阅读说明：本技术 一种三模冗余计算机时钟同步方法及其系统 (Triple-modular redundancy computer clock synchronization method and system ) 是由 王明明 朱永泉 王志 辛哲奎 杨毅强 于 2020-04-17 设计创作，主要内容包括：本申请公开了一种三模冗余计算机时钟同步方法及其系统,其中,三模冗余计算机时钟同步系统包括三个CPU子模块和双冗余MCU时钟配置单元；三个CPU子模块之间通过三机数据交换/同步/表决通道两两连接；双冗余MCU时钟配置单元通过时钟反馈通道分别与三个CPU子模块连接；双冗余MCU时钟配置单元还通过I2C总线分别与三个CPU子模块连接。本申请具有通过时钟计数值反馈,直接对时钟输出值进行补偿调试,补偿精度高,以及内部采用冗余结构,实现了时钟同步系统内部无单点失效环节,可靠性高的技术效果。(The application discloses a triple-modular redundancy computer clock synchronization method and a system thereof, wherein the triple-modular redundancy computer clock synchronization system comprises three CPU sub-modules and a double-redundancy MCU clock configuration unit; the three CPU sub-modules are connected pairwise through three-machine data exchange/synchronization/voting channels; the dual-redundancy MCU clock configuration unit is respectively connected with the three CPU sub-modules through clock feedback channels; the dual-redundancy MCU clock configuration unit is also respectively connected with the three CPU sub-modules through an I2C bus. The clock synchronization system has the advantages that the clock counting value feedback is adopted, the clock output value is directly compensated and debugged, the compensation precision is high, the redundancy structure is adopted inside, the internal single-point failure link of the clock synchronization system is avoided, and the reliability is high.)

1. A triple-modular redundancy computer clock synchronization system is characterized by comprising three CPU sub-modules and a double-redundancy MCU clock configuration unit; the three CPU sub-modules are connected pairwise through three-machine data exchange/synchronization/voting channels; the dual-redundancy MCU clock configuration unit is respectively connected with the three CPU sub-modules through clock feedback channels; the dual-redundancy MCU clock configuration unit is also respectively connected with the three CPU sub-modules through an I2C bus;

wherein, the dual redundant MCU clock configuration unit: the CPU sub-modules are used for receiving time difference values or counting difference values fed back by the three CPU sub-modules; and calculating the time difference or the counting difference to obtain a working clock compensation correction register value or a clock regulation value, and sending the obtained working clock compensation correction register value or the clock regulation value to the corresponding CPU submodule.

2. The triple-modular redundant computer clock synchronization system of claim 1, wherein each CPU sub-module comprises: the system comprises a CPU processing unit, an FPGA logic circuit, a CPU clock and a logic circuit clock; the CPU processing unit is respectively connected with the FPGA logic circuit and the CPU clock; the FPGA logic circuit is also connected with a logic circuit clock; the CPU clock is connected with the dual-redundancy MCU clock configuration unit through an I2C bus; the logic circuit clock is connected with the dual redundant MCU clock configuration unit through an I2C bus.

3. The triple-modular redundant computer clock synchronization system of claim 1, wherein the dual-redundant MCU clock configuration unit comprises: a master MCU and a backup MCU; the master MCU comprises a master I2C controller; the backup MCU comprises a backup I2C controller; the master I2C controller is connected with the I2C bus through an I2C interface; the backup I2C controller is connected with the I2C bus through an I2C interface; and a data interaction channel is arranged between the master MCU and the backup MCU.

4. A method for clock synchronization in a triple modular redundancy computer, comprising:

receiving all time difference values;

calculating each time difference value to obtain a corresponding working clock compensation correction register value, feeding the working clock compensation correction register value back to a corresponding logic circuit clock to complete time base synchronization, and taking a periodic interrupt signal after the time base synchronization is completed as a time reference source;

receiving a counting difference value obtained by executing clock synchronization of a CPU (central processing unit) according to a time reference source;

and calculating each counting difference value to obtain a corresponding clock adjusting value, and feeding the clock adjusting value back to the corresponding CPU clock, thereby completing the clock synchronization of the CPU processing unit.

5. The method of claim 4, wherein the sub-step of obtaining the time difference value is as follows:

presetting a periodic interrupt signal;

resetting at the same time, and starting to count until the count reaches a preset period interrupt signal;

when the counting reaches a preset period interrupt signal, respectively sending the cycle interrupt signal after the counting reaches the other two CPU sub-modules;

after receiving the post-arrival period interrupt signals sent by the other two CPU sub-modules, processing all post-arrival period interrupt signals in the local computer so as to obtain synchronous period interrupt signals;

and calculating by using the post-arrival period interrupt signal and the synchronous period interrupt signal generated by the local machine to obtain a time difference value, and sending the time difference value to the dual-redundancy MCU clock configuration unit.

6. The method of claim 4, wherein the sub-steps of calculating each time difference value to obtain the corresponding working clock compensation correction register value and feeding the working clock compensation correction register value back to the corresponding logic circuit clock to complete the time base synchronization configuration are as follows:

simultaneously calculating the received time difference value by a master MCU and a backup MCU in the MCU, and respectively obtaining a master register value and a backup register value;

the master MCU and the backup MCU perform data interaction on the master register value and the backup register value mutually;

after data interaction is completed, the master MCU and the backup MCU compare the master register value with the backup register value and obtain a comparison result, and if the comparison result is correct, the master MCU and the backup MCU respectively store the master register value and the backup register value in a self configuration information cache region as working clock compensation correction register values;

after the storage is finished, the master MCU sends the working clock compensation correction register value to a logic circuit clock needing to be configured and sends a configuration completion signal to the backup MCU;

and after receiving the configuration completion signal, the backup MCU reads the logic circuit clock to be configured, judges whether the working clock compensation correction register value of the logic circuit clock to be configured is the same as the working clock compensation correction register value stored by the backup MCU, feeds back a correct calibration signal to the master MCU to complete time base synchronization if the working clock compensation correction register value of the logic circuit clock to be configured is the same as the working clock compensation correction register value stored by the master MCU, informs each CPU sub-module of completing time base synchronization configuration, and can start next time synchronization configuration.

7. The method of claim 4, wherein the sub-step of performing the count difference obtained by the CPU processing unit clock synchronization according to the time reference source is as follows:

starting counting and stopping counting according to the time standard source, and respectively sending the clock count value of the CPU to the other two CPU sub-modules when the counting is stopped;

after receiving clock count values sent by the other two CPU sub-modules, processing all the clock count values in the local machine to obtain a reference clock counter value;

and calculating by using the counter value of the reference clock and the clock count value generated by the local machine to obtain a count difference value, and sending the count difference value to the dual-redundancy MCU clock configuration unit.

8. The method of claim 7, wherein if the difference between the outputs of the CPU sub-modules is zero, it indicates that the clock count value output by the local computer is equal to the reference clock counter value, and no adjustment is required to the CPU clock of the local computer; if the counting difference output by the CPU submodule is positive, the CPU clock of the local computer is fast, and the CPU clock of the local computer needs to be slowed down; if the count difference output by the CPU submodule is negative, the CPU clock of the local computer is slow, and the CPU clock of the local computer needs to be adjusted fast.

9. The method of claim 6, wherein each count difference is calculated to obtain a corresponding clock adjustment value, and the clock adjustment value is fed back to the corresponding CPU clock, so as to complete the clock synchronization configuration of the CPU, and the sub-steps are as follows:

simultaneously calculating the received counting difference value by a master MCU and a backup MCU in the MCU, and respectively obtaining a master clock regulation value and a backup clock regulation value;

the master MCU and the backup MCU perform data interaction on the master clock regulation value and the backup clock regulation value mutually;

after data interaction is completed, the master MCU and the backup MCU compare the master clock regulation value with the backup clock regulation value and obtain a comparison result, and if the comparison result is correct, the master MCU and the backup MCU respectively store the master clock regulation value and the backup clock regulation value as clock regulation values in a self configuration information cache region;

after the storage is finished, the master MCU sends the clock regulation value to a CPU clock needing to be configured and sends a configuration completion signal to the backup MCU;

and after receiving the configuration completion signal, the backup MCU reads the CPU clock to be configured, judges whether the clock regulation value of the CPU clock to be configured is the same as the clock regulation value stored by the backup MCU, feeds back a correct calibration signal to the master MCU if the clock regulation value of the CPU clock to be configured is the same as the clock regulation value stored by the backup MCU, completes the synchronous configuration of the CPU processing units, informs each CPU submodule of completing the synchronous configuration of the CPU processing units, and can start the next synchronous configuration.

10. The method according to claim 6 or 9, wherein when the link of the time base synchronous configuration or the synchronous configuration of the CPU processing unit fails, a reconfirmation is required, and if the failure still exists after the reconfirmation, the self-checking of the master MCU and the backup MCU is started; and if the self-checking result shows that one MCU fails and cannot be repaired, stopping data interaction between the master MCU and the backup MCU, and switching the dual-redundancy MCU clock configuration unit into a single-machine operation mode.

Technical Field

The present application relates to the field of computer technologies, and in particular, to a triple-modular redundancy computer clock synchronization method and system.

Background

The triple modular redundancy computing technology is a high-reliability computing technology with a fault-tolerant function, namely three completely independent Computer (CPU) submodules simultaneously execute the same operation and operation on an input object, the processing results are simultaneously sent to an output voter, and the voter takes the computing result with the same majority of the CPU submodules as voting output, which is generally called as two-out-of-three voting output. The technology can effectively eliminate single-point faults and realize computer system level fault tolerance. The application fields of the method are fields of aviation, aerospace, industrial control and the like with high requirements on reliability and safety. In order to ensure the correct and reliable operation of the triple-modular redundancy computer, namely that the CPU sub-modules execute the same operation at the same time, the three-machine (three CPU sub-modules) synchronization technology is a key problem which must be solved, and the synchronization of a three-machine clock system is realized firstly when the three-machine synchronization is realized. Because the clock system is the most basic time base signal for providing computers, the clock system is the basic signal for ensuring synchronous operation of the triple-modular redundancy computers.

The three-machine clock synchronization technology commonly adopted in the current engineering is as follows:

(1) common clock scheme: in order to ensure the synchronism of the triple-modular redundancy computer clock, the system adopts a unified common main clock, the clock buffer is divided into three paths to provide clocks for the three CPU sub-modules, and the clocks of the three CPU sub-modules are homologous, so that the accurate synchronization of the clocks of the three CPU sub-modules is ensured. Although the common clock scheme well solves the clock synchronization problem of each CPU submodule, the common clock is a single fault point of the system and threatens the reliability of the system.

(2) The time base synchronization method based on the logic circuit comprises the following steps: the method is characterized in that three CPU sub-modules use independent clocks, because the independent clocks have asynchronization, the asynchronization is continuously accumulated and increased along with the increase of working time, when a certain threshold value is reached, three machines can not be normally synchronized, in order to solve the problem, a logic circuit (generally, a Field Programmable Gate Array (FPGA) logic circuit) is adopted to carry out clock interactive voting on the three machines in a fixed time period (synchronous heartbeat), after the interactive voting, synchronous heartbeats of the three machines are consistent, the synchronous heartbeat is used as a time base signal of each CPU sub-module, and the time base signal is used for periodically carrying out synchronous handshake on the three machines, so that the synchronism of the three machines is ensured.

The time base synchronization method based on the logic circuit uses independent clocks, and although common cause failure caused by common clocks is effectively avoided, the method has the following defects:

(1) the synchronization precision depends on the unified synchronous heartbeat of the three machines after interactive voting, the interactive voting generated by the synchronous heartbeat requires the completion time, the clock period of the synchronous heartbeat is difficult to be equivalent to the working clock magnitude of a CPU submodule, the synchronization precision is not high, and the synchronization precision of the scheme is lower than that of a common clock scheme by several magnitudes in general.

(2) The synchronous logic circuit also needs clock driving for working, and also has clock asynchronism, and when the driving clock of the three-machine synchronous logic circuit is initially or greatly deviated in operation, a fault that the three machines cannot be synchronized can be generated.

Disclosure of Invention

The application aims to provide a triple-modular redundancy computer clock synchronization method and a triple-modular redundancy computer clock synchronization system, which have the technical effects that the clock output value is directly compensated and debugged through clock count value feedback, the compensation precision is high, a redundant structure is adopted in the triple-modular redundancy computer clock synchronization system, no single-point failure link exists in the clock synchronization system, and the reliability is high.

In order to achieve the above object, the present application provides a triple-modular redundancy computer clock synchronization system, which includes three CPU sub-modules and a dual-redundancy MCU clock configuration unit; the three CPU sub-modules are connected pairwise through three-machine data exchange/synchronization/voting channels; the dual-redundancy MCU clock configuration unit is respectively connected with the three CPU sub-modules through clock feedback channels; the dual-redundancy MCU clock configuration unit is also respectively connected with the three CPU sub-modules through an I2C bus; wherein, the dual redundant MCU clock configuration unit: the CPU sub-modules are used for receiving time difference values or counting difference values fed back by the three CPU sub-modules; and calculating the time difference or the counting difference to obtain a working clock compensation correction register value or a clock regulation value, and sending the obtained working clock compensation correction register value or the clock regulation value to the corresponding CPU submodule.

As above, wherein each CPU sub-module comprises: the system comprises a CPU processing unit, an FPGA logic circuit, a CPU clock and a logic circuit clock; the CPU processing unit is respectively connected with the FPGA logic circuit and the CPU clock; the FPGA logic circuit is also connected with a logic circuit clock; the CPU clock is connected with the dual-redundancy MCU clock configuration unit through an I2C bus; the logic circuit clock is connected with the dual redundant MCU clock configuration unit through an I2C bus.

As above, wherein, the dual redundant MCU clock configuration unit includes: a master MCU and a backup MCU; the master MCU comprises a master I2C controller; the backup MCU comprises a backup I2C controller; the master I2C controller is connected with the I2C bus through an I2C interface; the backup I2C controller is connected with the I2C bus through an I2C interface; and a data interaction channel is arranged between the master MCU and the backup MCU.

The application also provides a triple modular redundancy computer clock synchronization method, which comprises the following steps: receiving all time difference values; calculating each time difference value to obtain a corresponding working clock compensation correction register value, feeding the working clock compensation correction register value back to a corresponding logic circuit clock to complete time base synchronization, and taking a periodic interrupt signal after the time base synchronization is completed as a time reference source; receiving a counting difference value obtained by executing clock synchronization of a CPU (central processing unit) according to a time reference source; and calculating each counting difference value to obtain a corresponding clock adjusting value, and feeding the clock adjusting value back to the corresponding CPU clock, thereby completing the clock synchronization of the CPU processing unit.

As above, the sub-step of obtaining the time difference value is as follows: presetting a periodic interrupt signal; resetting at the same time, and starting to count until the count reaches a preset period interrupt signal; when the counting reaches a preset period interrupt signal, respectively sending the cycle interrupt signal after the counting reaches the other two CPU sub-modules; after receiving the post-arrival period interrupt signals sent by the other two CPU sub-modules, processing all post-arrival period interrupt signals in the local computer so as to obtain synchronous period interrupt signals; and calculating by using the post-arrival period interrupt signal and the synchronous period interrupt signal generated by the local machine to obtain a time difference value, and sending the time difference value to the dual-redundancy MCU clock configuration unit.

As above, the sub-step of calculating each time difference value to obtain the corresponding working clock compensation correction register value and feeding the working clock compensation correction register value back to the corresponding logic circuit clock to complete the time base synchronization configuration is as follows: simultaneously calculating the received time difference value by a master MCU and a backup MCU in the MCU, and respectively obtaining a master register value and a backup register value; the master MCU and the backup MCU perform data interaction on the master register value and the backup register value mutually; after data interaction is completed, the master MCU and the backup MCU compare the master register value with the backup register value and obtain a comparison result, and if the comparison result is correct, the master MCU and the backup MCU respectively store the master register value and the backup register value in a self configuration information cache region as working clock compensation correction register values; after the storage is finished, the master MCU sends the working clock compensation correction register value to a logic circuit clock needing to be configured and sends a configuration completion signal to the backup MCU; and after receiving the configuration completion signal, the backup MCU reads the logic circuit clock to be configured, judges whether the working clock compensation correction register value of the logic circuit clock to be configured is the same as the working clock compensation correction register value stored by the backup MCU, feeds back a correct calibration signal to the master MCU to complete time base synchronization if the working clock compensation correction register value of the logic circuit clock to be configured is the same as the working clock compensation correction register value stored by the master MCU, informs each CPU sub-module of completing time base synchronization configuration, and can start next time synchronization configuration.

As above, wherein the sub-step of executing the count difference obtained by the CPU processing unit clock synchronization according to the time reference source is as follows: starting counting and stopping counting according to the time standard source, and respectively sending the clock count value of the CPU to the other two CPU sub-modules when the counting is stopped; after receiving clock count values sent by the other two CPU sub-modules, processing all the clock count values in the local machine to obtain a reference clock counter value; and calculating by using the counter value of the reference clock and the clock count value generated by the local machine to obtain a count difference value, and sending the count difference value to the dual-redundancy MCU clock configuration unit.

As above, if the count difference output by the CPU sub-module is zero, it indicates that the clock count value output by the local computer is equal to the reference clock counter value, and the CPU clock of the local computer does not need to be adjusted; if the counting difference output by the CPU submodule is positive, the CPU clock of the local computer is fast, and the CPU clock of the local computer needs to be slowed down; if the count difference output by the CPU submodule is negative, the CPU clock of the local computer is slow, and the CPU clock of the local computer needs to be adjusted fast.

As above, the sub-step of calculating each count difference to obtain a corresponding clock adjustment value and feeding back the clock adjustment value to the corresponding CPU clock, thereby completing the clock synchronization configuration of the CPU processing unit, is as follows: simultaneously calculating the received counting difference value by a master MCU and a backup MCU in the MCU, and respectively obtaining a master clock regulation value and a backup clock regulation value; the master MCU and the backup MCU perform data interaction on the master clock regulation value and the backup clock regulation value mutually; after data interaction is completed, the master MCU and the backup MCU compare the master clock regulation value with the backup clock regulation value and obtain a comparison result, and if the comparison result is correct, the master MCU and the backup MCU respectively store the master clock regulation value and the backup clock regulation value as clock regulation values in a self configuration information cache region; after the storage is finished, the master MCU sends the clock regulation value to a CPU clock needing to be configured and sends a configuration completion signal to the backup MCU; and after receiving the configuration completion signal, the backup MCU reads the CPU clock to be configured, judges whether the clock regulation value of the CPU clock to be configured is the same as the clock regulation value stored by the backup MCU, feeds back a correct calibration signal to the master MCU if the clock regulation value of the CPU clock to be configured is the same as the clock regulation value stored by the backup MCU, completes the synchronous configuration of the CPU processing units, informs each CPU submodule of completing the synchronous configuration of the CPU processing units, and can start the next synchronous configuration.

If the failure still exists after the confirmation, the self-checking of the master MCU and the backup MCU is started; and if the self-checking result shows that one MCU fails and cannot be repaired, stopping data interaction between the master MCU and the backup MCU, and switching the dual-redundancy MCU clock configuration unit into a single-machine operation mode.

The beneficial effect that this application realized is as follows:

(1) according to the triple-modular redundancy computer clock synchronization method and the triple-modular redundancy computer clock synchronization system, the triple clocks are subjected to two-layer interactive voting, the asynchrony degree of the triple clocks is calculated according to the voting result, the hardware clocks are dynamically adjusted, the triple clocks are accurately synchronized, and a CPU module clock adjustment closed-loop feedback control system is formed in the whole process.

(2) The triple-modular redundancy computer clock synchronization system eliminates a single-point fault link by adopting the independent clock and the double-MCU redundancy hot backup clock configuration unit, realizes the full component redundancy of the whole CPU clock synchronization system, provides a high-reliability and high-precision clock synchronization solution for the triple-modular redundancy computer to realize high-speed and high-precision calculation, and has higher practical value.

(3) According to the triple-modular redundancy computer clock synchronization method, in the compensation process, the clock output value is directly compensated and debugged through clock count value feedback, the compensation precision can reach the clock magnitude, and the compensation precision is high.

(4) According to the triple-modular redundancy computer clock synchronization method, the problem that the synchronization reliability is reduced due to the fact that the asynchronous clock drifts along with the time is solved through flexible clock configuration.

Drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments described in the present application, and other drawings can be obtained by those skilled in the art according to the drawings.

FIG. 1 is a schematic diagram of an embodiment of a triple modular redundancy computer clock synchronization system;

FIG. 2 is a schematic structural diagram of an embodiment of a triple modular redundancy computer clock synchronization method.

Detailed Description

The technical solutions in the embodiments of the present invention are clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are some, not all, embodiments of the present invention. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.

The application provides a triple-modular redundancy computer clock synchronization method and a triple-modular redundancy computer clock synchronization system, which have the technical effects that the clock output value is directly compensated and debugged through clock count value feedback, the compensation precision is high, a redundancy structure is adopted in the triple-modular redundancy computer clock synchronization system, the single-point failure link in the clock synchronization system is avoided, and the reliability is high.

As shown in fig. 1, the present application provides a triple-modular redundancy computer clock synchronization system, which includes three CPU sub-modules 1 and a dual-redundancy MCU clock configuration unit 2; the three CPU sub-modules 1 are connected pairwise through three-machine data exchange/synchronization/voting channels; a clock configuration Unit of a double-redundancy MCU (Microcontroller Unit) is respectively connected with the three CPU sub-modules 1 through clock feedback channels; the dual-redundancy MCU clock configuration unit 2 is also respectively connected with the three CPU sub-modules 1 through an I2C bus; wherein, the dual redundant MCU clock configuration unit 2: the CPU submodule is used for receiving time difference values or counting difference values fed back by the three CPU submodules 1; and calculating the time difference or the counting difference to obtain a working clock compensation correction register value or a clock regulation value, and sending the obtained working clock compensation correction register value or the clock regulation value to the corresponding CPU submodule 1.

Further, each CPU sub-module 1 includes: the system comprises a CPU processing unit, an FPGA logic circuit, a CPU clock and a logic circuit clock; the CPU processing unit is respectively connected with the FPGA logic circuit and the CPU clock; the FPGA logic circuit is also connected with a logic circuit clock; the CPU clock is connected with the dual-redundancy MCU clock configuration unit through an I2C bus; the logic circuit clock is connected with the dual redundant MCU clock configuration unit 2 through an I2C bus.

Specifically, the CPU clock has an I2C interface; the logic circuit clock has an I2C interface. The CPU clock is connected with an I2C bus through an I2C interface; the logic circuit clock is connected to the I2C bus through an I2C interface.

Further, the dual redundant MCU clock configuration unit 2 includes: a master MCU and a backup MCU; the master MCU comprises a master I2C controller; the backup MCU comprises a backup I2C controller; the master I2C controller is connected with the I2C bus through an I2C interface; the backup I2C controller is connected with the I2C bus through an I2C interface; and a data interaction channel is arranged between the master MCU and the backup MCU and used for information interaction.

Specifically, the dual-redundancy MCU clock configuration unit 2 is set to be a circuit structure of dual-MCU redundancy hot backup. The master MCU and the backup MCU are connected with the clock feedback channel in a parallel mode, and the master MCU and the backup MCU receive data (the data is a time difference value or a counting difference value) sent by the CPU submodule together; the data output end of the dual-redundancy MCU clock configuration unit 2 adopts an output data bus switching mode, and only allows data output of one MCU, for example: if the master MCU has no fault, the data of the master MCU is output; and if the master MCU fails, switching to the data output of the backup MCU. The method is favorable for ensuring the reliability of the clock synchronization realization method and eliminating the single-point failure link.

Furthermore, the main MCU and the backup MCU have configuration information buffer areas in the memories for storing the configuration information of each clock module. Wherein the clock configuration information includes: the working clock compensates the correction register value and the clock adjustment value.

As shown in fig. 2, the present application provides a triple modular redundancy computer clock synchronization method, including:

s1: all time differences are received.

Specifically, the dual-redundancy MCU clock configuration unit receives the time difference values sent by the three CPU sub-modules through the clock feedback channel, and executes S2. And the master MCU and the backup MCU simultaneously receive the time difference.

Further, the sub-step of obtaining the time difference value is as follows:

s110: a periodic interrupt signal is preset.

Specifically, the three CPU sub-modules preset a periodic interrupt signal in their respective FPGA logic circuits, and execute S120.

The present application is described by taking a periodic interrupt signal of 20ms as an example, but not limited to the periodic interrupt signal of 20ms, the periodic interrupt signals preset in the respective FPGA logic circuits by the three CPU submodules are 20ms, that is, the periodic interrupt signals of the clocks of the CPU1, the CPU2, and the CPU3 are the same, the clock frequency values of the clocks of the logic circuit 1, the logic circuit 2, and the logic circuit 3 are equal, because the clock circuits have errors such as a clock temperature error caused by inherent initial deviation and temperature environment change, and a clock drift error caused by long-time storage, the clock initial values cannot be completely equal, a clock error measurement needs to be performed, the clock frequency is corrected according to a clock error measurement feedback value, and thus each clock error is ensured to be within an error range required by clock synchronization.

S120: and resetting at the same time, and starting to count until the count reaches a preset period interrupt signal.

Specifically, the three CPU submodules reset the respective logic circuit clocks at the same time, and start counting until the count reaches a cycle interrupt signal set in advance, that is, until the count reaches 20ms count time, S130 is executed.

S130: and when the counting reaches a preset period interrupt signal, respectively sending the arrival period interrupt signal of the CPU to the other two CPU sub-modules.

Specifically, each CPU sub-module sends the interrupt signal of the post-arrival period to the other two CPU sub-modules through the three-machine data exchange/synchronization/voting channel.

S140: after receiving the post-arrival period interrupt signals sent by the other two CPU sub-modules, all post-arrival period interrupt signals are processed in the local computer, so that synchronous period interrupt signals are obtained.

Specifically, after each CPU submodule receives the post-arrival period interrupt signals sent by the other two CPU submodules, three-out-of-two interactive voting is carried out in an FPGA logic circuit of the local computer by using the post-arrival period interrupt signals generated by the local computer and the two received post-arrival period interrupt signals, and a synchronous period interrupt signal is generated after interactive voting, wherein the synchronous period interrupt signal is 20 ms.

S150: and calculating by using the post-arrival period interrupt signal and the synchronous period interrupt signal generated by the local machine to obtain a time difference value, and sending the time difference value to the dual-redundancy MCU clock configuration unit.

Specifically, after the synchronization interrupt signal is obtained in each CPU sub-module, the post-arrival period interrupt signal and the synchronization period interrupt signal generated by the local computer are calculated in the local computer, so as to obtain a difference between the post-arrival period interrupt signal and the synchronization period interrupt signal generated by the local computer, and the difference is used as a time difference. And after acquiring the time difference value, each CPU submodule sends the time difference value to a dual-redundancy MCU clock configuration unit through a clock feedback channel, and S2 is executed.

Furthermore, if the time difference value between the interrupt signal of the post-arrival period and the interrupt signal of the synchronous period generated by the CPU sub-module is zero, the two signals are synchronous, and the clock of a logic circuit of the CPU sub-module is not required to be adjusted; if the time difference value obtained by the CPU submodule is positive, the logic circuit clock of the local computer is slow, and the logic circuit clock of the local computer needs to be adjusted fast; if the time difference value obtained by the CPU submodule is negative, the logic circuit clock of the local computer is fast, and the logic circuit clock of the local computer needs to be slowed down.

S2: and calculating each time difference value to obtain a corresponding working clock compensation correction register value, feeding the working clock compensation correction register value back to a corresponding logic circuit clock to complete time base synchronization, and taking a periodic interrupt signal after the time base synchronization is completed as a time reference source.

Specifically, the specific value of the logic circuit clock that needs to be adjusted is the working clock compensation correction register value. After receiving all the time difference values, the dual-redundancy MCU clock configuration unit calculates each time difference value to obtain a corresponding working clock compensation correction register value, sends the working clock compensation correction register value to a corresponding logic circuit clock through an I2C bus, repeats the step S1 to carry out time base synchronization until the time difference values of the post-period interrupt signal and the synchronous period interrupt signal generated by the FPGA logic circuit of each CPU submodule are all zero, and the logic circuit clock deviation of each CPU submodule is within a clock period range, namely the time base synchronization is finished, the periodic interrupt signal after the time base synchronization is finished is used as a time reference source, and S3 is executed. Wherein the time reference source is used for providing starting and stopping signals for clock counters of all CPU clocks.

Further, the sub-step of calculating each time difference value to obtain a corresponding working clock compensation correction register value and feeding back the working clock compensation correction register value to the corresponding logic circuit clock to complete time base synchronization configuration is as follows:

t1: and simultaneously calculating the received time difference value by the master MCU and the backup MCU in the MCU, and respectively obtaining a master register value and a backup register value.

Specifically, the dual-redundancy MCU clock configuration unit calculates the received time difference value by the master MCU and the backup MCU inside itself at the same time, and obtains the master register value and the backup register value respectively.

T2: and the master MCU and the backup MCU perform data interaction on the master register value and the backup register value mutually.

Specifically, the master MCU sends the master register value to the backup MCU; and the backup MCU sends the backup register value to the master MCU.

T3: after data interaction is completed, the master MCU and the backup MCU both compare the master register value and the backup register value and obtain a comparison result, and if the comparison result is correct, the master MCU and the backup MCU respectively store the master register value and the backup register value in a configuration information cache region of the master MCU and the backup MCU as working clock compensation correction register values.

T4: after the storage is finished, the master MCU sends the working clock compensation correction register value to the logic circuit clock needing to be configured, and sends a configuration completion signal to the backup MCU.

Specifically, the master MCU sends the working clock compensation correction register value to the logic circuit clock to be configured through the I2C bus.

T5: and after receiving the configuration completion signal, the backup MCU reads the logic circuit clock to be configured, judges whether the working clock compensation correction register value of the logic circuit clock to be configured is the same as the working clock compensation correction register value stored by the backup MCU, feeds back a correct calibration signal to the master MCU to complete time base synchronization if the working clock compensation correction register value of the logic circuit clock to be configured is the same as the working clock compensation correction register value stored by the master MCU, informs each CPU sub-module of completing time base synchronization configuration, and can start next time synchronization configuration.

Specifically, the backup MCU reads the working clock compensation correction register value of the logic circuit clock to be configured through the I2C bus.

S3: receiving a count difference value obtained by performing CPU processing unit clock synchronization according to a time reference source.

Further, the sub-step of executing the count difference obtained by the clock synchronization of the CPU processing unit according to the time reference source is as follows:

s310: and starting counting and stopping counting according to the time standard source, and respectively sending the clock count value of the CPU to the other two CPU sub-modules when the counting is stopped.

Specifically, the three CPU clocks simultaneously clear and start counting according to the time reference, and simultaneously stop counting. When the CPU clocks in each CPU sub-module stop counting, each CPU sub-module sends its clock count value to the other two CPU sub-modules through the three-machine data exchange/synchronization/voting channel, respectively, and executes S320.

S320: after receiving the clock count values sent by the other two CPU submodules, all the clock count values are processed in the local computer to obtain a reference clock counter value.

Specifically, after each CPU sub-module receives the clock count values sent by the other two CPU sub-modules, the two received clock count values are compared with the clock counter value generated by the CPU sub-module. After the arrangement comparison, the clock count value whose value is at the middle position is taken as the reference clock counter value, and S330 is performed.

S330: and calculating by using the counter value of the reference clock and the clock count value generated by the local machine to obtain a count difference value, and sending the count difference value to the dual-redundancy MCU clock configuration unit.

Specifically, each CPU sub-module calculates a reference clock count value and a clock count value generated by the local computer in the local computer, thereby outputting a difference value between the reference clock count value and the clock count value generated by the local computer as a count difference value, and transmits the count difference value to the dual redundant MCU clock configuration unit through the clock feedback channel, and then S4 is performed.

Furthermore, if the counting difference value output by the CPU sub-module is zero, the clock counting value output by the local machine is equal to the reference clock counter value, and the CPU clock of the local machine does not need to be adjusted; if the counting difference output by the CPU submodule is positive, the CPU clock of the local computer is fast, and the CPU clock of the local computer needs to be slowed down; if the count difference output by the CPU submodule is negative, the CPU clock of the local computer is slow, and the CPU clock of the local computer needs to be adjusted fast.

S4: and calculating each counting difference value to obtain a corresponding clock adjusting value, and feeding the clock adjusting value back to the corresponding CPU clock, thereby completing the clock synchronization of the CPU processing unit.

Specifically, the specific value of the CPU clock that needs to be adjusted is the clock adjustment value. And after receiving all the count difference values, the dual-redundancy MCU clock configuration unit calculates each count difference value to obtain a corresponding clock adjustment value, sends the clock adjustment value to a corresponding CPU clock through an I2C bus, repeats the step S3 to carry out CPU processing unit clock synchronization until the clock count values of the CPU clocks of all the CPU submodules are not deviated after interaction, and finishes the CPU processing unit clock synchronization. The clock synchronization method of the CPU processing unit utilizes clock counting feedback to directly adjust the frequency of the CPU clock of the CPU processing unit, and the synchronization precision can reach the clock magnitude.

Further, each count difference is calculated to obtain a corresponding clock adjustment value, and the clock adjustment value is fed back to the corresponding CPU clock, so that the substep of completing the clock synchronization configuration of the CPU processing unit is as follows:

f1: and simultaneously calculating the received counting difference value by the master MCU and the backup MCU in the master MCU and the backup MCU, and respectively obtaining a master clock regulation value and a backup clock regulation value.

Specifically, the dual-redundancy MCU clock configuration unit calculates the received count difference value by the master MCU and the backup MCU inside the dual-redundancy MCU clock configuration unit at the same time, and obtains a master clock adjustment value and a backup clock adjustment value, respectively.

F2: and the master MCU and the backup MCU perform data interaction on the master clock regulation value and the backup clock regulation value mutually.

Specifically, the master MCU sends the master clock regulation value to the backup MCU; and the backup MCU sends the backup clock regulation value to the master MCU.

F3: after data interaction is completed, the master MCU and the backup MCU compare the master clock regulation value with the backup clock regulation value and obtain a comparison result, and if the comparison result is correct, the master MCU and the backup MCU respectively store the master clock regulation value and the backup clock regulation value as clock regulation values in self configuration information cache regions.

F4: after the storage is finished, the master MCU sends the clock regulation value to the CPU clock needing to be configured, and sends a configuration completion signal to the backup MCU.

Specifically, the master MCU sends the clock adjustment value to the CPU clock to be configured via the I2C bus.

F5: and after receiving the configuration completion signal, the backup MCU reads the CPU clock to be configured, judges whether the clock regulation value of the CPU clock to be configured is the same as the clock regulation value stored by the backup MCU, feeds back a correct calibration signal to the master MCU if the clock regulation value of the CPU clock to be configured is the same as the clock regulation value stored by the backup MCU, completes the synchronous configuration of the CPU processing units, informs each CPU submodule of completing the synchronous configuration of the CPU processing units, and can start the next synchronous configuration.

Specifically, the backup MCU reads the clock adjustment value of the CPU clock to be configured through the I2C bus.

Further, when a base synchronous configuration link or a CPU synchronous configuration link fails, reconfirmation needs to be carried out, and if the failure still exists after the reconfirmation, the master MCU and the backup MCU are started for self-checking; and if the self-checking result shows that one MCU fails and cannot be repaired, stopping data interaction between the master MCU and the backup MCU, and switching the dual-redundancy MCU clock configuration unit into a single-machine operation mode.

Specifically, as an embodiment, if the self-checking result indicates that the backup MCU has a failure, the master MCU and the slave MCU operate independently to complete the related configuration functions.

When a fault occurs in a data interaction comparison loop, the master MCU stores a clock compensation correction register value or a clock regulation value calculated by the master MCU into a self configuration information buffer area, continues to complete a clock configuration function, replaces the backup MCU to finish reading the clock compensation correction register value of a logic circuit clock or the clock regulation value of a CPU clock through an I2C bus, compares the clock compensation correction register value or the clock regulation value with the clock compensation correction register value or the clock regulation value in the local configuration information buffer area of the master MCU, and informs each CPU submodule of completing configuration if the comparison is correct, so that the single master MCU operates at present, and can start next synchronous configuration.

When a fault occurs when the backup MCU reads the clock compensation correction register value or the clock adjustment value to compare the cycle, the master MCU directly replaces the backup MCU to read the clock compensation correction register value or the clock adjustment value through the I2C bus and compares the clock compensation correction register value or the clock adjustment value with the clock compensation correction register value or the clock adjustment value of the local configuration information buffer area of the master MCU, if the comparison is correct, each CPU submodule is informed of completing configuration, the single master MCU operates at present, and the next synchronous configuration can be started.

Specifically, as another embodiment, if the self-checking result indicates that the master MCU has a fault, the original master MCU stops working, and the backup MCU is switched to the new master MCU and operated by the new master MCU.

When a fault occurs in a data interaction comparison loop, the new master MCU single machine stores a clock compensation correction register value or a clock regulation value calculated by the new master MCU single machine into a self configuration information buffer area to replace the original master MCU to complete a clock configuration function, reads the clock compensation correction register value or the clock regulation value through an I2C bus and compares the clock compensation correction register value or the clock regulation value with a clock compensation correction register value or a clock regulation value of a local configuration information buffer area, and informs each CPU submodule of completing configuration after the comparison is correct, wherein the original backup MCU single machine operates at present, and the next synchronous configuration can be started.

When data abnormality occurs when the backup MCU reads the clock compensation correction register value or the clock adjustment value for comparison, the new master MCU single machine performs the configuration of the clock compensation correction register value or the clock adjustment value again through I2C, the configuration value is based on the clock compensation correction register value or the clock adjustment value of the new master MCU configuration information buffer area, the clock compensation correction register value or the clock adjustment value is read after the configuration is completed and compared with the clock compensation correction register value or the clock adjustment value of the local configuration information buffer area, after the comparison is correct, the CPU sub-modules are informed of the completion of the configuration, the original backup MCU single machine operates at present, and the next synchronous configuration can be started.

The master MCU and the backup MCU can mutually check the clock configuration information, and can be switched into a single MCU operation mode when the single MCU fails, so that the normal work of the clock configuration MCU unit is not influenced, and the normal work of the configuration function is effectively ensured.

The beneficial effect that this application realized is as follows:

(1) according to the triple-modular redundancy computer clock synchronization method and the triple-modular redundancy computer clock synchronization system, the triple clocks are subjected to two-layer interactive voting, the asynchrony degree of the triple clocks is calculated according to the voting result, the hardware clocks are dynamically adjusted, the triple clocks are accurately synchronized, and a CPU module clock adjustment closed-loop feedback control system is formed in the whole process.

(2) The triple-modular redundancy computer clock synchronization system eliminates a single-point fault link by adopting the independent clock and the double-MCU redundancy hot backup clock configuration unit, realizes the full component redundancy of the whole CPU clock synchronization system, provides a high-reliability and high-precision clock synchronization solution for the triple-modular redundancy computer to realize high-speed and high-precision calculation, and has higher practical value.

(3) According to the triple-modular redundancy computer clock synchronization method, in the compensation process, the clock output value is directly compensated and debugged through clock count value feedback, the compensation precision can reach the clock magnitude, and the compensation precision is high.

(4) According to the triple-modular redundancy computer clock synchronization method, the problem that the synchronization reliability is reduced due to the fact that the asynchronous clock drifts along with the time is solved through flexible clock configuration.

While the preferred embodiments of the present application have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. Therefore, the scope of protection of the present application is intended to be interpreted to include the preferred embodiments and all variations and modifications that fall within the scope of the present application. It will be apparent to those skilled in the art that various changes and modifications may be made in the present application without departing from the spirit and scope of the application. Thus, if such modifications and variations of the present application fall within the scope of the present application and their equivalents, the present application is intended to include such modifications and variations as well.