CN101815009B - Hot backup synchronizing method supporting fault tolerance - Google Patents

Abstract

A fault-tolerant hot standby synchronization method is characterized in that it includes selecting an irrelevant hot standby synchronization signal generating device, adopting a one-way synchronization signal channel, and making the signal channel between the synchronization signal generating device and the synchronized device be from One direction from the generating device to the synchronized device, that is, there is only the output port of the channel on the synchronization signal generating device, and only the input port of the channel on the synchronized device; and the main and standby synchronization signal channels are physically separated; the synchronized device can Error detection and switching, so that the synchronized device is supported by the local clock, and the accuracy of the local clock must be higher than the error accuracy of the synchronization signal. The invention enhances the reliability of the system, improves the maintainability and immunity of the system, and improves the operability at the same time.

Description

Support fault-tolerant hot standby synchronization method

technical field

The present invention relates to an automatic control method, especially a multi-equipment synchronous control technology, in particular to a mechanism commonly used in rail transit equipment to achieve a synchronous source signal by adding a voting mechanism for irrelevant hot standby synchronous signals. A fault-tolerant hot standby synchronization method for fault-tolerant purposes.

Background technique

As we all know, in the field of automatic control, some systems require multiple devices to work synchronously, and have high reliability and maintainability requirements for the synchronization mechanism. Therefore, a variety of synchronization mechanisms have been developed: single signal source synchronization, phase-locked transmission signal synchronization step by step, mutual phase-locked hot standby synchronization signal sources, etc. However, the requirements for the control system involving personal safety are more stringent. In addition to the above requirements, high safety and fault tolerance of single point of failure are also required. A signal source failure in a single signal source synchronization mechanism will directly cause the system to fail to work normally; the mechanism of using the daisy chain phase-locked phase-locked transmission of synchronization signals generates dependencies among synchronized devices, which reduces reliability and availability; interrelated hot standby The synchronization signal of the synchronization signal generating device will transmit common mode faults, which greatly reduces the error detection capability of the system. Therefore, the main and backup synchronization signal sources need to be as irrelevant as possible, but the phase difference of the synchronization signals caused by the irrelevance and the fault tolerance to the failure of the main and backup synchronization signal sources are problems that need to be solved.

Contents of the invention

The purpose of the present invention is to provide a fault-tolerant hot backup synchronization method for the problem of low error detection capability in the existing hot backup synchronization method, which can detect errors generated by irrelevant master and backup signal sources, and detect errors in a single It can continue to work after an error occurs, and has good fault tolerance and availability, and the irrelevant hot standby synchronization signal generation device brings higher reliability and maintainability.

Technical scheme of the present invention is:

A fault-tolerant hot standby synchronization method is characterized in that it comprises the following steps:

First, select an irrelevant hot standby synchronization signal generating device, which should meet the following conditions:

(1) The main and backup synchronization signal generators are physically separated, especially the power supply and grounding should be isolated;

(2) The synchronization time intervals of the synchronization signals sent by the master and backup synchronization signal generators are the same, and the error precision is the same;

(3) The maximum value of the phase difference range between the synchronization signals sent by the main and backup synchronization signal generating equipment can be determined;

Secondly, a unidirectional synchronization signal channel is adopted, and the signal channel between the synchronization signal generating device and the synchronized device is unidirectional from the generating device to the synchronized device, that is, there is only the output port of this channel on the synchronization signal generating device , the synchronized device only has the input port of this channel; and the main and standby synchronization signal channels are physically separated;

Finally, enable the synchronized device to perform error detection and switching, so that the synchronized device is supported by the local clock. The accuracy of the local clock must be higher than the error accuracy of the synchronization signal. The following steps should be followed:

(1) The main synchronization signal counting step: when the main synchronization signal arrives, the local clock starts counting; when the main synchronization signal arrives again, record the local clock count value and restart counting after clearing;

(2) Prepare the counting step of the synchronization signal: the local clock starts counting when the preparation synchronization signal arrives; when the preparation synchronization signal arrives again, record the count value of the local clock and restart counting after clearing;

(3) Analysis and switching steps: set the synchronization error tolerance threshold, and analyze the clock count values of the main and backup signals in each synchronization cycle: when the count value of the main synchronization signal is too large or too small and exceeds the error tolerance threshold, at the same time The count value of the standby synchronization signal is normal, and the analysis result shows that the equipment or signal channel of the main synchronization signal is faulty. The equipment switches to the standby synchronization signal and continues to work. is too small and exceeds the error tolerance threshold, and the count value of the main synchronization signal is normal. The analysis result shows that the device or signal channel of the standby synchronization signal is faulty, and the device continues to work but the working state is a single synchronization signal state (that is, it cannot be used when the main synchronization signal fails again). Switch to the synchronized signal and need to enter the exception handling), the alarm prompts to repair the equipment and signal channel of the synchronization signal generating device; when the count values of the main and standby synchronization signals are too large or too small and exceed the error tolerance threshold, the analysis result is that the synchronized equipment If the local clock fails or both the primary and backup synchronization signals fail (the failure of the primary and backup synchronization signals at the same time is a small probability event), the synchronized device enters abnormal processing and alarms for maintenance.

Beneficial effects of the present invention:

1. The synchronous signal generating equipment of hot standby enhances the reliability of the system;

2. The synchronous signal generating equipment that can be replaced separately improves the maintainability of the system;

3. The one-way synchronization channel prevents the failure of the synchronized device from causing a device error in the synchronization signal, which in turn leads to the failure of the entire system. Therefore, the immunity of the synchronous signal generating equipment is improved;

4. The single-fault-tolerant mechanism of the synchronized device improves the availability of the system.

Detailed ways

The present invention will be further described below in conjunction with embodiment.

A fault-tolerant hot standby synchronization method includes selecting irrelevant hot standby synchronization signal generating equipment, adopting a one-way synchronization signal channel and enabling the synchronized equipment to have error detection and switching functions.

The irrelevant hot standby sync signal generator includes the following:

(1) The main and standby two synchronous signal generating devices are physically separated, and it is recommended that the power supply and grounding should also be isolated;

(2) The synchronization time intervals of the synchronization signals sent by the master and backup synchronization signal generators are the same, and the error precision is the same;

(3) The maximum value of the phase difference range between the synchronization signals sent by the main and backup synchronization signal generating equipment can be determined;

The one-way synchronous signal channel means that the signal channel between the synchronous signal generating device and the synchronized device is unidirectional from the generating device to the synchronized device, that is, there is only the output port of this channel on the synchronizing signal generating device, and the synchronized device Only the input port for that channel. And the main and standby synchronous signal channels are separated physically.

The error detection and switching functions of the synchronized device need to be supported by the local clock of the synchronized device, and the precision of the local clock must be higher than the error precision of the synchronization signal. The error detection and switching functions are realized according to the following steps:

1) Main synchronization signal counting steps: when the main synchronization signal arrives, the local clock starts counting; when the main synchronization signal arrives again, record the count value of the local clock and restart counting after being cleared.

2) Counting steps of the standby synchronization signal: when the standby synchronization signal arrives, the local clock starts counting; when the standby synchronization signal arrives again, record the count value of the local clock and restart counting after being cleared.

3) Analysis and switching steps: set the synchronization error tolerance threshold, and analyze the clock count values of the main and backup signals in each synchronization cycle: when the count value of the main synchronization signal is too large or too small and exceeds the error tolerance threshold, the simultaneous backup The count value of the synchronization signal is normal. The analysis result shows that the device or signal channel of the main synchronization signal is faulty. The device switches to the standby synchronization signal to continue working. is small and exceeds the error tolerance threshold, and the count value of the main synchronization signal is normal. The analysis result shows that the equipment or signal channel of the standby synchronization signal fails, and the equipment continues to work, but the working state is a single synchronization signal state (that is, it cannot switch when the main synchronization signal fails again. Synchronized signal needs to enter into abnormal processing), the alarm prompts to repair the equipment and signal channel of the synchronization signal generating device; when the count value of the main and standby synchronization signal is too large or too small and exceeds the error tolerance threshold, the analysis result is the local synchronization signal of the synchronized device. If the clock fails or both the master and backup synchronization signals fail (the failure of the master and backup synchronization signals at the same time is a small probability event), the synchronized device enters abnormal processing and alarms for maintenance.

The following is a concrete example.

Firstly, the synchronous signal generating equipment, signal channel and synchronized equipment of the system are constructed according to the content of the invention. Define the main synchronization signal generator as SD1, the standby synchronization signal generator as SD2, the main synchronization signal channel as Ch1, and the standby synchronization signal channel as Ch2. Assume that the system has two synchronized devices DA and DB. The DA device is responsible for the main synchronization signal. The local count value of the DA device is CntA1, the local count value of the DA device for the standby sync signal is CntA2, the local count value of the DB device for the master sync signal is CntB1, the local count value of the DB device for the master sync signal is CntB2, and the standard sync count value is Cnt, the predefined tolerance threshold is dCnt.

When the system synchronization is normal: SD1 and SD2 work normally; on the DA device |CntA1-Cnt|<dCnt, |CntA2-Cnt|<dCnt; on the B device |CntB1-Cnt|<dCnt, |CntB2-Cnt|< dCnt.

When SD1 or Ch1 fails: on the DA device |CntA1-Cnt|>dCnt, |CntA2-Cnt|<dCnt; on the DB device |CntB1-Cnt|>dCnt, |CntB2-Cnt|<dCnt. The analysis result is: the main synchronization signal fails. Both DA and DB are switched to standby synchronous signal to continue working, and alarm and overhaul SD1 and Ch1.

When SD2 or Ch2 fails: on the DA device |CntA1-Cnt|<dCnt, |CntA2-Cnt|>dCnt; on the DB device |CntB1-Cnt|<dCnt, |CntB2-Cnt|>dCnt. The analysis result is: the standby synchronization signal fails. Both DA and DB continue to work, and alarm and overhaul SD2 and Ch2.

When the local clock of the DA device fails: |CntA1-Cnt|>dCnt, |CntA2-Cnt|>dCnt on the DA device; |CntB1-Cnt|<dCnt, |CntB2-Cnt|<dCnt on the DB device. The analysis result is: local clock failure. The DA device enters abnormal processing and alarms for maintenance, and the DB device continues to work normally. Similarly, analyze the situation when the local clock of the DB device fails.

Simultaneous failure of SD1 or Ch1 and SD2 or Ch2 is a small probability event. When it occurs: on the DA device |CntA1-Cnt|>dCnt, |CntA2-Cnt|>dCnt; on the DB device |CntB1-Cnt|>dCnt, |CntB2-Cnt|>dCnt. The result of the analysis is that both the master and backup synchronization signals fail. The system enters exception handling and alarms for system-level maintenance.

The parts not involved in the present invention are the same as the prior art or can be realized by adopting the prior art.

Claims (1)

1. support fault-tolerant hot backup synchronizing method for one kind, it is characterized in that it may further comprise the steps:

At first, select irrelevant heat to be equipped with synchronizing signal generation equipment, this equipment should meet the following conditions:

(1) active and standby two synchronizing signal generation equipment physically separate;

(2) the synchronizing signal synchronization of time intenals unanimity sent of active and standby synchronizing signal generation equipment, error precision is identical;

(3) the phase range maximum between the synchronizing signal sent of active and standby synchronizing signal generation equipment can be determined;

Secondly, adopt unidirectional sync channel signal, and make synchronizing signal generation equipment and be to unidirectional from generation equipment by synchronizer by the signalling channel between the synchronizer, the output port that promptly has only this passage on synchronizing signal generation equipment is had only the input port of this passage by synchronizer; And active and standby sync channel signal physically separates;

At last, make by synchronizer and carry out error detection and switching, make by synchronizer and obtain the local clock support, the local clock precision need be higher than the synchronizing signal error precision, should carry out according to the following steps:

(1) master sync signal counting step: local clock began counting when master sync signal arrived; Master sync signal restarts counting after writing down local clock count value and zero clearing when arriving once more;

(2) be equipped with the synchronizing signal counting step: local clock begins counting when being equipped with the synchronizing signal arrival; Restart counting after writing down local clock count value and zero clearing when synchronizing signal arrives once more fully;

(3) analysis and switch step: set timing error tolerance threshold value, in each synchronizing cycle the clock count value of active and standby two signals is analyzed: excessive or too small and surpass the fault tolerant threshold value when the master sync signal count value, it is normal to be equipped with the synchronizing signal count value simultaneously, analysis result is master sync signal generation equipment or signalling channel fault, equipment switches to fully that synchronizing signal works on, alarm prompt maintenance master sync signal generation equipment and signalling channel; Excessive or too small and surpass the fault tolerant threshold value when being equipped with the synchronizing signal count value, the master sync signal count value is normal simultaneously, analysis result is to be equipped with synchronizing signal generation equipment or signalling channel fault, equipment works on but operating state is single synchronizing signal state, and the alarm prompt maintenance is equipped with synchronizing signal generation equipment and signalling channel; All excessive or too small and surpass the fault tolerant threshold value when active and standby synchronizing signal count value, analysis result is that this was all lost efficacy by synchronizer local clock fault or active and standby synchronizing signal, and this is entered abnormality processing by synchronizer, and the alarm maintenance.