A method for double PLC redundancy switching and abnormal state monitoring of a rocket ground control system

Abstract

The present application relates to a kind of for rocket ground control system double PLC redundancy switching and abnormal state monitoring method, belong to aerospace equipment field.The method mainly includes the following steps: S1 health assessment, it includes: collection main PLC and the operating and communication parameters of spare PLC and carry out multidimensional weighting calculation;S2 presynchronization, it includes: when main PLC health degree drops to early warning state, spare PLC automatically completes data and timing presynchronization;S3 switching vote, it includes: when any two of multiple trigger conditions are satisfied simultaneously, switching permission instruction is generated;S4 non-disturbance switching execution, it includes: latching output and clock synchronization;S5 anti-shock locking prevents frequent back-off;S6 smooth back-off.The present application is non-disturbance, monitoring full coverage, fault can be self-healing, applicable to rocket launch site high reliable control scene.

Description

Technical Field

[0001] This invention relates to the field of aerospace equipment, and in particular to a method for dual PLC redundancy intelligent switching and end-to-end abnormal state monitoring of a rocket ground gas supply and power measurement and control system. Background Technology

[0002] The liquid rocket ground gas supply and propulsion control system is a core support system before rocket launch, requiring high real-time performance, high reliability, and high safety. It commonly employs dual PLC redundant control, dual redundant industrial switches, and fiber optic + network cable dual-link communication. However, existing technologies have the following shortcomings: 1) PLC redundancy switching relies solely on a single fault or communication interruption signal, which can easily lead to incorrect switching, missed switching, and repeated switching. 2) The switching process lacks output maintenance and timing synchronization, which can easily cause valve vibration, pressure fluctuation, and command interruption; 3) After a fault occurs, it is impossible to quickly locate, trace, or guarantee the continuous reliability of the launch mission. Existing related patents have not formed an integrated control scheme that combines intelligent switching, full-link status monitoring, microsecond-level timing synchronization, and network fault self-healing, making it difficult to meet the stringent safety and reliability requirements of aerospace launch scenarios. Summary of the Invention

[0003] The purpose of this invention is to provide a method for dual PLC redundancy switching and abnormal state monitoring in rocket ground control systems, so as to solve one or all of the technical problems existing in the prior art.

[0004] To achieve the above objectives, the present invention provides the following solution: This invention provides a method for dual PLC redundancy switching and abnormal state monitoring in a rocket ground control system, comprising the following steps: S1. Health assessment: The main PLC and the backup PLC collect their respective operating status parameters and communication status parameters with each other in real time. The collected parameters are weighted and calculated in multiple dimensions to generate a comprehensive health score. Based on the comprehensive health score, the health status of each PLC controller is divided into normal status, warning status, fault status and downtime status. S2. Pre-synchronization: When the health status of the main PLC drops from the normal state to the warning state, the standby PLC automatically completes the pre-synchronization of data, timing and output status with the main PLC, so that the standby PLC enters the hot standby ready state. S3. Switching vote: Real-time monitoring of multiple switching trigger conditions. When any two or more of the multiple switching trigger conditions are met simultaneously, a switching permission instruction is generated. The switching trigger conditions include at least: the health status of the main PLC reaches a fault state or a downtime state; the duration of the communication interruption between the main PLC and the system exceeds a preset threshold; the upper-level monitoring server determines that the main PLC is operating abnormally; and key process parameters undergo sudden changes. S4. Uninterrupted switching execution: In response to the switching permission command, all output signals are immediately latched and held at the hardware level. The backup PLC is switched to the new master PLC under the control of the global clock synchronization signal and takes over all control functions, so that the response time of the switching process is not greater than the preset time threshold. S5. Anti-vibration lock: After the smooth switching execution step is completed, a lock time window of a preset length is started, during which any switchback operation is prohibited. S6. Smooth Switchback: When the health status of the original master PLC returns to normal and remains stable for more than the preset stable time, it is triggered by an external confirmation command to perform a seamless switchback from the current master PLC to the original master PLC.

[0005] According to an embodiment of the present invention, in step S1: The operating status parameters include CPU utilization, memory usage, program scan cycle, and scan cycle jitter value. The communication status parameters include communication latency, packet loss rate, and packet error rate with the redundant switch. The parameters on which the multi-dimensional weighted calculation is based also include the response correctness of digital input / output channels and analog input / output channels, power supply voltage values, module temperature values, and fault codes. The comprehensive health score uses a dynamic weighting coefficient, which is adaptively adjusted according to the current operating conditions of the rocket's ground gas supply and power control system.

[0006] According to an embodiment of the present invention, in step S2: the backup PLC copies all variable data, output mapping register status, timing status mirror and instruction queue of the main PLC, and under the control of the global clock synchronization signal, aligns the instruction execution cycle of the backup PLC with the instruction execution cycle of the main PLC to a preset synchronization accuracy range.

[0007] According to an embodiment of the present invention, in step S3, the multiple switching trigger conditions include the following four items: Y1. The overall health score of the main PLC is lower than the preset health fault threshold. Y2. The duration of the communication link interruption between the main PLC and the redundant switch or between the main PLC and the upper-level monitoring server exceeds the preset communication timeout threshold. Y3. The upper-level monitoring server determines that the main PLC has a logic operation abnormality or a control command output abnormality by integrating and analyzing the main PLC's operating status data, network status data, and field sensor feedback data. Y4. The rate of change of process parameters reported by the field pressure sensor, temperature sensor or flow sensor exceeds the preset rate of change threshold, and the change does not match the current control command.

[0008] According to one embodiment of the present invention, in step S3, any two of the conditions Y1-Y4 are triggered to generate the switching permission instruction.

[0009] According to an embodiment of the present invention, in step S4: the hardware-level latching and holding of the output signal is achieved by hardware write protection of all output registers; the global clock synchronization signal is provided by a PTP precise time protocol synchronization unit or an IRIG-B time synchronization unit, and the global clock synchronization signal enables the main PLC, the backup PLC, the redundant switch, the upper-level monitoring server and the client to have a unified microsecond-level time reference; the response time of the switching process is no more than 20 milliseconds.

[0010] According to an embodiment of the present invention, in step S6: before the non-disruptive back-cut execution, the current main PLC and the original main PLC that has recovered to normal complete the pre-synchronization of data, timing and output status, and complete the output latching and holding during the back-cut process under the control of the global clock synchronization signal, so that the back-cut process does not cause disturbance to the field actuator.

[0011] According to one embodiment of the present invention, the method further includes step S7, full-link abnormal state monitoring: real-time abnormal monitoring of multiple links in the entire control link, the links including optical fiber communication links, Ethernet communication links, redundant switch ports, and data frame transmission processes; the monitoring parameters of the optical fiber communication links include optical power value, optical attenuation value, link break status, and bit error rate; the monitoring parameters of the Ethernet communication links include link connectivity status, latency value, and jitter value; the monitoring parameters of the redundant switch ports include port status, bandwidth utilization, frame error count, and device temperature; the monitoring parameters of the data frame transmission process include packet loss rate, out-of-order count, retransmission count, and invalid frame count; the abnormal states are classified into link abnormality level, device abnormality level, and system abnormality level according to their severity, and different levels correspond to different processing strategies.

[0012] According to one embodiment of the present invention, the method further includes step S8, network self-healing and fault isolation: when a single communication link is detected as abnormal in step S7, data transmission is automatically switched to a redundant communication link; when a single switch port is detected as abnormal, the data stream is automatically shifted to a backup switch port; when a network broadcast storm is detected, a rate limiting policy is automatically activated and abnormal network nodes are isolated; when an invalid or abnormal control command frame is detected, verification retransmission or discard processing is automatically performed; when a local network partition is detected as abnormal, the partition is isolated to prevent the fault from spreading to the global network.

[0013] According to one embodiment of the present invention, the system further includes step S9, multi-source data fusion early warning and black box recording: the upper-level monitoring server integrates the status data of the main PLC and the backup PLC, the full-link abnormal status monitoring data, and the on-site gas supply and distribution process parameters to establish a multi-source correlation early warning model, thereby realizing trend early warning before the occurrence of a fault; the on-site gas supply and distribution process parameters include pressure values, temperature values, and flow rates; the system records and stores in real time switching event records with global clock timestamps, abnormal event records, fault code records, link status records, instruction execution sequence records, valve action timestamp records, and process parameter curve records, which are used for fault tracing and launch mission zeroing analysis.

[0014] Beneficial effects This invention has at least one of the following technical effects: Firstly, this solution establishes a multi-dimensional comprehensive health assessment mechanism through S1 health assessment, effectively avoiding the problems of erroneous switching, missed switching, and repeated switching caused by traditional solutions that rely solely on a single fault signal as the switching criterion. Secondly, the S2 pre-synchronization mechanism ensures that the backup PLC is ready for hot standby in terms of data, timing, and output status before switching, solving the problem of valve jitter and pressure fluctuation caused by the lack of output synchronization with timing during traditional switching processes. Thirdly, the S3 switching voting logic, which requires any two of the multiple trigger conditions to be met simultaneously for switching to be allowed, and the S5 anti-oscillation locking mechanism, completely eliminate erroneous switching and frequent back-switching oscillations caused by instantaneous interference, ensuring the stability of the gas supply circuit pressure and the safe operation of the actuator.

[0015] Secondly, this solution expands the monitoring scope from the PLC itself to the fiber optic communication link, Ethernet communication link, redundant industrial switch ports, and data frame transmission process through S7 full-link abnormal status monitoring. This solves the problem of safety blind spots caused by traditional solutions that only monitor PLC failures and ignore transmission link abnormalities. Through the S8 network self-healing and fault isolation mechanism, automatic switching of single-link failures, port drifting, network storm suppression, and partition isolation are achieved. This allows network performance degradation to be automatically repaired before it affects system operation, greatly improving the system's continuous operation capability and anti-interference capability under communication link degradation conditions.

[0016] Thirdly, this invention uses the PTP / IRIG-B global clock synchronization unit to provide a unified microsecond-level time base for the main PLC, backup PLC, redundant industrial switches, upper-level monitoring server, and client, solving the problem of timestamp misalignment between devices caused by the lack of a unified time base in traditional solutions. This ensures precise timing alignment of switching times, instruction execution, and data recording. Through S9 multi-source data fusion early warning and black box recording, a correlation early warning model is established by integrating PLC status, network status, and gas supply and distribution process parameters. This enables trend early warning before faults occur and stores switching events, abnormal information, instruction sequences, and process curves with global clock timestamps. This solves the problem of not being able to quickly locate, trace, and perform zero-based analysis after a fault occurs, providing complete post-launch analysis data support for launch missions. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a diagram of the overall architecture of the rocket's ground-based gas supply and power control system. Figure 2 Block diagram of a dual PLC health assessment model; Figure 3 Flowchart for intelligent, seamless switching between dual PLCs; Figure 4 A flowchart for end-to-end anomaly monitoring and self-healing; Figure 5 Block diagram for maintaining timing synchronization and output disturbance-free operation. Detailed Implementation

[0019] The features and exemplary embodiments of various aspects of the present invention will now be described in detail. To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only configured to explain the present invention and to exemplify the principles of the present invention, and are not configured to limit the present invention. In addition, the structural components in the drawings are not necessarily drawn to scale. For example, the dimensions of some structural components or regions in the drawings may be enlarged for other structural components or regions to aid in the understanding of the embodiments of the present invention.

[0020] The directional terms used in the following description refer to the directions shown in the figures and are not intended to limit the specific structure of the embodiments of the present invention. In the description of the present invention, it should be noted that, unless otherwise stated, the terms "installation," "connection," and "joining" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a direct connection or an indirect connection through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms in the present invention according to the specific circumstances.

[0021] Furthermore, the terms "comprising," "including," "having," or any other variations thereof are intended to cover non-exclusive inclusion, such that a structure or component that includes a list of elements includes not only those elements but also other structural elements that are not expressly listed or inherent to the structure or component. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of other identical elements in the article or apparatus that includes the element.

[0022] Spatial relation terms such as "below," "under," "under," "low," "above," "on," and "high" are used for descriptive convenience to explain the positioning of one element relative to a second element, indicating that these terms are intended to cover different orientations of the device, in addition to those different from those shown in the figure. Furthermore, phrases such as "one element on / below another element" can indicate that two elements are in direct contact, or that there are other elements between the two elements. In addition, terms such as "first" and "second" are also used to describe individual elements, areas, parts, etc., without specifically indicating order or sequence, and should not be considered restrictive. Similar terms are used throughout the description to represent similar elements.

[0023] It will be apparent to those skilled in the art that the present invention can be practiced without requiring some of these specific details. The following description of embodiments is merely intended to provide a better understanding of the invention by illustrating examples of the invention.

[0024] In the following embodiments, there may be descriptions such as "this device". Those skilled in the art should understand that "this device" refers to the device provided by the present invention for a method of dual PLC redundancy switching and abnormal state monitoring of rocket ground control system.

[0025] Combined with appendix Figure 1-5 As shown, where Figure 1 This is an overall architecture diagram for the rocket's ground-based gas supply and power control system. Figure 2 This is a block diagram of a dual PLC health assessment model. Figure 3 This is a flowchart of the intelligent, seamless switching process between dual PLCs. Figure 4 This is a flowchart of end-to-end anomaly monitoring and self-healing. Figure 5 Block diagram for maintaining timing synchronization and output disturbance-free operation.

[0026] An apparatus for implementing a dual-PLC redundancy intelligent switching and end-to-end abnormal state monitoring method for a rocket ground gas supply and power measurement and control system comprises the following components: The system consists of a main programmable logic controller (PLC) and a backup programmable logic controller (PLC), both using the same high-performance CPU module for dual redundancy hot standby. Redundant industrial switches A and B form a dual-redundant industrial switching network. Communication media utilizes both fiber optic and Ethernet links for dual-media redundant communication. The monitoring server is an industrial-grade computer running monitoring and diagnostic software for data processing, storage, diagnosis, and early warning. Clients connect to both switches for dual-source redundant access, used for operation, display, and status monitoring. Field actuators include pressure sensors, temperature sensors, flow sensors, regulating valves, proportional valves, solenoid valves, and safety circuits. The global clock synchronization unit uses either the PTP precise time protocol or the IRIG-B time synchronization protocol to achieve a unified time base across the entire system.

[0027] A method for dual PLC redundancy switching and abnormal state monitoring in rocket ground control systems includes the following steps: S1. Health assessment: The main PLC and the backup PLC collect their respective operating status parameters and communication status parameters with each other in real time. The collected parameters are weighted and calculated in multiple dimensions to generate a comprehensive health score. Based on the comprehensive health score, the health status of each PLC controller is divided into normal status, warning status, fault status and downtime status. S2. Pre-synchronization: When the health status of the main PLC drops from the normal state to the warning state, the standby PLC automatically completes the pre-synchronization of data, timing and output status with the main PLC, so that the standby PLC enters the hot standby ready state. S3. Switching vote: Real-time monitoring of multiple switching trigger conditions. When any two or more of the multiple switching trigger conditions are met at the same time, a switching permission instruction is generated. The switching trigger conditions include at least one of the following: the health status of the main PLC reaches a fault state or a downtime state; the duration of the communication interruption between the main PLC and the system exceeds a preset threshold; the upper-level monitoring server determines that the main PLC is operating abnormally; and key process parameters undergo sudden changes. S4. Uninterrupted switching execution: In response to the switching permission command, all output signals are immediately latched and held at the hardware level. The backup PLC is switched to the new master PLC under the control of the global clock synchronization signal and takes over all control functions, so that the response time of the switching process is not greater than the preset time threshold. S5. Anti-vibration lock: After the smooth switching execution step is completed, a lock time window of a preset length is started, during which any switchback operation is prohibited. S6. Smooth Switchback: When the health status of the original master PLC returns to normal and remains stable for more than the preset stable time, it is triggered by an external confirmation command to perform a seamless switchback from the current master PLC to the original master PLC. S8. Network self-healing and fault isolation: When a single communication link is detected as abnormal in step S7, data transmission is automatically switched to a redundant communication link; when a single switch port is detected as abnormal, the data stream is automatically shifted to a backup switch port; when a network broadcast storm is detected, a rate limiting policy is automatically activated and abnormal network nodes are isolated; when an invalid or abnormal control command frame is detected, verification retransmission or discard processing is automatically performed; when a local network partition is detected as abnormal, the partition is isolated to prevent the fault from spreading to the global network. S9. Multi-source data fusion early warning and black box recording: The upper-level monitoring server integrates the status data of the main PLC and the backup PLC, the full-link abnormal status monitoring data, and the on-site gas supply and distribution process parameters to establish a multi-source correlation early warning model, realizing trend early warning before the occurrence of faults; the on-site gas supply and distribution process parameters include pressure values, temperature values, and flow rates; the system records and stores in real time switching event records with global clock timestamps, abnormal event records, fault code records, link status records, instruction execution sequence records, valve action timestamp records, and process parameter curve records, which are used for fault tracing and launch mission zeroing analysis.

[0028] In some embodiments, the main PLC and the backup PLC are respectively connected to two redundant industrial switches, the redundant industrial switches are interconnected, the monitoring server and the client are simultaneously connected to the dual redundant industrial switches, and the field devices are connected to the control system through the fieldbus.

[0029] In this embodiment, the main PLC and the standby PLC collect their respective operating status parameters in real time, and the operating status parameters include: CPU utilization: refers to the busy / idle status of the PLC controller's central processing unit per unit of time, expressed as a percentage, reflecting the current computing load of the controller; Memory utilization rate: refers to the proportion of the PLC controller's used memory space to the total memory space, expressed as a percentage, reflecting the controller's storage resource usage; Program scan cycle: refers to the time required for the PLC controller to complete one complete program cycle execution, reflecting the controller's real-time response capability; Scan cycle jitter: refers to the time difference between two adjacent program scan cycles, in milliseconds, reflecting the stability of the controller operation.

[0030] The main PLC and the backup PLC collect each other's communication status parameters in real time, as well as their communication status parameters with the redundant industrial switches. The communication status parameters include: Communication latency: refers to the time it takes for a data frame to be sent from one device to be correctly received by another device, measured in milliseconds; Packet loss rate: refers to the proportion of data packets lost per unit of time to the total number of data packets that should be received, expressed as a percentage; Error rate: refers to the proportion of erroneous data packets received per unit of time to the total number of received data packets, expressed as a percentage; In some embodiments, the parameters upon which the multi-dimensional weighted calculation is based further include: The correctness of the response of digital input / output channels refers to whether the digital input channels of the PLC controller correctly acquire external switch signals and whether the digital output channels correctly output control signals, which is obtained through periodic back-read verification.

[0031] The correctness of the response of analog input and output channels refers to whether the analog input channels of the PLC controller correctly acquire external continuous signals and whether the analog output channels correctly output continuous control signals, which is obtained through periodic back-read verification.

[0032] Power supply voltage value: refers to the real-time voltage value of the power supply to the PLC controller, in volts.

[0033] Module temperature value: refers to the real-time temperature value of the CPU module, power supply module and IO module of the PLC controller, in degrees Celsius.

[0034] Fault code: refers to the fault code generated by the PLC controller's self-diagnosis, which indicates the specific fault type and location.

[0035] In the above embodiments, the system performs multi-dimensional weighted calculations on the above parameters to obtain a comprehensive health score. In this embodiment, the weight allocation for each dimension is as follows: The PLC controller's physical status accounts for 40% of the total weight. This includes CPU utilization, memory usage, program scan cycle and jitter value, power supply voltage, module temperature, and fault codes. The PLC controller's communication status accounts for 30% of the total weight, including communication latency, packet loss rate, packet error rate, network optical power value, and link connectivity. The I / O channel status accounts for 20% of the total weight, including the correctness of response of digital and analog input / output channels. The environmental and power supply status accounts for 10% of the total weight. The scores of the above four dimensions are multiplied by their corresponding weight coefficients and then summed to obtain the comprehensive health score, with a maximum score of 100.

[0036] In the above embodiments, the scoring of the PLC controller body can be: The score is 100 when the CPU utilization is below 70%, linearly decreasing to 60 between 70% and 85%, and 0 when it is above 85%. When memory usage is below 75%, the score is 100 points; between 75% and 90%, it decreases linearly to 60 points; and above 90%, it is 0 points. When the program scan cycle jitter value is less than 1 millisecond, the score for this item is 100 points; it decreases linearly to 60 points between 1 and 5 milliseconds; and it is 0 points when it is greater than 5 milliseconds. When the power supply voltage deviates from the rated value within ±5%, the score for this item is 100 points; between ±5% and ±10%, the score decreases linearly to 60 points; and when it exceeds ±10%, the score is 0 points. The score for this item is 100 points when the module temperature is below 60℃, linearly decreases to 60 points between 60-75℃, and is 0 points when the temperature is above 75℃. The score for this item is 0 when a fault code is present and 100 when there is no fault code. The comprehensive score of the PLC controller's status is obtained by arithmetically averaging the scores of the above items.

[0037] In the above embodiments, the PLC controller communication status can be scored as follows: The score for this item is 100 points when the communication latency is less than 2 milliseconds, it decreases linearly to 60 points between 2 and 5 milliseconds, and is 0 points when it is greater than 5 milliseconds; When the packet loss rate is less than 0.1%, the score for this item is 100 points; between 0.1% and 1%, it decreases linearly to 60 points; and when it is greater than 1%, it is 0 points. When the error rate is less than 0.01%, the score for this item is 100 points; between 0.01% and 0.1%, it decreases linearly to 60 points; and when it is greater than 0.1%, it is 0 points. When the network optical power value is higher than -15dBm, the score for this item is 100 points; it decreases linearly to 60 points between -20dBm and -15dBm; and it is 0 points when it is lower than -20dBm. When the link connectivity is normal, this item scores 100 points; when it is abnormal, it scores 0 points. The comprehensive score of the PLC controller's communication status is obtained by arithmetically averaging the scores of the above items.

[0038] In the above embodiment, the I / O channel status can be scored as follows: when all channels respond correctly, the score is 100 points; when a single channel is faulty, 10 points are deducted; and when the number of faulty channels exceeds 4, the score is 0 points.

[0039] In some embodiments, the environmental and power conditions include power supply voltage stability and overall module temperature level.

[0040] In some embodiments, the above weighting can be adaptively adjusted according to different operating conditions of the rocket ground gas supply and power control system. For example, during the rocket engine ignition preparation stage, the real-time response of the I / O channel status is directly related to the accurate execution of the ignition timing. At this time, the weight of the I / O channel status can be increased to 40%, and the weight of the communication status can be reduced to 20%. During the long-term refueling standby stage, the system is in a waiting state for a long time, and the continuous stability of the communication link is more critical. At this time, the weight of the communication status can be increased to 35%, and the weight of the CPU load can be reduced to 25%. The adjustment of the weighting coefficients is updated by the upper-level monitoring server according to the current process stage, so that the health assessment can accurately reflect the actual operating risks under different operating conditions.

[0041] In the above embodiment, the system divides the health status of each PLC controller into four levels based on the comprehensive health score: normal status, warning status, fault status and downtime status. The switching process is only allowed to start when the health status enters the fault status.

[0042] In some embodiments, when the health status of the main PLC drops from the normal state to the warning range, the standby PLC automatically completes pre-synchronization with the main PLC, enabling the standby PLC to enter a hot standby ready state. The pre-synchronization specifically includes the following: 1. Variable data copying: The standby PLC copies all variable data from the main PLC. The variable data includes the current values ​​of all global variables, local variables, reserved variables, and retained variables in the main PLC program. By copying the variable data, it is ensured that the standby PLC has a completely consistent operating basis with the main PLC after taking over control. 2. Output mapping register state copying: The standby PLC copies the output mapping register state of the main PLC. The output mapping register is a memory area in the PLC controller used to temporarily store output signals. Its state directly determines the current action position of the external actuator. By copying the output mapping register state, it is ensured that the standby PLC can immediately drive the external actuator with an output value that is completely consistent with the main PLC after taking over control, thereby achieving output without disturbance. 3. Timing State Mirroring: The standby PLC copies the timing state mirror of the master PLC. The timing state mirror includes the current values ​​of each timer and counter in the master PLC and the current state of each timing logic step. By copying the timing state mirror, it is ensured that the standby PLC can continue execution from the current timing position of the master PLC after taking over control, instead of starting the program from the beginning, thereby achieving no timing disturbance. 4. Instruction queue consistency alignment: The standby PLC replicates the instruction queue of the master PLC. The instruction queue includes the sequence of control instructions issued by the master PLC but not yet executed. By replicating the instruction queue, it is ensured that the standby PLC will not miss or repeat control instructions after taking over control. 5. Instruction execution cycle alignment: Under the control of the global clock synchronization signal, the standby PLC aligns its own instruction execution cycle with that of the main PLC to a preset synchronization accuracy range. Specifically, the standby PLC adjusts its program scan start time according to the global clock synchronization signal to keep it consistent with the program scan start time of the main PLC, thereby achieving synchronous operation of the instruction execution pipelines of the two PLC controllers.

[0043] In some embodiments, the multiple switching trigger conditions include the following four items: Y1. The overall health score of the main PLC is lower than the preset health fault threshold. The preset health failure threshold is a comprehensive health score of 70. When the comprehensive health score of the main PLC is lower than 70, condition Y1 is met. Y2. The duration of the communication link interruption between the main PLC and the redundant industrial switch or between the main PLC and the upper-level monitoring server exceeds the preset communication timeout threshold. The preset communication timeout threshold is 500 milliseconds. When the communication link interruption between the main PLC and the redundant industrial switch lasts for more than 500 milliseconds, or when the communication link interruption between the main PLC and the upper-level monitoring server lasts for more than 500 milliseconds, condition Y2 is met. Y3. The upper-level monitoring server determines abnormal operation of the main PLC through fusion analysis. The upper-level monitoring server determines whether the main PLC has logical operation abnormalities or control command output abnormalities by integrating and analyzing the main PLC's operating status data, network status data, and field sensor feedback data.

[0044] Specifically, the upper-level monitoring server cross-verifies the health data reported by the main PLC, the network link quality data, and the process parameters fed back by the field sensors.

[0045] Alternatively, during cross-validation, the server may determine that the main PLC has a logic operation abnormality or instruction output abnormality when one of the following situations occurs: The first scenario is that the main PLC's health data is normal, but the deviation between the process parameters fed back by the field sensors and the control expectations exceeds the preset threshold, and this deviation cannot be explained by network latency or sensor noise. In this case, it is determined that there is an abnormality in the main PLC's control command output.

[0046] The second scenario: If the network quality is normal, but the main PLC reports abnormal fault codes multiple times in a row, it is determined that there is a logical operation abnormality in the main PLC.

[0047] The third scenario: If the CPU utilization and program scan cycle of the main PLC are normal, but the read-back value and write value of the output mapping register are inconsistent, it is determined that there is an output channel abnormality in the main PLC.

[0048] Y4. The rate of change of process parameters reported by field sensors exceeds the preset threshold and does not match the current control command. The rate of change of process parameters reported by the field pressure sensor, temperature sensor or flow sensor exceeds the preset rate of change threshold, and the change does not match the current control command.

[0049] Specifically, the process parameters include the pressure, temperature, and flow rate of the gas supply and distribution system. The system presets a normal rate of change range for each process parameter, which is adaptively adjusted according to the current operating condition. The mismatch with the current control command occurs when the trend of the process parameter is inconsistent with the physical effect that should be produced by the valve opening and switching commands output by the current PLC controller.

[0050] Taking pressure parameters as an example: When the control valve opening command remains at a fixed opening, the downstream pressure should remain relatively stable, and its normal rate of change should be less than 2% of full scale per second. If the downstream pressure change rate exceeds the preset mutation threshold, it indicates that an unexpected pressure mutation has occurred in the gas supply and distribution circuit, and this mutation is not caused by the change in control command. In this case, it is determined that the process parameters are abnormal, and condition Y4 is met.

[0051] Let's take flow parameters as an example: When the control valve opening command changes from 30% to 50% in a step, the downstream flow should increase accordingly, and its rate of change should fall within an expected range determined by the valve characteristics. If the rate of change of the downstream flow is much lower than the lower limit of the expected range, it indicates that there may be valve jamming or pipeline blockage, which is judged as an abnormal process parameter, and condition Y4 is met.

[0052] A handover permission instruction is generated when any two of the four conditions Y1 to Y4 above are met simultaneously.

[0053] For example, when both Y1 and Y2 are satisfied, a switching permission instruction is generated; When both Y1 and Y3 are satisfied, a switching permission instruction is generated; When both Y1 and Y4 are satisfied, a switching permission instruction is generated; When both Y2 and Y3 are satisfied, a switching permission instruction is generated; When both Y2 and Y4 are satisfied, a switching permission instruction is generated; When both Y3 and Y4 are satisfied, a switching permission instruction is generated; Switching is triggered only when any two of the four conditions are met simultaneously; switching is not triggered when only one condition is met, thus effectively avoiding false switching caused by momentary jitter of a single signal.

[0054] In some embodiments, in response to a handover permission command, the system immediately performs a seamless handover. The specific implementation of the seamless handover is as follows: 1. Hardware-level latching and holding of output signals At the moment of switching, the system performs hardware-level latching and holding of all output signals, including all digital output signals and all analog output signals from the PLC controller.

[0055] Regarding the specific implementation of hardware write protection: Output latching is implemented through hardware-level write protection. Specifically, at the moment of switching, the hardware logic circuit forcibly pulls low the write enable pins of all output registers, prohibiting the CPU from performing any write operations on the output registers, until the standby PLC completely takes over the output bus and the write protection is released. The hardware write protection circuit is triggered by the switching control signal, and its response time is less than 1 millisecond. During the write protection period, the value in the output register remains unchanged, thereby ensuring that analog and digital output signals such as valve opening and regulating valve output current do not produce any jumps.

[0056] In some embodiments of this system, a global clock synchronization signal is generated using a PTP (Precision Time Protocol) synchronization unit or an IRIG-B (Integrated IRGB) time synchronization unit. This signal is distributed to the main PLC, backup PLC, redundant industrial switches, upper-level monitoring server, and client via a dedicated time synchronization network or Ethernet PTP protocol, ensuring that all the above devices have a unified microsecond-level time reference, with clock deviations between devices not exceeding ±100 microseconds.

[0057] Under the control of the global clock synchronization signal, the standby PLC switches to the new master PLC at the same beat point of the global clock and immediately takes over all control functions. The response time of the switching process is no more than 20 milliseconds, that is, the total time from the generation of the switching enable instruction to the standby PLC fully taking over the control functions is no more than 20 milliseconds.

[0058] The following operations are performed during the switchover: the write enable pins of all output registers are forcibly pulled low for latching and holding; the standby PLC switches to the master controller under the global clock tick; the standby PLC takes over the control of the output bus; and the write enable pins of the output registers are restored.

[0059] The above operations ensure that the switching process does not interrupt the gas supply circuit, does not drive valve jumps, and does not generate pressure fluctuations.

[0060] After the switchover is complete, the system enters a preset lockout window, which lasts for 10 seconds. During this window, the system is prohibited from performing any switchback operations. Even if the original PLC resumes communication or its health score recovers during this period, the system will not perform a switchback, thus preventing frequent switchbacks caused by momentary fluctuations in the original PLC's status.

[0061] The anti-vibration lock-up mechanism in this solution completely eliminates the aforementioned vibration switching phenomenon by setting a lock-up time window.

[0062] Once the health status of the main PLC returns to normal and remains stable for more than the preset stable time, it is triggered by an external confirmation command to perform a seamless switchback from the current main PLC to the original main PLC.

[0063] Before the seamless switchback is executed, the current master PLC and the original master PLC that has returned to normal complete the pre-synchronization of data, timing and output status. The pre-synchronization before the switchback uses the same technical means as the pre-synchronization in step S2.

[0064] During the switchback process, the same output latching and holding mechanism as in step S4 is used. This involves using hardware logic to forcibly pull the write enable pins of all output registers low, prohibiting the CPU from performing any write operations on the output registers, until the original master PLC completely takes over the output bus and then releases the write protection. Through this mechanism, the switchback process does not cause any disturbance to the field valves, regulating valves, or other actuators.

[0065] In some embodiments, real-time anomaly monitoring is performed on multiple links in the entire control link, where the control link refers to the complete data transmission path from the main PLC / backup PLC through redundant industrial switches, fiber optic communication links / Ethernet communication links to the upper-level monitoring server and client.

[0066] The proposed solution provides a method for dual PLC redundancy switching and abnormal state monitoring in rocket ground control systems. This method can be widely applied to high-reliability scenarios such as gas supply and distribution systems, power measurement and control systems, pressurization and delivery systems, and refueling systems at liquid rocket launch sites. This invention features reliable switching, comprehensive monitoring, strong self-healing capabilities, and precise timing, effectively improving the reliability and safety of aerospace launch ground support systems. It possesses significant industrial practical value and promising prospects for widespread application.

[0067] It should be understood that the above-described embodiments or examples of the present invention can be combined with each other and have corresponding technical effects.

[0068] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for dual PLC redundancy switching and abnormal state monitoring in a rocket ground control system, characterized in that, Includes the following steps: S1. Health assessment: The main PLC and the backup PLC collect their respective operating status parameters and communication status parameters with each other in real time. The collected parameters are weighted and calculated in multiple dimensions to generate a comprehensive health score. Based on the comprehensive health score, the health status of each PLC controller is divided into normal status, warning status, fault status and downtime status. S2. Pre-synchronization: When the health status of the main PLC drops from the normal state to the warning state, the standby PLC automatically completes the pre-synchronization of data, timing and output status with the main PLC, so that the standby PLC enters the hot standby ready state. S3. Handover voting: Real-time monitoring of multiple handover triggering conditions; When any two or more of the multiple handover triggering conditions are met simultaneously, a handover permission instruction is generated. S4. Uninterrupted switching execution: In response to the switching permission command, all output signals are immediately latched and held at the hardware level. The backup PLC is switched to the new master PLC under the control of the global clock synchronization signal and takes over all control functions, so that the response time of the switching process is not greater than the preset time threshold. S5. Anti-vibration lock: After the smooth switching execution step is completed, a lock time window of a preset length is started, during which any switchback operation is prohibited. S6. Smooth Switchback: When the health status of the original master PLC returns to normal and remains stable for more than the preset stable time, it is triggered by an external confirmation command to perform a seamless switchback from the current master PLC to the original master PLC.

2. The method for dual PLC redundancy switching and abnormal state monitoring of a rocket ground control system according to claim 1, characterized in that, In step S1: The operating status parameters include CPU utilization, memory usage, program scan cycle, and scan cycle jitter value. The communication status parameters include communication latency, packet loss rate, and packet error rate with the redundant switch. The parameters on which the multi-dimensional weighted calculation is based also include the response correctness of digital input / output channels and analog input / output channels, power supply voltage value, module temperature value and fault code; The comprehensive health score uses a dynamic weighting coefficient, which is adaptively adjusted according to the current operating conditions of the rocket's ground gas supply and power control system.

3. The method for dual PLC redundancy switching and abnormal state monitoring of a rocket ground control system according to claim 1, characterized in that, In step S2: the backup PLC copies all variable data, output mapping register status, timing status mirror and instruction queue of the main PLC, and under the control of the global clock synchronization signal, aligns the instruction execution cycle of the backup PLC with the instruction execution cycle of the main PLC to a preset synchronization accuracy range.

4. The method for dual PLC redundancy switching and abnormal state monitoring of a rocket ground control system according to claim 1, characterized in that, In step S3, the multiple switching trigger conditions include at least the following four items: Y1. The overall health score of the main PLC is lower than the preset health fault threshold. Y2. The duration of the communication link interruption between the main PLC and the redundant switch or between the main PLC and the upper-level monitoring server exceeds the preset communication timeout threshold. Y3. The upper-level monitoring server determines that the main PLC has logical operation abnormalities or control command output abnormalities by integrating and analyzing the main PLC's operating status data, network status data, and field sensor feedback data. Y4. The rate of change of process parameters reported by the field pressure sensor, temperature sensor or flow sensor exceeds the preset rate of change threshold, and the change does not match the current control command.

5. The method for dual PLC redundancy switching and abnormal state monitoring of a rocket ground control system according to claim 4, characterized in that, In step S3, the switching permission instruction is generated when any two or more switching trigger conditions among Y1-Y4 are triggered.

6. The method for dual PLC redundancy switching and abnormal state monitoring of a rocket ground control system according to claim 1, characterized in that, In step S4: the hardware-level latching and holding of the output signal is achieved by hardware write protection of all output registers; the global clock synchronization signal is provided by a PTP precise time protocol synchronization unit or an IRIG-B time synchronization unit, and the global clock synchronization signal enables the main PLC, the backup PLC, the redundant switch, the upper-level monitoring server and the client to have a unified microsecond-level time reference; the response time of the switching process is no more than 20 milliseconds.

7. The method for dual PLC redundancy switching and abnormal state monitoring of a rocket ground control system according to claim 1, characterized in that, In step S6: Before the non-disruptive back-cut execution, the current main PLC and the original main PLC that has returned to normal complete the pre-synchronization of data, timing and output status, and complete the output latching and holding during the back-cut process under the control of the global clock synchronization signal, so that the back-cut process does not cause disturbance to the field actuator.

8. The method for dual PLC redundancy switching and abnormal state monitoring of a rocket ground control system according to claim 1, characterized in that, The process also includes step S7, full-link abnormal status monitoring: real-time abnormal monitoring of multiple links in the entire control link, including optical fiber communication links, Ethernet communication links, redundant switch ports, and data frame transmission processes; the monitoring parameters of the optical fiber communication links include optical power value, optical attenuation value, link break status, and bit error rate; the monitoring parameters of the Ethernet communication links include link connectivity status, latency value, and jitter value; the monitoring parameters of the redundant switch ports include port status, bandwidth utilization, frame error count, and device temperature; the monitoring parameters of the data frame transmission process include packet loss rate, out-of-order count, retransmission count, and invalid frame count; the abnormal statuses are classified into link abnormality level, device abnormality level, and system abnormality level according to their severity, with different handling strategies corresponding to different levels.

9. The method for dual PLC redundancy switching and abnormal state monitoring of a rocket ground control system according to claim 8, characterized in that, It also includes step S8, network self-healing and fault isolation: when a single communication link is detected as abnormal in step S7, the data transmission is automatically switched to a redundant communication link; when a single switch port is detected as abnormal, the data stream is automatically shifted to a backup switch port; when a network broadcast storm is detected, a rate limiting policy is automatically activated and abnormal network nodes are isolated; when an invalid or abnormal control command frame is detected, verification retransmission or discard processing is automatically performed; when a local network partition is detected as abnormal, the partition is isolated to prevent the fault from spreading to the global network.

10. The method for dual PLC redundancy switching and abnormal state monitoring of a rocket ground control system according to claim 1, characterized in that, It also includes step S9, multi-source data fusion early warning and black box recording: the upper-level monitoring server integrates the status data of the main PLC and the backup PLC, the full-link abnormal status monitoring data and the on-site gas supply and distribution process parameters to establish a multi-source correlation early warning model and realize trend early warning before the occurrence of faults; The on-site gas supply and distribution process parameters include pressure, temperature, and flow rate. The system records and stores in real time switching events, abnormal events, fault codes, link status, command execution sequence, valve action timestamps, and process parameter curves with global clock timestamps. These records are used for fault tracing and launch mission zeroing analysis.

Images