Three-mode redundant computing system based on tsn network and bus arbitration and timing voting method

Abstract

The application discloses a three-mode redundant computing system based on a TSN network and a bus arbitration and timing voting method, and belongs to the technical field of high-reliability computer systems. The application takes a launch vehicle avionics system as a breakthrough point, constructs a three-mode redundant scheme combined with FPGA arbitration and hardware two-out-of-three voting in a strong real-time scene, and realizes flexible cutting of the form through a bus arbitration module, so that the same set of core mechanisms is smoothly extended to wide application scenes such as industrial automation, robots and smart grids.

Description

Technical Field

[0001] This invention relates to the field of high-reliability computer system technology, and in particular to a triple-redundant computing system based on TSN network and a bus arbitration and timing voting method. Background Technology

[0002] Triple Modular Redundancy (TMR) is a classic fault-tolerant computing architecture in the fields of aerospace and industrial safety control. By having three identical functional modules operate in parallel and output through majority voting, it can completely shield the hardware failure of a single module.

[0003] In daily practice, the existing technical solutions have been found to have the following problems: The three computing modules must be strictly clock-synchronized, and the calculation results must be aligned at the same time. Traditional solutions rely on dedicated synchronization buses, hardware phase-locked loops, or custom backplanes, resulting in poor system scalability and difficulty in adapting to distributed sensor layouts and heterogeneous computing node access. Furthermore, the physical voter is the single point of failure in the entire fault-tolerant link; once the voter fails, the system will completely lose its fault tolerance capability.

[0004] Therefore, it is necessary to provide a new technical solution to solve the above problems. Summary of the Invention

[0005] To address the aforementioned technical problems, this application provides a triple-modal redundancy computing system based on a TSN network and a bus arbitration and timing voting method to solve these problems.

[0006] A triple-mode redundancy computing system based on a TSN network includes: a TSN network, three main control modules, a programmable bus arbitration module, and a timing voting module; Each of the main control modules is a computing node, including a TSN network interface, a communication interface, local control logic, an independent timing signal generation circuit, and a hardware timer for authorization timeout detection; The TSN network follows the IEEE 802.1AS and 802.1Qbv protocols and is used to synchronously distribute sensor data to all computing nodes in a multicast manner, and to carry the final instructions output by the authorized nodes. The bus arbitration module is directly connected to the three computing nodes via onboard communication, and is used to receive the calculation results of the three computing nodes every cycle, and can perform majority voting and authorization decisions. The timing voting module is communicatively connected to the three computing nodes, and can directly receive the original timing signals output by the three computing nodes, and can output the timing signal after a single vote in real time through pure hardware majority voting logic.

[0007] Optionally, the timing voting module is a two-out-of-three voting output module.

[0008] Optionally, the computing node can be a homogeneous or heterogeneous computing node.

[0009] Optionally, the bus arbitration module includes a first implementation and a second implementation; When the bus arbitration module adopts the first implementation form, it is implemented using FPGA, with combinational logic majority voting and arbitration delay of less than 1 microsecond. When the bus arbitration module adopts the second implementation form, it is implemented in C++ and runs on a standard industrial PC or embedded controller, with an arbitration cycle ranging from 1 to 100 milliseconds.

[0010] Optionally, the two-out-of-three voting output module is a pure hardware combinational logic with a transmission delay of less than 10 nanoseconds.

[0011] According to another aspect of this application, a bus arbitration and timing voting method is also provided, which utilizes the aforementioned triple-modular redundancy computing system to perform bus arbitration and timing voting, including: The network command is generated through the first path and sent to the execution mechanism; The timing instructions are generated via the second path and sent to the actuator. The process of generating network instructions and sending them to the execution mechanism via the first path includes: S11 and TSN networks are based on global clock synchronization and use gating scheduling to deliver input data frames to all computing nodes simultaneously. S12. Each main control module independently executes the control algorithm to generate calculation results and sends the calculation results to the bus arbitration module. At the same time, each main control module generates timing output based on the calculation results. S13. The bus arbitration module performs arbitration calculations and returns the arbitration decision results to each main control module in the form of an authorization frame. S14. Each main control module detects the authorization frame within the preset timeout window, selects the main control module with a valid authorization frame, and sends the final instruction frame to the actuator through the TSN network. The timing instructions are generated through the second path and sent to the actuator, including: S21. All three main control modules continuously output raw timing signals to the timing voting module every cycle; S22. The timing voting module performs majority voting on the three signals in real time and continuously, and sends the correct timing signal to the actuator based on the voting results.

[0012] Optionally, in the independent execution of the control algorithm by each main control module to generate calculation results, the calculation results include timestamp or period number, node ID, control quantity and CRC check code.

[0013] Optionally, when the timing voting module performs majority voting on the three signals in real time and continuously, it adopts a bit-by-bit or pulse-by-pulse method for majority voting.

[0014] Optionally, each of the three main control modules continuously outputs the original timing signal to the timing voting module every cycle. The original timing signal is a PWM wave, a pulse sequence, or a level command.

[0015] Optionally, generating timing instructions via the second path and sending them to the actuator further includes: S23. The bus arbitration module receives the execution agency's reply and performs a single-cycle decision. If the deviation between the response and the instruction exceeds the threshold, the authorization will be forcibly switched to another healthy node in the next cycle. If the deviation between the response and the instruction is within the threshold range, the correct timing signal will be sent to the execution mechanism through the corresponding node according to the voting result.

[0016] Compared with the prior art, this application has at least the following beneficial effects: 1. This invention can effectively improve the system scalability of triple-modular redundancy in the classic fault-tolerant computing architecture in the fields of aerospace and industrial safety control, and can effectively adapt to distributed sensor layout and heterogeneous computing node access.

[0017] 2. This invention can effectively improve fault tolerance and effectively avoid system failure caused by the failure of the physical voting unit.

[0018] 3. Through the flexible implementation of the bus arbitration module and the standardized design of the timing voting module, this invention can be seamlessly extended to various industrial control fields with stringent requirements for determinism and reliability but different levels of real-time performance, such as industrial automation, rail transit, smart grid, and autonomous driving. Attached Figure Description

[0019] The following sections will describe some specific embodiments of the invention in detail by way of example and not limitation, with reference to the accompanying drawings. The same reference numerals in the drawings denote the same or similar parts or portions. Those skilled in the art should understand that these drawings are not necessarily drawn to scale. In the drawings: Figure 1 This is a diagram illustrating the architecture of the triple redundancy computing system of the present invention, taking the main inertial navigation system as an example. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] like Figure 1 As shown, a triple-modular redundancy computing system based on a TSN network includes: a TSN network, three computing nodes, a programmable bus arbitration module, and a timing voting module.

[0022] Each main control module is a computing node, including a TSN network interface, a communication interface, local control logic, independent timing signal generation circuitry, and a hardware timer for authorization timeout detection. The computing nodes can be homogeneous or heterogeneous. The TSN network interface supports time synchronization, and the communication interface is an on-board high-speed communication interface supporting LVDS, SerDes, or Ethernet. The on-board high-speed communication interface refers to a dedicated hardware communication link within the same circuit board for highly reliable, low-latency, and high-speed data exchange between the three computing nodes and between nodes and local hardware modules. It is the core internal pathway for local synchronization, data exchange, and redundant voting between nodes.

[0023] The TSN network follows the IEEE 802.1AS and 802.1Qbv protocols to synchronously distribute sensor data to all computing nodes via multicast and to carry the final instructions output by the authorized nodes.

[0024] The bus arbitration module is directly connected to the three computing nodes via onboard communication. It receives the calculation results from the three computing nodes every cycle and can perform majority voting and authorization decisions.

[0025] The bus arbitration module includes a first implementation and a second implementation. When the bus arbitration module adopts the first implementation form, it is implemented using FPGA, with combinational logic majority voting and arbitration delay of less than 1 microsecond; When the bus arbitration module adopts the second implementation form, it is implemented in C++ and runs on a standard industrial PC or embedded controller, with an arbitration cycle ranging from 1 to 100 milliseconds.

[0026] The timing voting module communicates with three computing nodes, can directly receive the raw timing signals output by the three computing nodes, and can output the timing signal after a single vote in real time through pure hardware majority voting logic.

[0027] The timing voting module is a two-out-of-three voting output module. This two-out-of-three voting output module is a pure hardware combinational logic module with the following characteristics: Extremely low latency: Pure combinational logic, transmission delay <10ns; High reliability: No software involvement, free from the effects of soft errors such as single-event upsets; Completely independent: It forms a heterogeneous redundancy with the TSN output channel, and the failure of one channel will not affect the other channel.

[0028] Based on the same inventive concept, this invention also provides a bus arbitration and timing voting method, which utilizes the aforementioned triple-modular redundancy computing system for bus arbitration and timing voting, including: The network command is generated through the first path and sent to the execution mechanism; The timing instructions are generated via the second path and sent to the actuator. The process of generating network instructions and sending them to the execution mechanism via the first path includes: S11 and TSN networks are based on global clock synchronization and use gating scheduling to deliver input data frames to all computing nodes simultaneously. S12. Each main control module independently executes the control algorithm to generate calculation results and sends the calculation results to the bus arbitration module. At the same time, each main control module generates timing outputs based on the calculation results.

[0029] The calculation results include timestamps or period numbers, node IDs, control variables, and CRC checksums.

[0030] Each main control module generates timing outputs based on the calculation results, including TSN command frames and timing signals. The TSN command frames are encapsulated as TSN network messages and sent after authorization is obtained; the timing signals are directly output to the timing voting module through independent IO pins.

[0031] S13. The bus arbitration module performs arbitration calculations and returns the arbitration decision results to each master control module in the form of an authorization frame.

[0032] Specifically, including: S131. Receive data and perform CRC check.

[0033] S132. Use the 3-out-of-2 logic for majority voting.

[0034] S134. Determine the authorization strategy based on the voting results.

[0035] The authorization strategy is as follows: when two or three results are consistent, the authorization is given to the majority node; when all three results are inconsistent, the authorization is given to the node that was authorized in the previous period, that is, the authorization node remains unchanged.

[0036] S134, encapsulate the authorization frame and send it to each main control module through the high-speed interconnect channel.

[0037] S14. Each main control module detects the authorization frame within the preset timeout window, selects the main control module with a valid authorization frame, and sends the final instruction frame to the actuator through the TSN network.

[0038] The timing instructions are generated through the second path and sent to the actuator, including: S21. All three main control modules continuously output the original timing signal to the timing voting module every cycle.

[0039] The original timing signal is a PWM wave, a pulse sequence, or a level command.

[0040] S22. The timing voting module performs majority voting on the three signals in real time and continuously, and sends the correct timing signal to the actuator based on the voting results.

[0041] When the timing voting module performs majority voting on the three signals in real time and continuously, it adopts a bit-by-bit or pulse-by-pulse method for majority voting.

[0042] Furthermore, generating timing instructions via the second path and sending them to the actuator also includes: S23. The bus arbitration module receives the execution agency's reply and performs a single-cycle decision. If the deviation between the response and the instruction exceeds the threshold, the authorization will be forcibly switched to another healthy node in the next cycle. If the deviation between the response and the instruction is within the threshold range, the correct timing signal will be sent to the execution mechanism through the corresponding node according to the voting result.

[0043] This solution has at least the following innovative features: Innovation Point 1: A two-level interconnect architecture combining TSN synchronization and on-board direct interconnect. This architecture combines the wide-area distributed synchronization capability of TSN with the low-latency advantage of on-board high-speed interconnect, achieving nanosecond-level input synchronization while ensuring extremely low latency in the arbitration path. This interconnect architecture is independent of the bus arbitration module implementation form; the FPGA solution uses the LVDS / Serdes physical layer, while the C++ solution can use shared memory or UDP multicast, with a completely unified upper-layer state machine.

[0044] Innovation Point 2: Complete Elimination of Single Point of Failure in the Voting Unit. The bus arbitration module issues bus authorization, and the master node retains a timeout default sending mechanism. When the bus arbitration module (whether FPGA or C++ module) completely fails, the default node automatically takes over the sending of TSN commands within the predetermined timeout window, ensuring uninterrupted and unspecified system network output, fundamentally eliminating the single point of vulnerability of traditional hardware voting units.

[0045] Innovation Point 3: Single-path adaptability of the actuator. Through the bus arbitration module, only a single node is authorized to transmit data per cycle, ensuring that only one command stream is always present on the TSN network (switch redundancy). The actuator only needs a standard single TSN interface to obtain tri-mode redundancy fault shielding capability, without any hardware redundancy modifications, significantly reducing the cost of aerospace model upgrades and industrial system deployments.

[0046] Innovation Point 4: Hardware 3-out-of-2 Voting Output Channel (Independent Hardwired Redundancy). For critical loads such as attitude control engines and pyrotechnic devices that must be driven by pure hardware timing, this invention adds an independent timing voting module. Furthermore, this timing voting module employs a hardware 3-out-of-2 voting approach, offering the following advantages: The timing voting module and the TSN output channel are heterogeneously redundant: the network channel relies on arbitration and software, while the hardline channel relies on pure hardware voting, and the failure modes of the two do not overlap. The timing voting module features ultra-low latency: nanosecond-level transmission, meeting the most stringent timing requirements; The timing voting module has extremely high availability: if any two of the three inputs are normal, the output is correct; the module itself can be built with discrete components, with no single point of failure. The timing voting module is completely transparent: it is just ordinary IO output to the compute node, requiring no additional software overhead.

[0047] Innovation Point 5: Cyclic Fast Fault Switching (TSN Channel). Employing a hard-decision strategy of "switching upon error," the time from actuator error feedback to bus arbitration authorization switching requires only one control cycle (1 cycle for the FPGA solution, configurable to 1-2 cycles for the C++ solution). The strategy is simple, the behavior is deterministic, and it easily passes high-security level certifications.

[0048] Innovation Point 6: Unified Architecture Design and Cross-Domain Scalability. This invention decouples the core mechanisms of triple redundancy (TSN synchronization + arbitration authorization + default takeover + hardware voting) from the specific implementation technologies. Specifically, it includes: In high real-time scenarios, the combination of FPGA hard logic arbitration and FPGA hardware voting enables 1µs arbitration and ns-level voting, which is suitable for launch vehicle control and other applications.

[0049] In soft real-time scenarios, C++ software arbitration combined with discrete device hardware voting (or a simplified FPGA version) is suitable for industrial robots, smart substations, rail transit signaling systems, etc.

[0050] It can support heterogeneous computing: the three nodes can use different processor architectures, and the bus arbitration module and the timing voting module only compare the calculation results / level states, without relying on instruction set consistency.

[0051] A single architecture with dual redundant outputs and multiple real-time configurations covers the entire spectrum of applications from aerospace to industry.

[0052] Example 1

[0053] This embodiment uses a triple-modular redundancy computing system based on a TSN network, which is applied to the flight control computer of the launch vehicle's active phase. It adopts a scheme that combines FPGA hard real-time and hardware three-out-of-two voting.

[0054] In this embodiment, a certain type of liquid-fueled launch vehicle uses the triple-redundant computing system of this scheme as its flight control computer. It comprises three main control modules, all of which are computing nodes based on domestically produced military-grade processors with a control cycle of 10ms. The bus arbitration module uses a domestically produced aerospace-grade FPGA (Fudan Microelectronics JFM7K325T) with an on-board LVDS rate of 2.0Gbps. The timing voting module is a hardware 3-out-of-2 voting module integrated within the same FPGA, but using an independent power domain and an independent I / O bank to ensure electrical isolation from the arbitration logic.

[0055] Each cycle, the three computing nodes output PWM steering instructions to the timing voting module and output the calculation results to the bus arbitration module.

[0056] Under fault injection conditions, computing node B experiences a single-event flip, resulting in abnormal PWM output. The timing voting module shields the B signal in real time, outputting a PWM waveform that is largely consistent between A and C. The servo mechanism operates normally without any disturbance.

[0057] The bus arbitration module simultaneously completes the majority vote and authorizes compute node A. Computation node A issues a bus command in the TSN time slot, and the response is normal.

[0058] In the FPGA arbitration logic power-off simulation state, computing node A automatically takes over the TSN transmission count after a 2.5us timeout; the timing voting module still operates independently with three PWM inputs, and the output is unaffected.

[0059] In this scheme, the TSN network command and the hard-wired PWM voting output serve as backups for each other, and a single channel failure will not affect rocket flight.

[0060] Example 2

[0061] This embodiment uses a triple-modular redundancy computing system based on a TSN network as a safety controller for industrial robots, employing a combination of C++ soft real-time and discrete hardware voting.

[0062] A collaborative robot safety controller requires a response latency of ≤10ms and a hardwired emergency stop signal. This invention employs a C++ arbitration scheme and an independent hardware 3-out-of-2 voting circuit (timing voting module). The hardware 3-out-of-2 voting circuit consists of a five-transistor voter, soldered to a safety relay module. The three main control modules are all computing nodes, all using Infineon TC397, interconnected via a TSN backplane; the bus arbitration module runs on an independent safety monitoring PC, receiving calculation results via UDP multicast, and issuing authorization after a software majority vote.

[0063] Each cycle, the three computing nodes output an emergency stop level signal to the five-tube voter, and the voter outputs a single emergency stop signal to the robot driver.

[0064] During testing, a software malfunction in compute node C caused an emergency power outage with a constant high voltage. The five-tube voter automatically selected a low-level signal from A or B, and the robot safely stopped. The bus arbitration module will switch the authorization to compute node A in the next cycle.

[0065] This solution complies with ISO 13849 PL d level and IEC 61508 SIL 2 requirements.

[0066] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments according to this application. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0067] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in sequences other than those illustrated or described herein.

[0068] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A triple-modular redundancy computing system based on a TSN network, characterized in that, include: One TSN network, three main control modules, one programmable bus arbitration module, and one timing voting module; Each of the main control modules is a computing node, including a TSN network interface, a communication interface, local control logic, an independent timing signal generation circuit, and a hardware timer for authorization timeout detection; The TSN network follows the IEEE 802.1AS and 802.1Qbv protocols and is used to synchronously distribute sensor data to all computing nodes in a multicast manner, and to carry the final instructions output by the authorized nodes. The bus arbitration module is directly connected to the three computing nodes via onboard communication, and is used to receive the calculation results of the three computing nodes every cycle, and can perform majority voting and authorization decisions. The timing voting module is communicatively connected to the three computing nodes, and can directly receive the original timing signals output by the three computing nodes, and can output the timing signal after a single vote in real time through pure hardware majority voting logic.

2. The triple-modular redundancy computing system as described in claim 1, characterized in that, The timing voting module is a two-out-of-three voting output module.

3. The triple-modular redundancy computing system as described in claim 2, characterized in that, The computing nodes can be homogeneous or heterogeneous computing nodes.

4. The triple-modular redundancy computing system as described in claim 3, characterized in that, The bus arbitration module includes a first implementation and a second implementation. When the bus arbitration module adopts the first implementation form, it is implemented using FPGA, with combinational logic majority voting and arbitration delay of less than 1 microsecond. When the bus arbitration module adopts the second implementation form, it is implemented in C++ and runs on a standard industrial PC or embedded controller, with an arbitration cycle ranging from 1 to 100 milliseconds.

5. The triple-modular redundancy computing system as described in claim 4, characterized in that, The two-out-of-three voting output module is a pure hardware combinational logic with a transmission delay of less than 10 nanoseconds.

6. A bus arbitration and timing voting method, characterized in that, Performing bus arbitration and timing voting using the triple-modular redundancy computing system according to any one of claims 1-5 includes: The network command is generated through the first path and sent to the execution mechanism; The timing instructions are generated via the second path and sent to the actuator. The process of generating network instructions and sending them to the execution mechanism via the first path includes: S11 and TSN networks are based on global clock synchronization and use gating scheduling to deliver input data frames to all computing nodes simultaneously. S12. Each main control module independently executes the control algorithm to generate calculation results and sends the calculation results to the bus arbitration module. At the same time, each main control module generates timing output based on the calculation results. S13. The bus arbitration module performs arbitration calculations and returns the arbitration decision results to each main control module in the form of an authorization frame. S14. Each main control module detects the authorization frame within the preset timeout window, selects the main control module with a valid authorization frame, and sends the final instruction frame to the actuator through the TSN network. The timing instructions are generated through the second path and sent to the actuator, including: S21. All three main control modules continuously output raw timing signals to the timing voting module every cycle; S22. The timing voting module performs majority voting on the three signals in real time and continuously, and sends the correct timing signal to the actuator based on the voting results.

7. The bus arbitration and timing voting method as described in claim 6, characterized in that, In the calculation results generated by the independent execution of the control algorithm by each main control module, the calculation results include timestamp or period number, node ID, control quantity and CRC check code.

8. The bus arbitration and timing voting method as described in claim 6, characterized in that, When the timing voting module performs majority voting on three signals in real time and continuously, it uses bitwise or pulse-wise methods for majority voting.

9. The bus arbitration and timing voting method as described in claim 6, characterized in that, Each of the three main control modules continuously outputs the original timing signal to the timing voting module every cycle. The original timing signal is a PWM wave, a pulse sequence, or a level command.

10. The bus arbitration and timing voting method as described in claim 6, characterized in that, Generating timing instructions via the second path and sending them to the actuator also includes: S23. The bus arbitration module receives the execution agency's reply and performs a single-cycle decision. If the deviation between the response and the instruction exceeds the threshold, the authorization will be forcibly switched to another healthy node in the next cycle. If the deviation between the response and the instruction is within the threshold range, the correct timing signal will be sent to the execution mechanism through the corresponding node according to the voting result.

Images