CN116699964A - Redundant operation method and system for industrial process controller - Google Patents

Abstract

The application provides a redundant operation method and a system of industrial process controllers, wherein two industrial process controllers perform redundant information interaction through a redundant Ethernet to realize redundant operation of the controllers, and the redundant operation logic of the controllers is decoupled into a state redundant logic, a configuration redundant logic, a data redundant logic and a task redundant logic; decoupling a physical link layer and a data link layer of the Ethernet, and decomposing a redundant link by the data link layer to obtain a state redundant link, a configuration redundant link, a data redundant link and a task redundant link; and each redundant link uses a redundant Ethernet to carry out redundant information interaction of corresponding logics, so that independent redundant operation among the redundant logics is realized. The application reduces the complexity of a redundant system, ensures the reliability of redundant operation by decoupling and designing the redundant logic and decomposing the redundant link, and realizes the redundant effects of high reliability and short switching delay under the condition of not increasing the hardware cost.

Description

Method and system for redundant operation of industrial process controller

technical field

The invention belongs to the technical field of redundant operation of automation equipment, and relates to a method and system for redundant operation of industrial process controllers.

Background technique

At present, industrial process controllers generally adopt 1:1 module-level dual redundancy for key components to realize dual-machine master-slave hot-standby redundant operation, so as to avoid accidents such as downtime caused by a single module failure of the controller, and facilitate online maintenance and upgrade of the system , improve the mean time between failures of the system.

Hot standby redundancy consists of two identical subsystems, and these two subsystems form a working and a standby relationship, and run the exact same program at the same time, forming two completely parallel operating modes. In the hot standby redundant system, the two mutually redundant subsystems both receive input, perform calculations, and diagnose at the same time, but the standby subsystem does not enable output and does not actively send monitoring data.

The use of hot standby redundancy technology is mainly to improve the fault tolerance of the controller, so an important function of hot standby redundancy is to realize redundancy switching based on failure: both the active controller and the standby controller perform self-diagnosis and mutual diagnosis , when the working controller fails and the standby controller is normal, the master-slave relationship is switched automatically, so that the controller in the fault situation becomes the standby state, and the diagnosed normal controller becomes the working state. In order to avoid/reduce disturbance to the controlled object, the switching time is required to be as short as possible.

According to the redundancy implementation method, it can generally be divided into hardware redundancy and software redundancy.

The redundant structure of the hardware redundant system ensures system reliability at any time, for example, all important components are redundantly configured. This includes redundant CPUs, power supply modules and synchronization modules for redundant CPU communication. When a failure occurs, it will automatically switch to the standby controller, and the switching process will not stop. However, the cost of hardware redundancy is relatively high, and it is generally used in systems with high reliability requirements.

Software redundancy is realized by software programming when a fault is detected and switches to the standby controller. It is necessary for the platform or the user to write control logic with redundant functions and participate in the redundant fault diagnosis judgment and state matching throughout the process. If there is no dedicated Redundant communication channels, redundant data synchronization and state switching have hysteresis, the cost is relatively low, and the switching time is relatively long.

Contents of the invention

In order to solve the deficiencies in the prior art, the present invention provides a redundant operation method and system for industrial process controllers, through redundant logic decoupling and design, redundant link decomposition, reducing the complexity of redundant systems, ensuring redundant In addition to operational reliability, without increasing the cost of hardware, the redundancy effect of high reliability of operation and short switching delay is realized through software redundancy, and the hot standby redundancy function of the controller of the industrial control system is realized, which is convenient for online maintenance and upgrade of the system , improve the mean time between failures of the system.

The present invention adopts the following technical solutions.

A method for redundant operation of industrial process controllers, in which two industrial process controllers perform redundant information exchange through a redundant Ethernet network to realize redundant operation of the controllers;

Preferably, the controller redundant operation logic is decoupled into state redundancy logic, configuration redundancy logic, data redundancy logic and task redundancy logic;

Decouple the physical link layer and data link layer of the Ethernet network, where the physical link layer includes physical links A and B, physical links A and B form a redundant Ethernet network, and the data link layer performs redundant links Decompose to get state redundant link, configuration redundant link, data redundant link and task redundant link;

Each redundant link uses a redundant Ethernet network to exchange redundant information of the corresponding logic to realize independent redundant operation between redundant logics.

Preferably, the state redundancy logic includes redundant state negotiation logic for power-on operation, master offline slave active master logic, slave judge fault level active master master logic, and master slave forced master-slave switching logic upon receipt of a tool command.

Preferably, the redundant state negotiation logic of the power-on operation is used to confirm the state of the master-slave controller, specifically:

The controller is powered on and initialized to run, and obtains the default state settings of the respective redundant masters and slaves;

When the default setting is the slave state, the controller sets the side as the initial slave state after a delay;

When the default setting is the master state, immediately set the local side to the initial slave state without delay;

After the controller enters the initial slave state, it sends a heartbeat message to the opposite side through the state redundant link;

When the heartbeat message continues to time out without reply, the controller enters the host state;

When the heartbeat message is replied by the opposite host, the controller remains in the slave state.

Preferably, after confirming the state of the master-slave controller, the slave controller periodically sends a heartbeat message to the master controller through the state redundant link, and the master controller replies the heartbeat message to the slave controller after receiving the heartbeat message;

The heartbeat message includes the failure level of the local side, the forced switching flag and the master-slave status flag;

Among them, the failure level is stipulated for the specific failure type. When the master controller fails, the failure level of the local side is set to the corresponding agreed value, and the heartbeat reply message is sent to the slave.

Preferably, the logic of the host offline slave actively upgrading to the master is as follows:

If the slave controller continuously receives the heartbeat reply message timeout, it means that the master is offline, the slave controller itself switches to the master, and then continuously sends messages to force the other side to switch to the slave.

Preferably, the slave judges that the fault level is actively upgraded to the master logic and the application logic cooperates to realize the slave judges the fault level to actively upgrade the master, specifically:

The application logic is: receiving the fault level of the opposite side in the heartbeat reply message from the controller and comparing it with the fault level of the local side;

The slave judges that the failure level is actively upgraded to the main logic: through the application logic comparison, when the failure level of the opposite side in the heartbeat reply message received from the controller is continuously higher than the failure level of the side, the side switches to the master, and then continuously sends A message that forces the opposite side to switch to a slave; the host immediately sets it as a slave after receiving a message that makes this side switch to a slave.

Preferably, the host receives a tool command to force the master-slave switching logic, specifically:

After the main controller receives the switch master-slave command from the debugging tool side, it will force the switch flag to be set when replying the heartbeat message this time;

When the forced switching flag is set in the heartbeat message received from the controller, the local side switches to the master, and then continuously sends messages to force the opposite side to switch to the slave;

After the host receives the message to switch the local side to the slave, it is immediately set as the slave.

Preferably, the configuration redundancy logic includes slave power-on synchronization configuration logic and online update configuration logic;

The slave power-on synchronization configuration logic is specifically:

After the controller is powered on for initial operation and is determined as a slave through redundancy state negotiation, it sends a configuration information request message to the master through the configuration of the redundant link;

After the slave machine obtains the verification code of the master configuration information, it compares it with the local configuration information. If the verification information is consistent, the configuration synchronization ends, and if the verification information is inconsistent, the configuration file synchronization starts.

Preferably, the online update configuration logic is specifically:

When the debugging tool connects to the main controller and issues an online update configuration command, the master downloads the update message and forwards it to the slave through the configuration redundant link, and the slave updates the local configuration file after receiving the download update message;

The debugging tool only establishes a connection with the current main controller and sends an online update configuration command to the main controller when online update configuration is required.

Preferably, the data redundancy logic is specifically:

Divide controller tasks into periodic tasks, free tasks, state-triggered tasks, and event-triggered tasks;

When the controller initializes and runs, select the periodic task or the free task with the highest priority as the highest priority task; when the periodic task and the free task have the same highest priority setting, select the periodic task as the highest priority task;

Before the execution of the highest priority task, the main controller sends a data synchronization message through the data redundancy link, and after receiving the data synchronization message, the slave controller updates the local data and executes the highest priority task.

Preferably, the task redundancy logic is specifically:

Realize highest priority task synchronization and data redundancy based on data redundancy logical merging;

The master controller sends a task synchronization command through the task redundancy link before the execution of the non-highest priority task, and the slave controller executes the corresponding task after receiving the task synchronization command.

A redundant operation system for industrial process controllers, including two industrial process controllers and a redundant Ethernet network;

Each controller is provided with a state redundancy module, a configuration redundancy module, a data redundancy module and a task redundancy module, which are respectively used to execute state redundancy logic, configuration redundancy logic, data redundancy logic and task redundancy logic;

The redundant Ethernet network sets state redundant links, configuration redundant links, data redundant links and task redundant links;

The state redundancy module, the configuration redundancy module, the data redundancy module and the task redundancy module operate independently, and each uses an independent thread to complete the relevant logical tasks, respectively adopts the state redundancy link, the configuration redundancy link, and the data redundancy link. Redundant links and task redundant links exchange data.

Preferably, the two industrial process controllers are identical, and are interconnected through physical links A and B of the redundant Ethernet network;

The base of the controller is equipped with a hardware dialing module, which is used to manually set one side as the master controller by default, and the other side as the slave controller by default;

The redundant state results negotiated by the state redundancy module can be accessed by other modules and participate in the operation logic of other modules; at the same time, the state redundancy module also exchanges the operation states of both sides;

The state redundant link uses physical link A and B to send data in turn, and when the response data sent by physical link A or B is not received continuously, it is determined that the corresponding physical link is disconnected;

The configuration redundant link, data redundant link and task redundant link use the state redundant link to detect connected physical links to send data.

A terminal, including a processor and a storage medium; the storage medium is used to store instructions;

The processor is configured to operate according to the instructions to perform the steps of the method.

A computer-readable storage medium stores a computer program thereon, and implements the steps of the method when the program is executed by a processor.

The beneficial effect of the present invention is that, compared with the prior art, the redundant controller of the present invention completes the redundant information exchange through the redundant Ethernet, and can realize the hot standby redundant operation of the controller. On the basis of conventional controller hardware, only Increase the redundant communication port, make full use of the physical bandwidth, and improve the redundancy and reliability of the system. The present invention reduces the complexity of the redundant system and ensures the reliability of redundant operation through redundant logic decoupling and design and redundant link decomposition. On the basis of not increasing the hardware cost of the redundant system, it is realized through software redundancy It ensures the redundancy effect of high reliability of operation and short switching delay.

Description of drawings

Fig. 1 is a schematic diagram of the architecture of the controller redundancy system of the present invention;

Fig. 2 is a flow chart of negotiation and interaction of controller power-on redundancy state in the present invention;

Fig. 3 is the interaction flow chart of master offline slave active upgrading to master in the present invention;

Fig. 4 is the interaction flow chart of slave judging the fault level and actively upgrading the master in the present invention;

Fig. 5 is the interaction flow chart of the master-slave switching forced master-slave switch received by the host of the present invention;

Fig. 6 is an interaction flow chart of slave power-on synchronization configuration interaction in the present invention;

Fig. 7 is a flow chart of online update configuration interaction in the present invention;

Fig. 8 is a flow chart of data redundancy interaction in the present invention;

Fig. 9 is a flowchart of task redundancy interaction in the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. The embodiments described in this application are only some embodiments of the present invention, not all embodiments. Based on the spirit of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts all belong to the protection scope of the present invention.

Embodiment 1 of the present invention provides a method for redundant operation of industrial process controllers. Two industrial process controllers perform redundant information exchange through a redundant Ethernet network to realize redundant operation of the controllers. In the preferred but non-limiting aspect of the present invention In an embodiment, the method decouples the controller redundant operation logic into state redundancy logic, configuration redundancy logic, data redundancy logic and task redundancy logic;

Decouple the physical link layer and data link layer of the Ethernet network, where the physical link layer includes physical links A and B, physical links A and B form a redundant Ethernet network, and the data link layer performs redundant links Decompose to get state redundant link, configuration redundant link, data redundant link and task redundant link;

Each redundant link uses a redundant Ethernet network to exchange redundant information of the corresponding logic to realize independent redundant operation between redundant logics.

That is to say, two controllers are connected by redundant Ethernet network to form a master-slave redundant controller. The controllers obtain the default state settings of their respective redundant masters and slaves and combine the redundant information exchanged through the redundant Ethernet to complete the master-slave state negotiation. Redundancy information exchange includes master-slave state negotiation, master-slave state switching, running state information exchange, configuration synchronization, data synchronization and task synchronization. Redundancy information interaction is decomposed into state redundancy module, configuration redundancy module, data redundancy module and task redundancy module according to logical function. The redundant modules operate independently, and use the state redundant link, configuration redundant link, data redundant link and task redundant link to exchange data respectively.

The slave controller periodically sends a heartbeat message to the master controller through the state redundant link. State negotiation, master-slave state switching and running state information exchange. The master controller sends configuration information by configuring redundant links, receives configuration information from the slave controller to update the local configuration, and waits for the master controller to send a switching configuration command after synchronizing the configuration information from the slave controller.

The slave controller does not run tasks through the local task scheduling module. Before the execution of the highest priority task, the main controller sends a data synchronization message through the data redundancy link, and the slave controller receives the data synchronization message to update the local data and execute the highest priority task. Before the execution of non-highest priority tasks, the master controller sends task synchronization commands through the task redundancy link, and the slave controller receives task synchronization commands to execute corresponding tasks.

Embodiment 2 of the present invention provides an industrial process controller redundant operation system, including two redundant controllers and a redundant Ethernet network;

Each controller is provided with a state redundancy module, a configuration redundancy module, a data redundancy module and a task redundancy module, which are respectively used to execute state redundancy logic, configuration redundancy logic, data redundancy logic and task redundancy logic;

The redundant Ethernet network sets state redundant links, configuration redundant links, data redundant links and task redundant links;

The state redundancy module, the configuration redundancy module, the data redundancy module and the task redundancy module operate independently, and each uses an independent thread to complete the relevant logical tasks, respectively adopts the state redundancy link, the configuration redundancy link, and the data redundancy link. Redundant links and task redundant links exchange data.

Further preferably, the framework of the controller redundant operation system of the present invention is described in conjunction with FIG. 1:

The two industrial process controllers are identical, and are interconnected through physical links A and B of the redundant Ethernet network, and the flow control function of the Ethernet ports of physical links A and B is turned off;

The base of the controller has a hardware dialing function, which can be manually set to one side as the master controller by default, and the other side as the slave controller by default.

The controller software includes state redundancy module, configuration redundancy module, data redundancy module, task redundancy module and application logic module, etc.

Each redundant module operates independently, each uses an independent thread to complete related tasks, and uses state redundant links, configuration redundant links, data redundant links, and task redundant links to exchange data.

Among them, the redundant state results negotiated by the state redundancy module can be accessed by other modules and participate in the operation logic of other modules.

At the same time, the status redundancy module also exchanges the operating status of both sides, including operating information such as load, temperature, and memory usage.

The state redundant link uses physical link A and B to send data in turn, making full use of the physical bandwidth; the sent data contains the data number, and when the response data sent by the physical link A or B is not received continuously, it is judged The corresponding physical link is disconnected;

The configuration redundant link, data redundant link and task redundant link use the state redundant link to detect connected physical links to send data, which improves the redundancy and reliability of the system. That is, physical links A and B are connected at the same time by default, and the data sent continuously by the state redundant link is sent using physical links A and B in turn. Configure redundant links, data redundant links and task redundant links The road can choose a physical link to send data;

When the status redundant link determines that the physical link is disconnected, it means that the physical link is faulty. At this time, configure the redundant link, data redundant link and task redundant link to use another connected physical link. An error is reported when both physical links fail.

The specific introduction of the above-mentioned state redundancy logic, configuration redundancy logic, data redundancy logic and task redundancy logic is as follows:

As shown in Figure 2, the redundancy state negotiation logic for controller power-on operation is specifically:

The controller is powered on and initialized to run, and obtains the default state settings of the respective redundant master and slave.

Further preferably, the controller base provides a dial to set the redundant master-slave default state, and the controller obtains relevant settings by collecting hardware signals of the base.

In the implementation scheme that does not have hardware conditions, the method of setting parameters by software can also realize the default state setting of the redundant master and slave.

When the default setting is the slave state, the controller sets the side as the initial slave state after a delay T;

When the default setting is the master state, immediately set the local side to the initial slave state without delay.

After the controller enters the initial slave state, it sends a heartbeat message to the opposite side through the state redundant link.

When the heartbeat message does not reply after N frame timeout ΔT, the controller enters the host state;

When the heartbeat message is replied by the opposite host, the controller remains in the slave state.

To sum up, before the official operation, the controllers on both sides first enter the initial slave state and send a heartbeat message requesting to upgrade to the master. By setting the delay T, the master-slave state competition relationship that may occur when the controllers on both sides are powered on and run at the same time can be resolved.

After the state of the master-slave controller is confirmed, the slave controller periodically sends a heartbeat message to the master controller through the state redundant link according to ΔT, and the master controller replies the heartbeat message to the slave controller after receiving the heartbeat message.

The heartbeat message includes the failure level of the local side, the forced switching flag and the master-slave status flag.

As shown in Figure 3, the logic of the active master upgrade of the offline slave of the controller master is as follows:

When the host is offline due to abnormal operation or power failure, the slave controller periodically sends heartbeat messages to the master controller through the state redundant link according to ΔT. When receiving heartbeat reply messages in consecutive N frames times out, the side switches to The host, and then continuously send messages to force the other side to switch to the slave.

As shown in Figure 4, the logic of the controller’s slave judging the fault level to actively upgrade to the master cooperates with the application logic to realize the slave judging the fault level to actively upgrade to the master, specifically:

The fault level field is included in the heartbeat message of the controller, and the fault level ranges from 0 to 255. The larger the number, the higher the fault level. For the specific types of abnormalities such as bus anomalies, power failures, and man-machine interface failures, the corresponding fault levels are respectively agreed. When the master controller fails, set the failure level of the local side to a corresponding non-zero value, and send it to the slave machine through a heartbeat reply message.

The application logic is: receiving the opposite side failure level (i.e. running state) in the heartbeat reply message from the controller and comparing it with the failure level of this side;

The slave judges that the failure level is actively raised to the main logic: by comparing the application logic, it is obtained that the failure level of the opposite side in the heartbeat reply message received from the controller is higher than the failure level of the side for 3 consecutive frames, then the side is switched to the master, and then Continuously send messages to force the other side to switch to the slave;

After the host receives the message to switch the local side to the slave, it is immediately set as the slave.

As shown in Figure 5, the controller host receives the tool command to force the master-slave switching logic to be specific.

The controller heartbeat message contains a forced switching field, which is 0 during normal operation, and when it is 0x5A, it means that the debugging tool issued a command to forcibly switch the master-slave state of the redundant controller.

The commissioning tool only establishes communication with the current master controller.

After the master controller receives the master-slave switch command from the debugging tool side, it sets the forced switch flag bit to 0x5A in this heartbeat reply message.

The position of the forced switching flag in the heartbeat message received from the controller is 0x5A, then the local side switches to the master, and then continuously sends messages to force the opposite side to switch to the slave.

After the host receives the message to switch the local side to the slave, it is immediately set as the slave.

As shown in Figure 6, the controller slave power-on synchronization configuration logic is as follows:

After the controller is powered on for initial operation and is determined to be a slave through redundancy negotiation, the slave sends a configuration information request message to the master through the configuration of the redundant link.

After receiving the slave configuration information request message, the master sends all the configuration files on the local side to the slave according to the file name + valid flag + check code.

After the slave machine obtains the host configuration information, it uses the file name as the associated information to compare with the configuration file on the local side. First, compare the valid flag of the configuration file. When the valid flag bit is invalid, the slave machine deletes the local configuration file, otherwise it further compares the configuration files. check code, when the check code is inconsistent, the slave will obtain inconsistent configuration files in turn, otherwise, the configuration synchronization will end.

As shown in Figure 7, the controller online update configuration logic is as follows:

The debugging tool only establishes communication with the current main controller. When the configuration needs to be updated online, the tool sends a download request, file transfer, download confirmation and configuration update command to the main controller.

When the master controller receives the above command, it forwards it to the slave controller by configuring the redundant link.

After receiving the above command from the controller, it will be processed according to the equivalent logic of the command issued by the tool.

As shown in Figure 8, the controller data redundancy logic is introduced.

Controller tasks are generally divided into task scheduling methods such as periodic tasks, free tasks, state-triggered tasks, and event-triggered tasks. Among them, the free task is a task that does not pass the cycle, is triggered by a state, or is triggered by an event.

When the controller initializes and runs, select the periodic task or the free task with the highest priority as the highest priority task; when the periodic task and the free task have the same highest priority setting, select the periodic task as the highest priority task;

The slave controller does not trigger the running period tasks, free tasks, state-triggered tasks, and event-triggered tasks through the local task scheduling module; that is, the master is the task scheduling module that triggers the running cycle tasks, free tasks, state-triggered tasks, and event-triggered tasks; The machine does not trigger, and the data redundancy and task redundancy modules are completely responsible for triggering periodic tasks, free tasks, state-triggered tasks, and event-triggered tasks;

Before the highest priority task is executed, the main controller sends a data synchronization message through the data redundancy link, and then executes the highest priority task.

Update the local data after receiving the data synchronization message from the controller, and execute the highest priority task after receiving all the data.

As shown in Figure 9, the redundancy logic for the controller task is specifically:

The highest priority task synchronization and data redundancy of redundant controllers are combined to avoid the problem of out-of-sync data and tasks.

Non-highest priority tasks are coordinated through the task redundancy module.

Before the execution of the non-highest priority task, the main controller sends the task synchronization command through the task redundancy link, and then executes the corresponding task.

The content of the above command includes the task ID of this execution, and the task ID of the master and slave controllers is the same.

Execute the corresponding task after receiving the task synchronization command from the controller.

Embodiment 3 of the present invention provides a terminal, including a processor and a storage medium; the storage medium is used to store instructions;

The processor is configured to operate according to the instructions to execute the steps of the method according to Embodiment 1.

Embodiment 4 of the present invention provides a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the steps of the method described in Embodiment 1 are implemented.

The beneficial effect of the present invention is that, compared with the prior art, the redundant controller of the present invention completes the redundant information exchange through the redundant Ethernet, and can realize the hot standby redundant operation of the controller. On the basis of conventional controller hardware, only Adding redundant communication ports, through redundant logic decoupling and design, and redundant link decomposition, reduces the complexity of the redundant system and ensures the reliability of redundant operation. On the basis of not increasing the hardware cost of the redundant system, through Software redundancy realizes the redundancy effect of high reliability of operation and short switching delay.

The present disclosure can be a system, method and/or computer program product. A computer program product may include a computer readable storage medium having computer readable program instructions thereon for causing a processor to implement various aspects of the present disclosure.

A computer readable storage medium may be a tangible device that can retain and store instructions for use by an instruction execution device. A computer readable storage medium may be, for example, but is not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), or flash memory), static random access memory (SRAM), compact disc read only memory (CD-ROM), digital versatile disc (DVD), memory stick, floppy disk, mechanically encoded device, such as a printer with instructions stored thereon A hole card or a raised structure in a groove, and any suitable combination of the above. As used herein, computer-readable storage media are not to be construed as transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., pulses of light through fiber optic cables), or transmitted electrical signals.

Computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to a respective computing/processing device, or downloaded to an external computer or external storage device over a network, such as the Internet, a local area network, a wide area network, and/or a wireless network. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and/or edge servers. A network adapter card or a network interface in each computing/processing device receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in each computing/processing device .

Computer program instructions for performing the operations of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or Source or object code written in any combination, including object-oriented programming languages—such as Smalltalk, C++, etc., and conventional procedural programming languages—such as the “C” language or similar programming languages. Computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer, or entirely on the remote computer or server implement. In cases involving a remote computer, the remote computer can be connected to the user computer through any kind of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computer (such as via the Internet using an Internet service provider). connect). In some embodiments, an electronic circuit, such as a programmable logic circuit, field programmable gate array (FPGA), or programmable logic array (PLA), can be customized by utilizing state information of computer-readable program instructions, which can Various aspects of the present disclosure are implemented by executing computer readable program instructions.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to the above embodiments, those of ordinary skill in the art should understand that the present invention can still be Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention shall fall within the protection scope of the claims of the present invention.

Claims (15)

1. The utility model provides an industrial process controller redundancy operation method, two industrial process controllers carry out redundant information interaction through redundant Ethernet, realize controller redundancy operation, its characterized in that:

decoupling the controller redundancy operation logic into state redundancy logic, configuration redundancy logic, data redundancy logic and task redundancy logic;

decoupling a physical link layer of the Ethernet from a data link layer, wherein the physical link layer comprises physical links A and B, the physical links A and B form a redundant Ethernet, and the data link layer carries out redundant link decomposition to obtain a state redundant link, a configuration redundant link, a data redundant link and a task redundant link;

and each redundant link uses a redundant Ethernet to carry out redundant information interaction of corresponding logics, so that independent redundant operation among the redundant logics is realized.

2. A method of redundant operation of an industrial process controller according to claim 1 wherein:

the state redundancy logic comprises redundancy state negotiation logic of power-on operation, master-slave active lifting master logic of a host offline slave the slave judges the failure level to actively raise the master logic and the master receives the tool command to force the master-slave switching logic.

3. A method of redundant operation of an industrial process controller according to claim 2 wherein:

the redundant state negotiation logic of the power-on operation is used for confirming the state of the master-slave controller, and specifically comprises the following steps:

the controller is electrified to perform initialization operation to acquire respective redundant master-slave default state settings;

when the default is set as the slave state, the controller sets the local side as the initial slave state through delay;

when the default is set to be in a host state, the local side is set to be in an initial slave state immediately without delay;

after entering the initial slave state, the controller sends a heartbeat message to the opposite side through a state redundancy link;

when the heartbeat message is not replied after continuous timeout, the controller enters a host state;

when the heartbeat message is replied to the opposite-side host, the controller keeps the slave state.

4. A method of redundant operation of an industrial process controller according to claim 3 wherein:

after confirming the state of the master controller and the slave controller, the slave controller periodically transmits heartbeat messages to the master controller through a state redundant link, and the master controller replies the heartbeat messages to the slave controller after receiving the heartbeat messages;

the heartbeat message comprises a local side fault grade, a forced switching mark and a master-slave state mark;

the fault grade is appointed for a specific fault type, when the main controller fails, the fault grade of the main controller is set to be a corresponding appointed value, and a heartbeat reply message is sent to the slave.

5. A method of redundant operation of an industrial process controller according to claim 4 wherein:

the master-slave active lifting logic of the host offline slave specifically comprises the following steps:

and continuously receiving the heartbeat reply message from the controller until the heartbeat reply message is overtime, indicating that the host is offline, switching the host from the local side of the controller, and continuously transmitting the message for forcibly switching the opposite side into the slave.

6. A method of redundant operation of an industrial process controller according to claim 4 wherein:

the slave machine judging fault level active rising master logic is matched with the application logic to realize that the slave machine judges the fault level active rising master, and specifically:

the application logic is as follows: receiving a contralateral fault grade in a heartbeat reply message from a controller and comparing the contralateral fault grade with the local fault grade;

the slave judges that the failure level actively rises the master logic as follows: when the failure level of the opposite side in the heartbeat reply message received from the controller is continuously higher than the failure level of the local side, the local side is switched to the host computer, and then the message for forcibly switching the opposite side to the slave computer is continuously sent; and the host sets the message as the slave immediately after receiving the message for switching the host to the slave.

7. A method of redundant operation of an industrial process controller according to claim 4 wherein:

the host machine receives the tool command to force the master-slave switching logic, specifically:

after receiving a master-slave switching command from the debugging tool side, the master controller sets a forced switching flag bit when replying a heartbeat message at the time;

the slave controller receives a forced switching flag bit in the heartbeat message, the slave controller switches the slave to the master, and then continuously sends a message for enabling the opposite side to be forcibly switched to the slave;

and the host sets the message as the slave immediately after receiving the message for switching the host to the slave.

8. A method of redundant operation of an industrial process controller according to claim 1 wherein:

the configuration redundancy logic comprises slave power-on synchronous configuration logic and online update configuration logic;

the slave power-on synchronous configuration logic specifically comprises:

after the controller is powered on and initialized to run and is determined to be a slave machine through redundancy state negotiation, a configuration information request message is initiated to a host machine through a configuration redundancy link;

after the slave acquires the check code of the configuration information of the host, the check code is compared with the local configuration information, the configuration synchronization is finished when the check information is consistent, and the configuration file is started when the check information is inconsistent.

9. A method of redundant operation of an industrial process controller according to claim 8 wherein:

the online update configuration logic specifically comprises:

when the debugging tool is connected with the main controller and issues an online updating configuration command, the main machine downloads an updating message and forwards the updating message to the auxiliary machine through a configuration redundancy link, and the auxiliary machine updates a local configuration file after receiving the downloading updating message;

wherein the debug tool establishes a connection only with the current host controller and issues an online update configuration command to the host controller when online update configuration is required.

10. A method of redundant operation of an industrial process controller according to claim 1 wherein:

the data redundancy logic specifically comprises:

dividing the controller task into a periodic task, a free task, a state triggering task and an event triggering task;

the method comprises the steps that a controller initializes a periodic task or a free task with highest priority level to be selected as a task with highest priority level when running; when the highest priority level of the periodic task and the free task is set to be the same, selecting the periodic task as the task with the highest priority level;

and the master controller sends a data synchronization message through a data redundancy link before executing the task with the highest priority, and updates local data and executes the task with the highest priority after receiving the data synchronization message from the controller.

11. A method of redundant operation of an industrial process controller according to claim 10 wherein:

the task redundancy logic specifically comprises:

the task synchronization and the data redundancy of the highest priority are realized based on the data redundancy logic combination;

the master controller sends a task synchronous command through a task redundant link before the task with the non-highest priority is executed, and the corresponding task is executed after receiving the task synchronous command from the controller.

12. An industrial process controller redundant operating system for implementing the method of any one of claims 1-11, wherein:

the system includes two industrial process controllers and a redundant ethernet network;

each controller is provided with a state redundancy module, a configuration redundancy module, a data redundancy module and a task redundancy module which are respectively used for executing state redundancy logic, configuration redundancy logic, data redundancy logic and task redundancy logic;

the redundant Ethernet is provided with a state redundant link, a configuration redundant link, a data redundant link and a task redundant link;

the state redundancy module, the configuration redundancy module, the data redundancy module and the task redundancy module independently operate, each of which adopts independent threads to complete related logic tasks, and each of which adopts state redundancy links, configuration redundancy links, data redundancy links and task redundancy links to exchange data.

13. An industrial process controller redundant operating system according to claim 12 wherein:

the two industrial process controllers are identical and are interconnected by physical links A and B of the redundant Ethernet network;

the base of the controller is provided with a hardware dial module which is used for manually setting one side to default to be a master controller and the other side to default to be a slave controller;

the redundant state result negotiated by the state redundant module can be accessed by other modules to participate in the operation logic of the other modules; meanwhile, the state redundancy modules also exchange the running states of the two sides;

the state redundant links alternately use the physical links A, B to send data, and when the response data sent by the physical links A or B are not received continuously, the corresponding physical links are judged to be disconnected;

the configuration redundant link, the data redundant link and the task redundant link adopt physical links communicated by state redundant link detection to transmit data.

14. A terminal comprising a processor and a storage medium; the method is characterized in that:

the storage medium is used for storing instructions;

the processor being operative according to the instructions to perform the steps of the method according to any one of claims 1-11.

15. Computer readable storage medium, on which a computer program is stored, characterized in that the program, when being executed by a processor, implements the steps of the method according to any of claims 1-11.