed. When the delay is completed, it indicates that the pre-reset was successful, that the module's self-test operation is over, and that all modules are operating normally.

[0209] The clock phase-locked synchronization control state machine of each module is used to switch the state of the clock phase-locked synchronization control state machine from waiting for reset handshake to waiting for synchronization reset, and each module enters the time synchronization handshake synchronization operation.

[0210] Preferably, the clock phase-locked synchronization control state machine is specifically used for:

[0211] After the handshake synchronization of the module is successful, the state of the clock phase-locked synchronization control state machine will jump to idle, indicating that the synchronization reset is successful.

[0212] When the output comparison value of the target module is adjusted by adjusting the timer comparison output logic unit within each target module, and the count value of the timer comparison output logic unit is equal to the output comparison value, it indicates that the timer comparison output is successful; the state of the clock phase-locked synchronization control state machine is switched to start synchronization, and a synchronization request command is sent to the synchronization handshake unit at the same time;

[0213] If each target module completes the rising edge adjustment at the rising edge of the synchronization pulse adjustment square wave signal, the synchronization is successful through the handshake synchronization unit, and the state of the clock phase-locked synchronization control state machine is sequentially switched to synchronized and idle.

[0214] If one of the target modules times out, it indicates a synchronization error. Each time a synchronization error occurs, the synchronization error monitoring counter increments by 1. If the module experiences intermittent synchronization errors, the timeout error counter in the clock phase-locked synchronization control state machine of the target module is cleared. If the module experiences continuous synchronization errors, when the synchronization error count exceeds the error threshold and another synchronization error occurs, a module switching bypass will be triggered, setting the module as a bypass. Modules set as bypasses will no longer participate in subsequent synchronization handshakes.

[0215] Preferably, in this multi-mode redundant computer system-level time synchronization device, the handshake synchronization unit includes a pulse generation logic subunit, a counter, and a pulse edge detection subunit corresponding to other modules, wherein the pulse generation logic subunit is electrically connected to the CPU;

[0216] The CPU of each module is used to send synchronization request instructions to the handshake synchronization unit of each module according to a pre-set time window; the CPU communicates with the AXI interface integrated into the FPGA of the module through the AXI bus, and then sends synchronization request instructions to the handshake synchronization unit.

[0217] Each module has its own pulse generation logic subunit, which generates handshake pulse signals, sends the handshake pulse signals to other modules, and records the handshake pulse generation time of each module.

[0218] The pulse edge detection subunits corresponding to other modules are used to record the handshake pulse reception time when the handshake pulse signal of the corresponding module is detected.

[0219] The counter in each module simultaneously contains the handshake pulse reception time and its own handshake pulse generation time within the preset synchronization time period, indicating that the module that issued the handshake pulse corresponding to the handshake pulse reception time successfully synchronized with the module in that handshake.

[0220] Preferably, the number of counters is the same as the number of modules, and the counters include: a local counter and a receiving counter corresponding to each of the other modules;

[0221] The local counter is used to record the handshake pulses generated by this module and to continuously count the duration after the handshake pulse is emitted.

[0222] The receiver counter, corresponding to other modules, is used to record the moment when a handshake pulse signal is detected sent by other modules, and to continuously count to record the duration after the handshake pulse is sent.

[0223] Preferably, the handshake synchronization unit includes a logic state machine connected to the pulse generation logic subunit; wherein:

[0224] The logic state machine is used to receive synchronization request signals sent by the CPU of each module, and in an idle state, to notify the pulse generation logic subunit of each module to generate handshake pulse signals; and after receiving handshake pulse signals sent by other modules for a set duration, to clear the mark signal that marks the handshake pulse signal, or after the current handshake synchronization, to clear the mark signal that marks the handshake pulse signal.

[0225] The receive counter is used to clear the receive counter after the mark signal that marks the handshake pulse signal is cleared.

[0226] Preferably, the handshake synchronization unit further includes a debouncing unit disposed before and connected to each pulse edge detection subunit, the debouncing unit including an odd number of redundant debouncing filters and a voting subunit;

[0227] Each set of the aforementioned debouncing filters is used to receive handshake pulse signals sent by other modules and to denoise and debouncing the handshake pulse signals to obtain the corresponding debouncing pulse signals;

[0228] The voting subunit is used to, after each set of debounce filters has undergone a show of hands voting, if at least the second odd number of sets of debounce filters have the same debounce pulse signal, use the debounce pulse signal as a detection pulse signal, and the detection pulse signal is used to input to the pulse edge detection subunit.

[0229] Preferably, the handshake synchronization unit further includes a register for storing numerical values;

[0230] The handshake synchronization unit further includes a buffer located after the pulse edge detection subunit and a buffer located before each of the pulse edge detection subunits.

[0231] Figure 9 This is the timing simulation waveform of the three-mode synchronization process from the perspective of mode A. The yellow vertical line represents the moment when mode A initiates the handshake pulse signal (start_sync_A). It can be seen that mode C has already initiated the handshake pulse signal (start_sync_C) before mode A initiates it. Mode B initiates synchronization (start_sync_B) some time after mode A initiates it, which is a typical three-mode synchronization handshake process. Among them:

[0232] In the first column, `reg_A2B_pulse` represents the handshake pulse signal sent from module A to other module B; `reg_A2C_pulse` represents the handshake pulse signal sent from module A to module C; `reg_B2A_pulse` represents the handshake pulse signal sent from module B to module A; `reg_C2A_pulse` represents the handshake pulse signal sent from module C to module A; `sync_b2a_ok` indicates that a handshake pulse signal sent from module B to module A has been detected; `sync_c2a_ok` indicates that a handshake pulse signal sent from module C to module A has been detected; `sync_ok` indicates whether the three-module handshake synchronization was successful; `timeout_count_c2a_la` represents the latch value of the counter corresponding to module C in module A, used to calculate the generation time of the square wave signal used for time synchronization; `timeout`... `t_count_b2a_la` represents the latch value of the counter corresponding to the B mode in mode A, indicating the generation time of the square wave signal used for time synchronization; `timeout_count_c2a` represents the count value of the counter corresponding to the C mode in mode A, i.e., the count of the handshake pulse signal sent by the C mode, and the number following it (marked by a yellow vertical line) is the specific count value; `timeout_count_b2a` represents the count value of the counter corresponding to the B mode in mode A, i.e., the count of the handshake pulse signal sent by the B mode, and the number following it (marked by a yellow vertical line) is the specific count value; `timeout_count_self` represents the count value of the local counter in mode A when the handshake pulse signal is generated by the mode A itself, i.e., the count of the handshake pulse signal generated by the mode A itself, and the number following it (marked by a yellow vertical line) is the specific count value.

[0233] The Value column in the second column represents the signal value of the handshake synchronization pulse, and the number following it, located under the yellow vertical line, is the specific count value; the number ending in ns represents the timing of the local clock in the A-mode.

[0234] After a period of time, once the handshake synchronization is successful, it can be seen that interrupt requests are sent from mode A, mode B and mode C respectively. These are the synchronization pulses reg_sync_int_A, reg_sync_int_B and reg_sync_int_C used to adjust the phase of the square wave signal of mode A (pulse signals initiated by modes A, B and C).

[0235] Figure 10 Simulate the handshake timeout situation between model A and model C from the perspective of model A. The symbols and their meanings are as follows: Figure 9The results are completely consistent. The yellow vertical line represents the moment when mode A initiates the handshake pulse signal (start_sync_A). It can be seen that after mode A and mode B initiate the handshake pulse signal, mode C has not yet initiated the handshake pulse signal after the timeout threshold.

[0236] In conjunction with embodiments of the present invention, a multi-mode redundant computer system is provided, comprising multiple independent modules, each module including a handshake device for time synchronization of the multi-mode redundant computer system as described above.

[0237] In conjunction with embodiments of the present invention, a rocket is provided, including the aforementioned multi-mode redundancy computer system.

[0238] Figure 2 This is a system block diagram of an embodiment of the present invention. It includes a multi-mode phase-locked loop (PLL) frequency synthesizer. Depending on specific needs, it may include a system task scheduler, a system clock service, and a hardware abstraction layer. This is just an example; the configuration will vary depending on the specific situation and will not be elaborated upon. The PLL frequency synthesizer can also provide synchronization services for other hardware modules in the FPGA, such as multi-mode synchronized analog signal acquisition and control, hardware communication, data synchronization, and digital input / output.

[0239] The system task scheduler is a core function program in the operating system software. It is invoked through periodic interrupts of the system tick timer to coordinate CPU time resources and allocate time reasonably to ready processes.

[0240] System cycle time service is a periodic interrupt that provides cycle time for various software in the system. For example, in automatic control, it is commonly used to periodically acquire the feedback values ​​of sensors to actuators, calculate the error, give control quantities, and then adjust the actuators. This process is periodic and continuously iterates.

[0241] The Hardware Abstraction Layer (HAL) is primarily used to represent the relationships between different layers. It abstracts the underlying differences in computer system hardware into a unified program interface for the operating system, unifying and defining system layers to decouple their design.

[0242] APPs represent various applications that run on top of an operating system.

[0243] Figure 5 The actual synchronization pulse waveform of a specific embodiment shows that the maximum jitter between the rising edges of the synchronization pulses between mode A (digit 1 in the first column), mode B (digit 2 in the first column), and mode C (digit 3 in the first column) is 20ns. The working clock of this real-time example is 100MHz, which satisfies the synchronization time accuracy guarantee of plus or minus one working clock cycle. Among them, mode B is the target module with the slowest rising edge.

[0244] Figure 6The simulation waveform shows the synchronous reset phase after power-on, where the reset_all_n signals of modes A, B, and C are synchronously pulled high.

[0245] It should be understood that the specific order or hierarchy of steps in the disclosed process is an example of an exemplary method. Based on design preferences, it should be understood that the specific order or hierarchy of steps in the process may be rearranged without departing from the scope of this disclosure. The appended method claims provide elements of various steps in an exemplary order and are not intended to limit the scope to the specific order or hierarchy described.

[0246] In the above detailed description, various features are combined together in a single embodiment to simplify this disclosure. This approach to disclosure should not be construed as reflecting an intention that embodiments of the claimed subject matter require more features than are explicitly stated in each claim. Rather, as reflected in the appended claims, the invention is presented with fewer features than all of the features of the single disclosed embodiment. Therefore, the appended claims are hereby explicitly incorporated into the detailed description, wherein each claim stands alone as a preferred embodiment of the invention.

[0247] The disclosed embodiments have been described above to enable any person skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be applied to other embodiments without departing from the spirit and scope of this disclosure. Therefore, this disclosure is not limited to the embodiments given herein, but is consistent with the broadest scope of the principles and novel features disclosed in this application.

[0248] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A time synchronization method at the level of a multi-modal redundant computer system, characterized in that, The multi-mode redundant computer system includes multiple independent modules. Each module includes a CPU and a field-programmable gate array (FPGA) electrically connected to the CPU. The FPGA includes a multi-mode phase-locked frequency synthesizer, which includes a handshake synchronization unit, a clock phase-locked synchronization control state machine, a timer comparison output logic unit, and a system time counter. The handshake synchronization unit includes a pulse generation logic subunit; The aforementioned time synchronization method at the multi-modal redundancy computer system level includes: According to the pre-set time window, the CPU of each module sends a synchronization request instruction to the handshake synchronization unit of each module, and the pulse generation logic subunit of each module generates a handshake pulse signal and sends it to other modules. For each module, if the counter in the synchronization unit of the module has both the handshake pulse reception time and its own handshake pulse generation time within the preset synchronization time period, then it is determined that the module has successfully synchronized with the module whose handshake pulse is issued at the handshake pulse reception time, and the module that has successfully synchronized is taken as the target module. For each target module, the handshake pulse reception time and the handshake pulse generation time of the target module are obtained from the counter of the handshake synchronization unit of the target module through the clock phase-locked synchronization control state machine of the target module itself, and the handshake synchronization unit of each target module generates a synchronization pulse. The clock phase difference between each target module is determined by comparing the timer output logic unit of each target module with the handshake pulse reception time and the handshake pulse generation time of the target module itself. The phase adjustment time of the square wave signal is determined by the clock phase difference between each target module and the count of the combined counter. Based on the phase adjustment time of the square wave signal, the phase of the square wave signal used for timing by the target module is adjusted by the timer comparison output logic unit using a synchronization pulse, so that the phase of the square wave signal of all target modules is synchronized. The square wave signal of the local machine is counted starting from 0 using the counters of all target modules.

2. The time synchronization method at the level of a multi-modal redundant computer system according to claim 1, characterized in that, The step of comparing the output logic unit of the timer on the target module itself, determining the clock phase difference of each target module based on the handshake pulse reception time and the handshake pulse generation time of the target module itself, and determining the phase adjustment time of the square wave signal based on the clock phase difference of each target module and the count of the system time counter includes: By comparing the output logic unit of the timer on each target module, the clock phase difference between each target module is determined based on the handshake pulse reception time and the handshake pulse generation time on the target module itself. For the target module with the slowest rising edge determined by the clock phase difference, the moment when the clock phase-locked synchronization control state machine jumps to the start of synchronization is directly taken as the start time of the new cycle of the square wave signal. For other target modules, the output comparison value in the timer comparison output logic unit of the target module is adjusted by combining the count of the system time counter and the clock phase difference. The output comparison value represents the count value in the period of the square wave signal of the target module, and the count value corresponds to the start time of the new period of the square wave signal of the slowest target module.

3. The time synchronization method at the level of a multi-modal redundant computer system according to claim 2, characterized in that, The step of determining the clock phase difference between target modules by comparing the output logic unit of the timer on each target module with the handshake pulse reception time and the handshake pulse generation time on the target module itself includes: For the target module with the slowest rising edge, when the clock phase-locked loop synchronization control state machine jumps to the start synchronization, the synchronization pulse of the target module is used to directly adjust the square wave signal of the target module to zero and directly output the rising edge. At the same time, the timer comparison output logic unit inside the target module counts the square wave signal period from 0. For other target modules, the output comparison value in the timer comparison output logic unit of the target module is adjusted by combining the count of the system time counter and the clock phase difference. This output comparison value represents the count value within the period of the square wave signal of the target module, and the count value corresponds to the start time of a new period of the square wave signal of the slowest target module. This includes: For each other target module, the output comparison value is compared with the count value of the timer comparison output logic unit of the target module through the clock output comparison register of the target module. When the count value of the timer comparison output logic unit is equal to the output comparison value, the square wave signal of the target module is adjusted to the start time of a complete cycle by the synchronization pulse of the target module and the rising edge is started to be output, so that the phase of the square wave signal output by the timer comparison output logic unit of all target modules is synchronized. At the same time, the timer comparison output logic unit in each other target module starts counting the square wave signal cycle from 0.

4. The time synchronization method at the level of a multi-modal redundant computer system according to claim 1, characterized in that, Also includes: At least one frequency of the clock is set by a clock divider counter, which is used by the timer comparison output logic unit to form the output frequency of a square wave signal according to the selected frequency; All modules use the same clock frequency.

5. The time synchronization method at the level of a multi-modal redundant computer system according to claim 3, characterized in that, Also includes: For each target module, the control period interrupt generation logic unit sends the square wave signal output by the timer comparison output logic unit to the system time counter and the system tick timer simultaneously, and notifies the system time counter and the system tick timer of their respective count upper limit values. The timing period of the system time counter or the timing period of the system tick timer is determined by the corresponding count upper limit value. The system time counter and the system tick timer use the same counting frequency to accumulate counts of the square wave signal. The system time counter is used to represent the time of each target module, and the system tick timer is used to provide synchronous periodic interrupt counting and periodic reset counting for the operating system served by each module.

6. The time synchronization method at the level of a multi-modal redundant computer system according to claim 1, characterized in that, The multimode phase-locked frequency synthesizer also includes a reset signal generation logic unit; The aforementioned time synchronization method at the multi-modal redundancy computer system level further includes: When each module is powered on for the first time, the reset signal generation logic unit of each module generates a continuous high-level signal to perform the module's self-test operation. After the self-test operation is completed, each module enters the time synchronization handshake synchronization operation.

7. The time synchronization method at the level of a multi-modal redundant computer system according to claim 6, characterized in that, One of the multiple independent modules is the on-duty unit, while the other modules serve as backup units; the handshake synchronization unit includes a pulse generation logic subunit and a pulse edge detection subunit; the multi-mode phase-locked frequency synthesizer also includes a delay timer. Upon initial power-on of each module, a continuous high-level signal is generated by the reset signal generation logic unit of each module to perform a self-test. After the self-test is completed and all modules are operating normally, each module enters a time synchronization handshake operation, including: If the pulse edge detection subunit of the current machine receives a continuous high-level signal from the standby machine, it determines that the counterclockwise reset of the corresponding standby machine is valid; If the pulse edge detection subunit of the first standby unit receives a continuous high-level signal sent by the current standby unit, and the pulse edge detection subunit of the next standby unit receives a continuous high-level signal sent by the previous standby unit, until all standby units receive a continuous high-level signal sent by the previous standby unit, then the clockwise reset is deemed valid. After both clockwise and counterclockwise resets are completed, the delay timer will start accumulating from 0 to the set value for a delay. When the delay is completed, it indicates that the pre-reset was successful, that the module's self-test operation is over, and that each module is operating normally. The state of the clock phase-locked synchronization control state machine is switched from waiting for reset handshake to waiting for synchronization reset, and each module enters the time synchronization handshake synchronization operation.

8. The time synchronization method at the level of a multi-modal redundant computer system according to claim 7, characterized in that, Also includes: After the handshake synchronization of the module is successful, the state of the clock phase-locked synchronization control state machine will jump to idle, indicating that the synchronization reset is successful. When the output comparison value of the target module is adjusted by adjusting the timer comparison output logic unit within each target module, and the count value of the timer comparison output logic unit is equal to the output comparison value, it indicates that the timer comparison output is successful; the state of the clock phase-locked synchronization control state machine is switched to start synchronization, and a synchronization request command is sent to the synchronization handshake unit at the same time; If each target module completes the rising edge adjustment at the rising edge of the synchronization pulse adjustment square wave signal, the synchronization is successful through the handshake synchronization unit, and the state of the clock phase-locked synchronization control state machine is sequentially switched to synchronized and idle. If one of the target modules times out, it indicates a synchronization error. Each time a synchronization error occurs, the synchronization error monitoring counter increments by 1. If the module experiences intermittent synchronization errors, the timeout error counter in the clock phase-locked synchronization control state machine of the target module is cleared. If the module experiences continuous synchronization errors, when the synchronization error count exceeds the error threshold and another synchronization error occurs, a module switching bypass will be triggered, setting the module as a bypass. Modules set as bypasses will no longer participate in subsequent synchronization handshakes.

9. A time synchronization device at the level of a multi-modal redundant computer system, characterized in that, The multi-mode redundancy computer system comprises multiple independent modules. Each module includes a CPU and a field-programmable gate array (FPGA) electrically connected to the CPU. The FPGA includes a multi-mode phase-locked frequency synthesizer, which includes a handshake synchronization unit, a clock phase-locked synchronization control state machine, a timer comparison output logic unit, and a counter. The handshake synchronization unit includes a pulse generation logic subunit. Wherein: Each module's CPU sends a synchronization request command to the module's local handshake synchronization unit according to a pre-set time window. The pulse generation logic subunit of each module is used to generate handshake pulse signals and send them to other modules; If, within a preset synchronization time period, the counter in the synchronization unit of each module simultaneously has the handshake pulse reception time and its own handshake pulse generation time, then it is determined that the module has successfully synchronized with the handshake pulse issued at the handshake pulse reception time. The clock phase-locked synchronization control state machine of the target module obtains the handshake pulse reception time and the handshake pulse generation time of the target module from the counter of the handshake synchronization unit of the target module itself. Here, the target module refers to the module that has successfully completed the handshake. The handshake synchronization unit of the target module has a pulse generation logic subunit, which is used to generate synchronization pulses; The timer comparison output logic unit of each target module is used to determine the clock phase difference between each target module based on the handshake pulse reception time and the handshake pulse generation time of the target module itself, determine the phase adjustment time of the square wave signal based on the clock phase difference between each target module and the count of the combined counter, and adjust the phase of the square wave signal used for timing by the target module's local clock using the timer comparison output logic unit according to the phase adjustment time of the square wave signal, so that the phase of the square wave signal of all target modules is synchronized. The counter is also used to count the square wave signal of the target module itself, starting from 0, while synchronizing the phase of the square wave signal of all target modules.

10. The time synchronization device at the level of a multi-modal redundant computer system according to claim 9, characterized in that, The timer comparison output logic unit of each target module is specifically used for: The clock phase difference between each target module is determined based on the handshake pulse reception time and the handshake pulse generation time of the target module itself. For the target module with the slowest rising edge determined by the clock phase difference, the moment when the clock phase-locked synchronization control state machine jumps to the start of synchronization is directly taken as the start time of the new cycle of the square wave signal. For other target modules, the output comparison value in the timer comparison output logic unit of the target module is adjusted by combining the count of the system time counter and the clock phase difference. The output comparison value represents the count value in the square wave signal of the target module, and the count value corresponds to the start time of the new cycle of the square wave signal of the slowest target module.

11. The time synchronization device at the level of a multi-modal redundant computer system according to claim 10, characterized in that, Also includes: The timer comparison output logic unit of the target module with the slowest rising edge is used to directly adjust the square wave signal of the target module to zero and directly output the rising edge when the clock phase-locked synchronization control state machine jumps to the start synchronization. At the same time, it counts the square wave signal period from 0. The clock output compare register of each other target module is used to compare the output compare value of the target module with the count value of the timer compare output logic unit of the target module; The timer comparison output logic unit of each other target module is used to adjust the square wave signal of the target module to the start time of a complete cycle and start outputting a rising edge when the count value of the timer comparison output logic unit is equal to the output comparison value, so that the phase of the square wave signal output by the timer comparison output logic unit of all target modules is synchronized; at the same time, the counting of the square wave signal cycle starts from 0.

12. The time synchronization device at the level of a multi-modal redundant computer system according to claim 11, characterized in that, Also includes: The control cycle interrupt generation logic unit of each target module is used to simultaneously send the square wave signal output by the timer comparison output logic unit to the system time counter and the system tick timer, and notify the system time counter and the system tick timer of their respective count upper limit values. The timing period of the system time counter or the timing period of the system tick timer is determined by the corresponding count upper limit value. Both the system time counter and the system tick timer use the same counting frequency to accumulate counts of the square wave signal. The system time counter is used to represent the time of each target module, and the system tick timer is used to provide synchronous periodic interrupt counting and periodic zeroing counting for the operating system served by each module.

13. The time synchronization device at the level of a multi-modal redundant computer system according to claim 9, characterized in that, The multimode phase-locked frequency synthesizer also includes a reset signal generation logic unit; The reset signal generation logic unit of each module is used to generate a continuous high-level signal after each module is powered on for the first time to perform the module's self-test operation until the self-test operation is completed.

14. The time synchronization device at the level of a multi-modal redundant computer system according to claim 13, characterized in that, One of the multiple independent modules is the on-duty unit, and the others serve as backup units; the handshake synchronization unit includes a pulse generation logic subunit and a pulse edge detection subunit; the multi-mode phase-locked frequency synthesizer also includes a delay timer; wherein: The pulse edge detection subunit of the current machine is used to determine whether the counterclockwise reset of the corresponding backup machine is valid when a continuous high-level signal is received from the backup machine. If the pulse edge detection subunit of the first standby machine receives a continuous high-level signal sent by the current machine, and the pulse edge detection subunit of the next standby machine receives a continuous high-level signal sent by the previous standby machine, until all standby machines' pulse edge detection subunits receive a continuous high-level signal sent by the previous standby machine, then the clockwise reset is deemed valid. The delay timer is used to start accumulating from 0 to a set value for a delay after both clockwise and counterclockwise resets are completed. The clock phase-locked synchronization control state machine of each module is used to transition from the state of the clock phase-locked synchronization control state machine to the state of waiting for reset handshake to waiting for synchronization reset.

15. A multi-modal redundancy computer system, characterized in that, It includes multiple independent modules, each module including the handshake device for time synchronization of a multimodal redundant computer system as described in any one of claims 9-14.

16. A rocket, characterized in that, Includes the multi-mode redundant computer system as described in claim 15.

Images