Abstract: Digital high-voltage circuit breakers have advantages such as wear-free operation, high precision, and long service life; however, the failure of certain components can still cause significant losses to power systems and users. To improve the performance and reliability of circuit breakers and reduce accidents, two redundant DSP chips are used to implement the circuit breaker controller. This not only enables load sharing but also provides fault tolerance. When both chips are operating normally, each processes its own input signals. If one chip fails and cannot process the signal, the other chip independently takes over all processing tasks, thus improving the system's processing capacity and reliability. Keywords: Circuit breaker, fault tolerance, redundancy, fault diagnosis, reliability 1 High-voltage circuit breaker monitoring and control system [align=center] Figure 1 System composition of high-voltage circuit breaker monitoring and control system[/align] High-voltage circuit breaker monitoring and control system is widely used in power systems. When overload, short circuit and other faults occur, the high-voltage circuit breaker disconnects to protect power lines and power equipment. At the same time, it provides the power sector with basic parameters such as voltage, current, active power, reactive power, frequency, etc. After networking, it can detect the power quality in the region and judge whether the overall reliability, safety and stability of the power grid are within the specified indicators, providing strong support for the power sector to monitor the operation of the power grid. Figure 1 shows the high-voltage circuit breaker monitoring and control system, which consists of a power supply system, an electrical parameter conversion subsystem, a core control subsystem, an operating mechanism and drive subsystem, and a human-machine interface subsystem. Among them, the power supply system provides power to the entire system, the electrical parameter conversion subsystem converts the 10KV high voltage and hundreds of amps of large current into 0-3V DC signals that can be collected by the CPU, and the human-machine interface subsystem communicates with the core control subsystem using wireless and carrier wave methods. The core control subsystem is the heart of the entire control system. It acquires the signal transformed by the electrical parameter transformation subsystem, calculates the frequency and power, performs overcurrent detection, outputs opening and closing control commands, and communicates with the outside world. The drive subsystem receives the opening and closing control signals output by the core control subsystem, amplifies them, and uses them as control signals for the solid-state relays. The contacts of the solid-state relays serve as the power switches for the opening and closing relays in the circuit breaker operating mechanism. 2 Design of Circuit Breaker Control System Based on Redundancy Technology 2.1 Reliability Principle Reliability is the ability to perform a specified function under specified conditions and within a specified time. Redundancy is an effective method to achieve fault tolerance and improve reliability. To ensure that the circuit breaker works effectively under any load and to ensure the timeliness and accuracy of data, hardware redundancy is used to improve system reliability. Hardware redundancy involves equipping key components in the system with multiple identical physical components. Once a fault occurs, the faulty part can be quickly and automatically disconnected, and the backup system can be immediately activated. In Figure 1, the core control subsystem is the heart of the entire control system. Its failure will cause the entire system to fail; therefore, two TI TMS320LF2406 DSP chips are used for hardware redundancy. As shown in Figure 2, four (or more) input signals can be simultaneously input to two DSP chips. Through software programming, one chip can sample and process only two signals, while the other processes the remaining two. If one chip malfunctions, the fault diagnosis module will detect the fault and instruct the other chip to respond quickly and take over the processing of all four signals. In other words, only one chip processes the signals, equivalent to a single chip controlling the system. Whether a DSP chip has a soft or hard fault is mainly determined by detecting the key signals output by the DSP. If a fault signal appears, a switch is initiated, allowing the fault-free chip to continue operating. The entire system mainly consists of four modules: a fault diagnosis module (including hard and soft fault diagnosis), a decision module, a program switching module, and a shared memory module. The shared memory is used to implement communication between the two chips, and the switching module is implemented in software. [align=center] Figure 2 Redundancy Design Scheme of Circuit Breaker Core Control Subsystem[/align] 2.2 Fault Diagnosis Module The fault diagnosis module is divided into a hard fault diagnosis module and a soft fault diagnosis module. The hardware circuitry of the hard fault diagnosis module is relatively simple. This module reads the output information indicating hardware faults from two DSPs and uses this information to detect whether a specific chip has failed. The hardware circuitry can be implemented using counters and flip-flops. Hard fault diagnosis can only diagnose and switch over when a hardware fault occurs in the DSP, and the occurrence rate of hardware faults is relatively low. Software faults are more common in the system, such as program crashes due to external interference, failure to enter interrupts, and infinite loops. Software faults are handled in the same way as hardware faults. First, a timer is set. During normal program operation, no error signal is generated; when a program fault occurs, an error signal is generated. If, due to some accidental cause (such as noise, electrostatic discharge, or accidental device failure), the program cannot run normally, deadlocks, or fails to enter interrupts, the system can be reset by timeout, allowing the program to overcome the dead zone and return to normal. If the fault cannot be overcome within the specified number of resets, an error signal is sent out, indicating that redundancy backup is needed. At the main program entry point of the controller, there is a judgment program that counts the number of timer resets. If the timer is reset a specified number of times consecutively, the fault is considered unresolvable by timeout reset, and a software error signal reset=0 (soft error) is sent. When the soft fault diagnosis module receives the reset=0 signal (reset=1 when the chip is working normally), it sends a fault signal to the automatic decision module, thereby instructing the program to switch to isolate the fault and activate redundancy backup. 2.3 Decision Module The main function of the decision module is to receive fault signals from the hard and soft fault diagnosis modules, and promptly send a control signal bio = 0 to the switching module according to their switching requests, notifying the program to switch, promptly isolating the faulty chip and activating redundancy backup, so that the system can recover to normal in a very short time. This module can be designed using D flip-flops. When an error signal arrives (signal transition), the D flip-flop outputs a signal to the DSP. 2.4 Program Switching Module The program switching module is implemented in software. The main flow of the switching program running on chip 1 is as follows: Based on the normal two-signal processing program of chip 1, a program segment for processing four signals is added. An instruction to check bio is inserted in each interrupt-waiting program segment. If bio=0 is detected, the program is switched (normally bio=1; when bio=0, it indicates a fault in chip 2), switching from the program segment processing two input signals to the program segment processing all four input signals. An external clock signal uses a timer with a period of 10µs. Therefore, the switching module checks the bio signal every 10µs, meaning that once a fault occurs, the program will switch within a maximum of 10µs. The flowchart of chip 1's processing is shown in Figure 3. (a) DSP1 main program flow (b) DSP1 normal operation two-channel signal processing flow [align=center] (a) DSP1 main program flow (b) DSP1 normal operation two-channel signal processing flow 3 DSP1 program flow chart and its switching[/align] As can be seen from the above flowchart, after the two chips are powered on, chip 1 first processes its own first and second channels of signals, while chip 2 is in standby mode. Each time chip 1 is in standby mode, it checks the bio signal to determine whether chip 2 has failed. Once chip 2 fails, bio=0, and the program executed by chip 1 is switched to run the program segment that processes four channels of signals. When chip 2 does not fail, chip 1 processes its own first and second channels of signals in sequence, then notifies chip 2 to process the other two channels of signals, and finally disables interrupts and no longer responds to interrupt requests, remaining in a waiting state. It can only respond again after chip 2 finishes processing and enables interrupts. Similarly, when chip 2 executes its program, it also periodically checks the value of bio to determine whether chip 1 has failed, and after processing the fourth channel of signals, it notifies chip 1 to process it, and so on. Because the program processing adopts distributed control, that is, the A/D conversion, PID processing, and D/A output of the four signals are executed in turn, and the program generates an interrupt every 10us, the sampling period of each signal is 40us. 3 Reliability Analysis Let the average failure rate of the two chips be λ, representing the average number of failures in the (0,t) time interval; let T be the average fault-free operating time in the (0,t) time interval; let R(t) be the reliability of a single chip, representing the probability that a single chip works normally in the (0,t) time interval. Then we have: R(t) = e[sup]-λt[/sup] t ≥ 0 where T =1/λ Since the system adopts a hot backup standby redundancy method, the reliability of this redundancy structure can be calculated by the following formula: Then the average fault-free time of the entire system is: Obviously, the average fault-free time of the system is 1.5 times that of single-machine operation. It can be seen that the reliability of the control system composed of two redundant chips is much higher than that of the control system composed of a single chip. 5. Conclusion The circuit breaker fault-tolerant design scheme based on redundancy technology using two DSP chips mainly completed the design of the communication interface between the two chips, the software and hardware fault diagnosis module, and the decision module. Based on this hardware foundation, a switching program for the two chips to share the processing of four signals and a program to implement the system's fault-tolerant function were designed. This reduced the amount of data processed by each chip, allowing for a further increase in the A/D sampling frequency. When one chip fails, the other chip will independently complete the processing of all input signals, thus effectively realizing the measurement and control of the power system and significantly improving the system's reliability. References: [1] Wang Jian, Zhao Haiyan. Redundancy design of controller based on CPLD. Microcomputer Information. Issue 13, 2005 [2] Heng Junshan, Zhen Chenggang. Research on software-based dual-CPU redundancy control. Microcomputer Information. Issue 21, 2005 [3] Yu Tongzheng, Xu Longxiang. Fault-tolerant design of magnetic bearing digital controller based on dual DSP. Electronic Design Application. January 2005 [4] Liao Huimin. Implementation of dual-CPU redundancy control of PLC controller. Hubei Electric Power. December 2005 [5] Liu Jian, Wei Guannan. Redundancy design of elevator control system reliability. Liaoning Chemical Industry. December 2003 [6] Zhang Yusheng, Sun Fengrui. Analysis and application research on fault tolerance of thermal system control. Thermal Science and Technology. Issue 6, 2003