CN102073284B - Dual-computer redundant embedded control system suitable for nuclear industrial robot - Google Patents

Abstract

The invention discloses a dual-machine redundant embedded control system suitable for nuclear industry robot control. The dual-machine redundant control system includes a host computer (100) with PC 104 as the main controller and a computer with ARM9E as the controller. The backup machine (200), the main machine (100) and the backup machine (200) are installed on the nuclear industrial robot, and realize electrical signal connection with the robot drive control module (400) through the 485 bus; the nuclear industrial robot is connected with the upper computer (300 ) to realize instruction information transmission. In the dual-machine redundant control system designed by the present invention, each module is provided with a state detection command, and the state information is continuously sent to the upper computer during the program operation process, so that the operating state of each module can be judged by the different state information returned by each module , once a fault occurs, the fault location can be accurately judged. Since the location of the fault can be located more accurately, it can provide a better method for the robot to make decisions after the fault, and at the same time provide important reference information for the robot to return to repair, so as to avoid the same fault in the future.

Description

A dual-machine redundant embedded control system suitable for nuclear industry robots

technical field

The present invention relates to an activation control system of a nuclear industrial robot, more particularly, a control system for activation and control of a nuclear industrial robot with a dual-machine redundant embedded control system.

Background technique

my country's nuclear industry is a national strategic industry. Because the nuclear radiation and radioactive substances involved in the nuclear industry are very dangerous, it is also a very special industry. A large number of operations in my country's nuclear industry and emergency response to nuclear incidents require quantitative measurement of radiation sites and determination of the scope of pollution sources, and even direct contact with nuclear radioactive materials. Nuclear facility pollution sites often have strong radiation fields, conventional protective measures are difficult to implement or the protective effect is extremely limited after implementation, and it is difficult for personnel to approach, which causes great difficulties for investigation site measurement and radioactive pollution treatment. It is urgent to use mobile robot systems to carry relevant The device replaces the staff to complete the relevant radiation detection and operation at close range in the radiation site to ensure the health and safety of the staff.

In this case, according to the characteristics of the nuclear industry, it is particularly necessary and urgent to develop a practical system for nuclear radiation detection and emergency treatment robots. Due to the particularity of nuclear industrial sites, higher requirements are put forward for the reliability and stability of nuclear industrial robots. On the one hand, due to the great danger of nuclear radiation and radioactive substances involved in nuclear industrial sites, once a robot fails, it is difficult for staff to retrieve the robot; on the other hand, nuclear industrial robots work in a nuclear radiation environment, which is a harsh industry The environment and nuclear radiation are highly disturbing and destructive to the robot control system and its navigation sensor device, and are prone to unpredictable accidents.

Contents of the invention

Because the nuclear radiation and radioactive substances involved in the nuclear industry are very dangerous, nuclear industry robots can replace workers to complete relevant inspections and operations at close range in radiation sites. In order to ensure the higher reliability and stability of nuclear industry robots, the present invention designs a dual-machine redundant embedded control system suitable for nuclear industry robots with PC 104 as the main controller and ARM9E as the backup controller (below The description is referred to as dual-machine redundant control system). The dual-machine redundant control system can not only transfer the control right when the main machine and the backup machine fail, but also detect the location of the failure, which ensures the normal operation of the nuclear industrial robot and improves the reliability of the nuclear industrial robot and stability.

A kind of dual-machine redundant embedded control system applicable to the nuclear industry robot of the present invention, this dual-machine redundant control system includes the main frame (100) with PC 104 as the main controller and the backup machine with ARM9E as the controller (200), the main machine (100) and the backup machine (200) are installed on the nuclear industrial robot, and realize the electrical signal connection with the robot drive control module (400) through the 485 bus; instruction information transmission; the backup machine (200) starts to enter the working state when the main machine (100) breaks down;

The host computer (100) is divided into a network module (11), an image transmission module (12), a navigation module (13), an action driving module (14) and a detection and sensing module (15) according to realized functions;

The backup machine (200) is divided into a network module (21), an image transmission module (22), a navigation module (23), an action drive module (24) and a detection sensor module (25) according to realized functions.

The advantage of the dual-machine redundant control system designed by the present invention is:

1. In the past, the CPU status was judged through the system self-test. Once the CPU fails, the self-detection system may also fail, and the output of its own state is inaccurate, resulting in errors and missed reports. When the dual-machine redundant control system of the present invention was working normally, the host computer 100 (using PC104 as the main controller) obtained the control right of the external upper computer 300, and after completing the corresponding control tasks, it was connected with the backup machine 200 (using ARM9E as the controller) Exchanging information with the host computer 300 regularly to determine whether the working state of the host computer 100 is normal.

2. The previous design can only judge whether the CPU is working normally, but cannot judge the location of the specific fault. The dual-machine redundant control system of the present invention is subdivided into different modules according to functions, and each module is provided with a state detection command, and continuously sends state information to the upper computer 300 during the operation of the system, so that different states can be returned by each module The information judges the operating status of each module, and once a fault occurs, the fault location can be accurately judged.

Three, the dual-machine redundant control system of the present invention has designed a kind of idea of modular combination to complete fault handling, and completes the control task through the effective combination of different modules between the PC104 master controller and the ARM9E backup controller, to achieve better Resource allocation and higher reliability.

4. Once a CPU fault is detected in the previous design, all module functions of the controller are abandoned and permanently invalidated, resulting in waste of resources. The dual-machine redundant control system of the present invention is designed with a self-recovery function for the faulty controller, and also has the ability of self-learning while restoring the state, remembering the last fault location, so as to avoid making the same mistake again when the controller is restored . This makes the entire dual-machine redundant control system more perfect and comprehensive, and effectively guarantees the reliability and safety of the system.

Description of drawings

Fig. 1 is a structural block diagram of the robot control system of the present invention.

Fig. 2 is a structural block diagram of the internal modules of the dual-machine redundant control system of the present invention.

Fig. 3 is a structural block diagram of the modular combination of the mainframe of the present invention to handle faults.

Fig. 4 is a structural block diagram of the modular combination of the backup machine in the present invention to handle faults.

Detailed ways

The present invention will be further described in detail below in conjunction with the accompanying drawings.

Referring to shown in Fig. 1, a kind of dual-machine redundant embedded control system (hereinafter referred to as dual-machine redundant control system) applicable to nuclear industry robot control of the present invention, this dual-machine redundant control system includes with PC 104 The host 100 as the main controller and the backup machine 200 with ARM9E as the controller, the host 100 and the backup machine 200 are installed on the nuclear industrial robot, and realize the electrical signal connection with the robot drive control module 400 through the 485 bus; the nuclear industrial robot passes The optical fiber and the host computer 300 implement instruction information transmission.

Referring to FIG. 2 , the host 100 is divided into a network module 11 , an image transmission module 12 , a navigation module 13 , an action driving module 14 and a detection and sensing module 15 according to the realized functions.

The backup machine 200 is divided into a network module 21 , an image transmission module 22 , a navigation module 23 , an action driving module 24 and a detection and sensing module 25 according to the realized functions.

In the present invention, in order to ensure the reliability and stability of the dual system (main frame 100 and backup machine 200), the same functional modules are designed on different main control chips (PC 104 controller, ARM9E controller).

Referring to Fig. 3, when the network module 11 in the host 100 receives a group of command data from the remote terminal (a part of the nuclear industry robot), it will send a reply instruction DA host to the host computer 300 that the network module is working normally, referred to as DA _host for short. Commands the DA _host for network normal.

Every time the image transmission module 12 in the host 100 receives a frame of video data, it will send to the host computer 300 a reply command DB _host that the image transmission module is working normally, referred to as the normal image command DB _host .

Each time the navigation module 13 in the host 100 receives a set of navigation status data, it will send a reply command DC _host to the host computer 300 that the navigation module is working normally, referred to as the navigation normal command DC _host .

The action drive module 14 in the host 100 sends a set of command frequency data to the drive board (that is, the robot drive control module 400) every time, it will send a response command DD _host that the action drive module is working normally to the host computer 300, referred to as the drive normal command for short. DD _host .

Each time the detection and sensing module 15 in the host 100 receives a set of data from the detection end, it will send to the host computer 300 a response command DE _host that the detection and sensing module is working normally, referred to as the sensing normal command DE _host .

In the present invention, the host-data information MD _100-300 uploaded by the host 100 to the host computer 300 is expressed in a collective form as MD _100-300 = {DA _host , DB _host , DC _host , DD _host , DE _host }. When within the receiving time T (generally set as 1 second, 5 seconds or 10 seconds, etc. to upload data once), if the host computer 300 does not receive any one or more of the host-data information MD _100-300 , then download Send the corresponding startup backup machine 200 instruction FF _{backup machine} ={FDA _host , FDB _host , FDC _host , FDD _host , FDE _host } to the backup machine 200. Since the functional module structures set in the main machine 100 and the backup machine 200 are the same, it can be based on the host computer 300 failing to receive within the set time T, such as network normal command DA _host , image normal command DB _host , navigation normal command DC _{The host} , the drive normal command DD _host and/or the sensing normal command DE _host start each module in the backup machine 200 accordingly.

Referring to shown in Fig. 4, when the network module 21 in the backup machine 200 receives a group of command data from the remote terminal (a part on the nuclear industry robot) every time, it will send the backup-network module to the normal reply command DA to the host computer 300 _Standby , referred to as backup-network normal command DA _backup .

The image transmission module 22 in the backup machine 200 will send a backup-image transmission module normal work reply command DB _backup to the host computer 300 each time it receives a frame of video data, referred to as backup-image normal command DB _backup .

Each time the navigation module 23 in the backup machine 200 receives a set of navigation state data, it will send a backup-navigation module normal reply _command DC standby to the host computer 300, referred to as backup-navigation normal command DC _standby .

When the action drive module 24 in the backup machine 200 sends a set of command frequency data to the drive board (ie, the robot drive control module 400), it will send a backup command to the host computer 300 to reply that the action drive module is working normally, DD _{standby machine} for short. Command DD _standby for backup-drive normal.

Each time the detection sensor module 25 in the backup machine 200 receives a set of data from the detection end, it will send a backup-detection sensor module to the host computer 300 to reply to the normal operation command DE _{standby machine} , referred to as backup-transmission Feel normal command DE _{backup machine} .

The mode of operation of the dual-machine redundant control system designed by the present invention is: during normal operation, the host computer 100 (using PC104 as the main controller) obtains the control right to the peripherals of the nuclear industry robot, and the backup machine 200 (using ARM9E as the controller) is on standby. At this moment, both the master machine 100 and the backup machine 200 run the self-testing program. When the main machine 100 fails, the upper computer 300 gives up the control right of the main machine 100 to the peripherals of the nuclear industrial robot, and at the same time transfers the control right to the backup machine 200, so as to ensure that the failure of the single machine will not cause the failure of the nuclear industrial robot system .

In the present invention, the upper computer 300 is an industrial computer, and the industrial computer is PCM-9380 industrial computer produced by Advantech.

In the present invention, both the network module 11 and the network module 21 are used to realize uploading of data information collected by nuclear industry robots and issuing instructions. The network module 21 is when any one (image transmission module 12, navigation module 13, action drive module 14 and sensor module 15) module breaks down in the host computer 100, and sends the backup machine network start-up command FDA _host computer through the host computer 300. implemented.

In the present invention, both the image transmission module 12 and the image transmission module 22 are used to realize real-time acquisition of the environment where the nuclear industry robot is located, and upload the acquired image information to the upper computer 300 . The image transmission module 22 is executed when the image transmission module 12 breaks down and the host computer 300 sends the backup machine image startup command to the FDB _master .

In the present invention, the navigation module 13 and the navigation module 23 are used to realize the positioning of its own position, and upload the information of its own position to the upper computer 300 . The navigation module 23 is executed when the navigation module 13 breaks down and the backup machine navigation start command issued by the host computer 300 is executed to the FDC _master . The navigation module 13 and the navigation module 23 can use GPS, gyroscope and so on.

In the present invention, the action driving module 14 and the action driving module 24 are used to control the action of the nuclear industrial robot. The action drive module 24 is executed only when the action drive module 14 fails and the backup machine action start instruction issued by the host computer 300 is executed to the FDD _master .

In the present invention, the sensor module 15 and the sensor module 25 are used to collect information related to nuclear leakage in the environment where the nuclear industrial robot is located, and upload the collected information to the upper computer 300 . The sensor module 25 is when any one of the image transmission module 12, the navigation module 13, the action drive module 14, and the sensor module 15 in the host computer 100 breaks down, and the backup machine sensing and starting instruction FDE issued by the _host computer 300 is activated. implement.

In order to receive multiple information MD _100-300 ={DA _mainframe , DB _mainframe , DC _mainframe , DD _mainframe , DE _mainframe } to receive the multiple information MD 100-300 that main controller 100 uploads in real time, upper computer 300 judges that main controller is under the normal working state, if Within the receiving time T, if the upper computer 300 does not receive the information uploaded by a certain module in the main controller 100, it is considered that the module in the main controller has failed. At this time, the upper computer 300 needs to send a message to the backup controller 200. The corresponding enabling information is used to enable the modules with the same structure as the main controller.

In the present invention, the receiving time T can be set to 1 second, 5 seconds or 10 seconds, etc.

In the present invention, the main controller adopts PC104 standard industrial computer.

In the present invention, the backup controller adopts the embedded controller with ARM9E as the core.

In the present invention, the robot drive control module communicates with the main controller and the backup controller respectively through the RS485 bus, and is used to realize the behavior control of the nuclear industry robot.

In the dual-machine redundant control system designed by the present invention, each module is provided with a state detection command, and the state information is continuously sent to the upper computer during the program operation process, so that the operating state of each module can be judged by the different state information returned by each module , once a fault occurs, the fault location can be accurately judged. Since the location of the fault can be located more accurately, it can provide a better method for the robot to make decisions after the fault, and at the same time provide important reference information for the robot to return to repair, so as to avoid the same fault in the future.

In the past, dual-machine redundancy fault detection can only simply judge whether the CPU is working normally, and does not judge the specific location of the fault. In practice, although some functional modules fail, they do not affect the work of the CPU. Therefore, two problems are prone to occur: the status information shows that the CPU is working normally, but in fact some functional modules have failed, resulting in missed fault reports; Normal work is affected, but due to the failure of this functional module, the status information reports a CPU error, so that all other functional modules of the entire controller are abandoned, resulting in waste of resources.

Based on the above considerations, the design of the present invention divides the entire controller function into different functional modules, including multiple modules as shown in Figure 2, and adopts different processing methods according to the importance of the functional modules.

① The key module is the network communication module. The network communication module is the link between the host computer and the robot. Once the network is disconnected, the host computer will not be able to send commands to the robot, and the entire robot will lose control.

Solution: In the PC104 host control software, every time PC104 receives a set of command data, it sends status information to the host computer to report the network connection status, and also sends network connection status information to the ARM backup machine on the other hand. Once the ARM backup controller inquires that the network communication function module of the PC104 main controller fails, the ARM controller will directly switch to the master, connect to the host computer, and take over the control. And PC 104 then enters self-recovery state, and switches to slave machine standby.

② The non-key modules are control bottom drive module, image transmission module, navigation module and detection sensor module. Although the failure of the above modules will affect the normal operation of the robot, it will not cause the robot to completely lose control.

Processing method: When a non-critical module in the PC104 host fails, the host computer receives the fault status information of the module and makes a decision: On the one hand, it sends an interrupt execution condition to the PC104 to stop the faulty module from working. In order to avoid the continued execution of the faulty module to cause memory conflicts, crashes, and program runaways and cause the entire CPU to crash. On the other hand, send start-up execution conditions to ARM to start the same function module in ARM as the faulty module of PC104, switch this function to ARM for execution, and the upper computer receives relevant data, images and other information from the ARM controller.

Once the two same modules of PC104 and ARM fail, it indicates that there is a problem in the design of the functional module, and then return to overhaul.

Advantages: It can greatly reduce the probability of robot failure.

Proof: Assume that the five modules of the network communication module, the control bottom module, the image transmission module, the navigation module, and the detection sensor module have a failure probability of 20%, and a normal working probability of 80%.

In the past dual-machine redundant system: if we only judge whether the CPU is faulty or not, and the CPU is not faulty when all five modules are working normally, the probability of one CPU working normally is P ₁ = (0.8) ⁵ = 0.32768, and the probability of robot failure is two The average CPU failure probability is P=(1-P ₁ ) ² ＝0.45201

The dual-machine redundant system designed by the present invention: if the modular combination method is adopted, assuming that the failure probability of the five modules of the network communication module, the control bottom module, the image transmission module, the navigation module, and the detection sensor module is 20%, a certain module The failure probability is the average failure probability of PC104 and ARM modules P ₁ =(0.2) ² =0.04, the normal operation probability of the robot is the normal operation probability of five modules P ₂ =(1-P ₁ ) ⁵ =0.81537, the robot failure probability P =1-P ₁ =0.18463.

The design of the present invention divides robot faults into functional module faults and CPU faults. The processing method for functional module faults has been introduced above. Once a CPU fault occurs, it is a major error. The design of self-recovery and self-learning functions is mainly for CPU faults. The present invention designs and defines the condition that the robot fails and returns to maintenance: PC104 and ARM have two identical modules that fail or PC104 and ARM each have a CPU failure.

When the PC104 has a CPU failure, on the one hand, the control right is switched to the ARM controller, and then the PC104 is powered on again, the network communication function module is restored, and the connection with the upper computer is maintained, and it is switched to a slave, in a standby state. On the other hand, locate the functional module causing the CPU failure, store and remember the fault location, and when the PC 104 recovers again, the faulty functional module will be forced to fail permanently and will no longer be enabled.

When ARM fails again, there are three situations: Situation 1, ARM has a CPU failure, switches to PC104 control, and meets the failure condition 2, reports to the host computer, and returns for maintenance; Situation 2, ARM controller has the same function module as PC104 Fault, because the PC104 module has been forced to permanently fail, meet the failure condition 1, report to the host computer, and return for maintenance; case three, the ARM controller has a functional module failure different from that of the PC104, as described in the modular combination method above, the PC 104 will After taking over the function of this module, the robot still runs normally.

The advantage of this design method is that once the two CPUs fail in the previous design method, the robot will fail completely. However, the self-recovery and self-learning idea is used to store and remember the fault location, and when the PC104 recovers again, the fault function module is forced to fail permanently and is no longer enabled. The module fails, but the CPU of the robot can still operate normally, and it will not completely lose control. The host computer can control the robot to return for maintenance.

Network communication module: Since network communication is the link between the host computer and the robot, once the network is disconnected, the host computer will not be able to send commands to the robot, and the entire robot will be completely out of control, so this function is very important. Based on the above considerations, in addition to using optical fiber communication in the design of the robot, a wireless network communication module is also backed up. Once the optical fiber communication fails, the wireless network communication module will take over the task of connecting the upper computer and the robot to ensure the safety of the robot.

Control the underlying module: When the robot meets the failure conditions, the upper computer will control the robot to return to maintenance. The underlying drive module is the module that controls the movement of the robot such as forward and turning, and is the basic guarantee for the robot to return for maintenance, so it is also a very important part. Based on the above considerations, an encoder is installed on each joint motor of the robot. The encoder will feed back the state of each execution motor to the controller, and then return to the host computer. Once the control bottom drive module fails, the host computer can better judge the cause of the failure. and location to make an optimal decision.

Claims (4)

1. A dual-machine redundant embedded control system applicable to nuclear industry robots is characterized in that: this dual-machine redundant embedded control system includes a mainframe (100) with PC104 as the main controller and ARM9E as the control The backup machine (200) of the device, the main machine (100) and the backup machine (200) are installed on the nuclear industrial robot, and realize the electrical signal connection with the robot drive control module (400) through the 485 bus; the nuclear industrial robot is connected with the upper computer through the optical fiber (300) realizes instruction information transmission; the backup machine (200) starts to enter the working state when the main machine (100) breaks down. 2. a kind of double-machine redundant embedded control system that is applicable to nuclear industry robot according to claim 1 is characterized in that: main frame (100) is divided into network module (11), image transmission module ( 12), navigation module (13), action drive module (14) and detection sensing module (15); When the network module (11) receives a group of command data from the remote terminal on the nuclear industry robot, it will send the network normal command DA _host to the host computer (300); The image transmission module (12) will send the image normal instruction DB _host to the upper computer (300) each time it receives a frame of video data; The navigation module (13) will send a navigation normal instruction DC _host to the host computer (300) each time it receives a set of navigation status data; When the action drive module (14) sends a group of command frequency data to the robot drive control module (400) each time, it will send the drive normal command DD _host to the host computer (300); The detection sensing module (15) will send a sensing normal command DE _host to the host computer (300) each time it receives a set of data from the detection end. 3. a kind of dual-machine redundant embedded control system applicable to nuclear industry robots according to claim 1 is characterized in that: backup machine (200) is divided into network module (21), image transmission module according to the function realized (22), navigation module (23), action drive module (24) and detection sensing module (25); The network module (21) will send a backup-network normal command DA _backup to the host computer (300) each time it receives a set of command data from the remote terminal on the nuclear industry robot; The image transmission module (22) will send a backup-image normal command DB _backup to the upper computer (300) each time it receives a frame of video data; The navigation module (23) will send a backup-navigation normal _command DC backup to the upper computer (300) each time it receives a set of navigation status data; When the action drive module (24) sends a group of command frequency data to the robot drive control module (400) each time, it will send a backup-drive normal command DD _{standby machine} to the upper computer (300); The detection sensing module (25) will send a backup-sensing normal command DE _backup to the host computer (300) each time it receives a set of data from the detection end. 4. A kind of dual-machine redundant embedded control system applicable to nuclear industry robots according to claim 1, 2 or 3, characterized in that: within the receiving time T, if the upper computer (300) does not receive the host (100) Uploaded host-data information MD _100-300 = {DA _host , DB _host , DC _host , DD _host , DE _host } when any one or more, then issue the corresponding start backup machine command FF _{backup Machine} ={FDA _host , FDB _host , FDC _host , FDD _host , FDE _host } to the backup machine (200).

Images