CN114442523A - Control method of distributed redundant control system actuator - Google Patents

Abstract

The invention discloses a control method of a distributed redundancy control system actuator, which comprises the following steps: the master executor broadcasts a first command or first data; if the main actuator broadcasts the first command, all actuators obtain an execution result based on the first command, and the execution result is used as a first result; if the main actuator broadcasts the first data, all actuators compare the received first data with the newly added data of the actuators, and the comparison result is used as a first result; each executor broadcasts a first result to other executors, and all executors vote respectively based on the received first results; and the main executor collects the voting result and judges whether the voting passes or not, and if the voting passes, the first result is taken as a final execution result. The control method of the actuator of the distributed redundancy control system provided by the invention enables the system to run more stably and safely by voting and election of the actuator.

Description

A kind of control method of distributed redundant control system actuator

technical field

The invention relates to a control system executor applied in the field of industrial control, in particular to a control method of a distributed redundant control system executor.

Background technique

In the field of industrial control, people have very high requirements for the security and reliability of industrial software. As a software that directly controls the control system, the safety and reliability of the control system actuator directly affects the safety production of the entire workshop and even the entire project. Actuators running independently may be offline, faulty and other unavailable states due to network environment, equipment status, and human factors, thus affecting production.

The commonly used technical solution of master-slave redundancy at present realizes the stable and safe operation of the actuators of the control system. The operating data is kept synchronized on the two actuators of the master and slave, and the switch is made according to the judgment of a third party when an abnormality occurs.

However, with the above-mentioned master-slave redundancy technical solution, it is inevitable to rely on a third party for adjudication, which will lead to failure when the third party loses contact or fails. On the other hand, using the database to run data synchronously means that the data is generated by the master executor. When the data source connected to the master executor is unstable or the master executor is attacked, the slave executor cannot provide verification or error correction functions.

SUMMARY OF THE INVENTION

In order to improve the stability and safety of the actuator, the present invention provides a reliable and safe control method for the actuator of the distributed redundant control system. By voting and electing the execution result of the distributed redundant control actuator, It can make the actuator of the control system run more stably and safely, and improve the anti-interference ability and robustness of the actuator.

The technical solution adopted by the present invention to overcome its technical problems is: a method for controlling actuators in a distributed redundant control system, which is applied to a control system including at least three actuators, wherein the actuators include at most one main actuator. It includes: the master executor broadcasts the first command or the first data; if the master executor broadcasts the first command, all the executors in the system obtain the execution result based on the first command, and Take the execution result as the first result; if the main executor broadcasts the first data, all the executors in the system compare the received first data with their own newly added data, and use the comparison result as the first result; each execution The executor broadcasts the first result to other executors respectively, and all executors vote based on the received first result; the main executor collects the voting results, and judges whether the vote is passed based on the voting results. A result as the final execution result.

The first command is used for distributed execution of the actuators of the distributed redundant control system, and the first data is used for data synchronization.

Further, if the voting result is passed, it also includes increasing the weight of the executors that voted.

The weights of executors affect the outcome of elections and voting.

Further, if an exception occurs in the master executor, the slave executor is changed to a candidate executor based on the detected exception, and the election of the master executor is re-initiated.

Further, the slave executor is changed to a candidate executor based on the detected abnormality, and the election of the master executor is re-initiated, which specifically includes: the candidate executor initiates the election of the master executor after the term ID is auto-incremented, and for itself Vote, and collect the voting results after broadcasting the voting request; determine whether it has won the election based on the collected voting results; if the election is successful, the new master executor publishes the election winning and term ID, and the remaining executors become slave executors; if the election is successful If it fails, the candidate executor re-initiates the election of the main executor at a preset time interval.

Further, if the master executor returns to normal during the election process, it becomes a candidate executor to participate in the election of the master executor. If the master executor returns to normal after electing a new master executor, it becomes a slave executor. .

Further, if the main executor broadcasts the first command, it also includes the main executor writing the final result to the controller.

Further, if the main executor broadcasts the first data, it also includes that all executors write the final result into the database or cache.

Further, all executors vote based on the received first result, which specifically includes: all executors collect the execution results of other executors, and the corresponding weight of each executor. The execution result is ignored. If the weight of the executor cannot be collected, the weight collected last time is used; if the ratio of the collected weight of the executor that matches the result to the total weight is greater than the first preset Actuator voted.

Further, the main executor collects the voting results, and judges whether the voting is passed based on the voting results, which specifically includes: if the main executor collects the votes of all executors, if the ratio of the number of votes to the total number of votes is greater than the second pre-determined number of votes. If the threshold is set, the voting result is judged to pass.

Further, if the voting result fails, the main executor broadcasts the first command or the first data repeatedly.

The beneficial effects of the present invention are:

1. The control system actuator adopts a more flexible distributed redundant architecture, so that each actuator participates in the execution process under normal circumstances, thus providing better data reliability, security and robustness. .

2. Through the election and voting of the executor, the execution of the executor is more reliable and safe.

Description of drawings

1 is a flowchart of a method for controlling an actuator of a distributed redundant control system according to an embodiment of the present invention;

2 is a schematic flowchart of a distributed execution method for an executor of a distributed redundant control system according to an embodiment of the present invention;

3 is a schematic flowchart of a data synchronization method for an executor of a distributed redundant control system according to an embodiment of the present invention;

FIG. 4 is a schematic flowchart of a method for electing an executor of a distributed redundant control system according to an embodiment of the present invention.

Detailed ways

In order to facilitate those skilled in the art to better understand the present invention, the present invention will be described in further detail below with reference to the accompanying drawings and specific embodiments. The following are only exemplary and do not limit the protection scope of the present invention.

Before describing the technical solution of the actuator of the distributed redundant control system of the present invention, some proper terms related to this solution are first explained:

Distributed: Distributing a system across multiple computers for higher performance and better reliability

Redundancy: A backup system provided for safety and reliability requirements, usually with hot-swap capability

Actuator: A piece of hardware or software that executes a process or logic. It is located at the upper level of the control system and has the ability to directly control the control system. Its function can be expressed as: executor (previous state, event) = next state.

State: The state of the system in particular, usually a system can be described by a state model.

In order to facilitate those skilled in the art to better understand the present invention, the present invention will be described in further detail below with reference to the accompanying drawings and specific embodiments. The following are only exemplary and do not limit the protection scope of the present invention.

As shown in FIG. 1 , a method for controlling an actuator of a distributed redundant control system proposed by the present invention is applied to a control system including at least one master actuator and two slave actuators. The distributed redundant control system executes The control method of the executor specifically includes: the main executor broadcasts the first command or the first data, if the main executor broadcasts the first command, all the executors in the system execute the command to obtain the execution result based on the first command, and use the execution result as the first command. One result: if the main executor broadcasts the first data, all the executors in the system compare the received first data with their own newly added data, and use the comparison result as the first result. Each executor broadcasts the first result to other executors, and all the executors vote respectively based on the received first result. The main executor collects the voting results, and judges whether the voting is passed based on the voting results. If the voting results are passed, the first result is used as the final execution result.

In some embodiments, the first command is used for the control method for distributed execution of the executors, and the first data is used for the control method for the executors to perform data synchronization.

The following describes the control method for distributed execution of the distributed control system as shown in FIG. 2 . The distributed redundant control system includes a master executor and three slave executors, which are slave executor 1 and slave executor 2 respectively. and slave executor 3. The main executor executes the command a. After the command a starts to be executed, the main executor broadcasts to start executing the command a, so that all the executors receive the command a. After each executor receives the command a, it reads the program data and the control program, tries to execute the command a, and broadcasts the execution result obtained by the attempt to the system. As shown in Figure 2, the execution result obtained by the master executor trying to execute is the result A, the execution result obtained by the slave executor 1 is the result A, the execution result of the slave executor 2 is A, and the execution result of the slave executor 3 is B.

In some embodiments, since different executors may be connected to different data sources, and different data sources have different data read and write permissions, different executors have different execution results for the same execution command.

In other embodiments, the executor may have different results due to network status, data delay, etc., and it is not excluded that the executor has abnormal results.

Each executor broadcasts the execution result to other executors, and all executors vote whether the execution result A of the main executor is correct based on the collected execution results and weights. The main executor collects the results and judges whether the vote is passed. If it fails, execute command a again and repeat the above process. If it passes, collect the final execution result A and complete the subsequent control by the main executor, as shown in Figure 2. of the write controller or database. If it does not pass, the process of returning to the main executor to start executing the command restarts the distributed execution.

即符合结果的执行器权重之和除以总权重之和大于等于0.5，则投通过票。如果存在未能及时收集到执行器的结果，则将其即为空，如果未能及时收集到执行器的权重，则使用上一次收集到的权重。In some implementations, the results R of all executors and the corresponding execution weight p are collected before the executors vote, and the requirement for passing the vote is:

That is, if the sum of the weights of the actuators that meet the results divided by the total weights is greater than or equal to 0.5, the vote is passed. If there is a result that the executor cannot be collected in time, it will be empty. If the weight of the executor cannot be collected in time, the weight collected last time will be used.

In some implementations, if the number of approved votes collected by the main executor is greater than half of the total number of votes, it is determined that the vote is passed, and the result of the previous attempted execution is converted into the actual execution result.

In some implementations, for all executors that voted, their corresponding execution weights are increased. In the embodiment of the present invention, since the slave executor 1 and the slave executor 2 cast a pass vote for the execution result of the master executor, A, the slave executor 1 and the slave executor 2 increase the execution weight.

In some embodiments, if there are multiple executions or if the execution fails for a long time, the execution weight of the main executor is lowered, demoted to a candidate, and the election is re-initiated.

The control method of the actuator of the distributed redundant control system of the present invention is also suitable for data synchronization. The data synchronization method of the distributed redundant control system will be described below with reference to FIG. 3 .

The data of the controller is directly read by each actuator, and there is no synchronization problem involved. However, in some cases, for example, after the step execution ends, after a special event is triggered, the state of the executor changes, and the executor needs to synchronize the data of the currently executing program. Data synchronization starts at command execution

In some embodiments, the executor needs data of the synchronously executed program, such as variables, parameters, timers, triggers, and the like.

The process of data synchronization is triggered by the main executor. As shown in FIG. 3 , the main executor first increments the transaction ID, calculates the first data, and broadcasts the first data.

Among them, the transaction ID represents the order of data update, and the executor records the transaction ID to prevent data loss in some cases. The first data is the data change between the two transaction IDs, that is, the newly added data in FIG. 3 .

The slave executor compares the received new data with the data changes between its two transaction IDs, and determines whether its own data changes match the new data. Slave executors 1 and 2 vote to the master executor by comparing the data results. The main executor collects the voting results and decides whether to pass the vote. If not, it returns to the transaction ID auto-increment process shown in Figure 3 to start the synchronization again. If it passes the vote, the collected final result is sent to all executors, and the executors then perform data synchronization and write the final result to the database and data cache.

As shown in Figure 3, the slave executors 1 and 2 participate in the data synchronization, but the slave executor 3 does not participate in the data synchronization process due to the abnormal state before. Therefore, the process of comparing data and voting has not been carried out.

In the embodiment shown in FIG. 3 , since the newly added data of the slave executor 1 matches its own data changes, it casts a pass vote to the master executor, while the slave executor 2 compares the newly added data and does not conform to its own data. If the change is changed, a vote of rejection is cast to the main executor.

It should be noted that a certain error is allowed when matching, and it is considered to be consistent within the error range. Executors that voted boost data weight. If it is executed multiple times or fails for a long time, the data weight of the main executor will decrease, and it may be downgraded to a candidate executor, triggering a re-election.

The election process is shown in Figure 4. In the distributed redundant control system, if the main executor is offline, or the main executor cannot complete the distributed execution or data synchronization tasks for many times or for a long time, the main executor is degraded, such as The master executor shown in Figure 4 is faulty, and the slave executor 1 and slave executor 2 detect that the master executor times out or the master executor fails, and then upgrade to a candidate executor, and slave executor 3 may not detect the master executor yet. If the executor fails, it does not participate in the process of initiating election voting.

Candidate executor 1 and candidate executor 2 auto-increment the term ID. The candidate executor first votes for itself, broadcasts voting requests from other executors, and sends weights to other slave executors. As shown in FIG. 4 , the sending weight of candidate executor 1 is P=1.1, and the sending weight of candidate executor 2 is P=1.8, and the voting results are collected.

The candidate executor determines whether it wins the election through the collected voting results. Since in the embodiment of the present invention, the slave executor 3 votes for the candidate executor 2, then the candidate executor 2 successfully becomes the main executor, and the candidate executor 1 fails. Waiting for the election results. The candidate executor that becomes the master executor publishes the election result and updates the term, and the remaining executors receive the updated term, indicating that the original slave executor 2 has become the master executor, then the remaining executors, regardless of whether they were candidate executors before. Whether it is a slave executor or a master executor, it will become a new slave executor.

If all candidate executors fail to win the election, after a period of time, the candidate executor re-initiates voting. A candidate executor who obtains more than half of all votes is deemed to have won the election;

It should be noted that the voting request of candidate executor 1 and candidate executor 2 is received from executor 3 within a short receiving time. Since candidate executor 2 has a higher weight, candidate executor 2 is voted for.

In some embodiments, the weight in the election is determined jointly by the data weight and the execution weight, and the smaller value of the two can also be used as the weight in the election. The weight is initially 1 and the lowest is 1, and the highest weight will not exceed the total number divided by two. Weight P=N/πarctan(M), where N is the number of executors, and M is the number of successful operations in the past 20 times.

It should be noted that: in other embodiments, the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification. In some other embodiments, the method may include more or fewer steps than described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may also be combined into a single step in other embodiments. describe.

The above only describes the basic principles and preferred embodiments of the present invention, and those skilled in the art can make many changes and improvements based on the above description, and these changes and improvements should belong to the protection scope of the present invention.

Claims (10)

1. A method for controlling an actuator of a distributed redundant control system, characterized in that it is applied to a control system comprising at least three actuators, wherein the actuators include at most one main actuator and no less than two From the executor, the control method of the executor of the distributed redundant control system specifically includes: The main executor broadcasts the first command or the first data; If the main executor broadcasts the first command, all the executors in the system obtain the execution result based on the first command, and use the execution result as the first result; If the main executor broadcasts the first data, all the executors in the system compare the received first data with their own newly added data, and use the comparison result as the first result; Each executor broadcasts the first result to other executors respectively, and all executors vote respectively based on the received first result; The main executor collects the voting results, and judges whether the voting is passed based on the voting results. If the voting is passed, the first result is used as the final execution result. 2 . The method for controlling the actuators of the distributed redundant control system according to claim 1 , wherein if the voting result is passed, the method further comprises increasing the weight of the actuators that passed the vote. 3 . 3. The method for controlling an executor of a distributed redundant control system according to claim 1, further comprising, if an abnormality occurs in the main executor, changing the slave executor to a candidate executor based on the detected abnormality, And re-initiate the election of the master executor. 4. The method for controlling an executor of a distributed redundant control system according to claim 3, wherein the slave executor is changed to a candidate executor based on the detected abnormality, and the election of the master executor is re-initiated, Specifically include: The candidate executor initiates the election of the main executor after the term ID is incremented, and votes for itself, and collects the voting results after broadcasting the voting request; Determine whether it won the election based on the results of the votes collected; If the election is successful, the new master executor publishes the ID of winning the election and the term, and the rest of the executors turn into slave executors; If the election fails, at a preset time interval, the candidate executor re-initiates the election of the main executor. 5. the control method of the distributed redundant control system executor according to claim 4 is characterized in that, if the main executor returns to normal in the election process, then it becomes the candidate executor to participate in the election of the main executor, If the master executor returns to normal after electing a new master executor, it becomes a slave executor. 6 . The method for controlling the actuators of the distributed redundant control system according to claim 1 , wherein if the main executor broadcasts the first command, it further comprises that the main executor writes the final result to the controller. 7 . 7 . The method for controlling the executors of a distributed redundant control system according to claim 1 , wherein if the main executor broadcasts the first data, it further comprises that all executors write the final result into a database or a cache. 8 . 8. The method for controlling the actuators of a distributed redundant control system according to claim 1, wherein all actuators vote based on the received first result, specifically comprising: All executors collect the execution results of other executors and the corresponding weight of each executor. If the execution result of the executor cannot be collected, it will be ignored. If the weight of the executor cannot be collected, then Use the weights collected last time; If the ratio of the collected executor weights that meet the results to the total weights is greater than the first preset threshold, the executor votes. 9. The method for controlling an executor of a distributed redundant control system according to claim 1, wherein the main executor collects voting results, and judges whether the voting is passed based on the voting results, specifically comprising: if the main executor After the votes of all actuators are collected, if the ratio of the number of votes to the total number of votes is greater than the second preset threshold, the voting result is judged to be passed. 10. The method for controlling an actuator of a distributed redundant control system according to any one of claims 1 to 9, wherein if the voting result fails, the main actuator broadcasts the first command or the first data repeatedly. .

Images