[Objective] To address the cross-machine redundant fault-tolerance problem of virtual DCS controllers in thermal power plants under Hypervisor architecture, a VM -level cross -machine redundancy synchronization mechanism based on SR-IOV virtual links is proposed. In virtualized environments, controllers running as virtual machines on general-purpose servers must synchronize their control states across physical machines and Hypervisor layers, facing the challenges of virtualized I/O performance degradation, real-time master-slave role negotiation and fault detection, and bumpless control output transfer during switchover. 

[Methods] A VM -level paired cross machine redundancy architecture is designed, in which each VM is equipped with at least two VF redundant communication interfaces through SR-IOV passthrough technology. The VFs are bound to different physical ports of the 10 GbE network controller to achieve full-path physical redundancy from the VF level through the physical port level to the entire server lev el. A dual-task redundancy management protocol combining heartbeat and data synchronization is proposed. The heartbeat task runs as an independent thread and exchanges lightweight 64 -byte messages via dual A/B VFs at a 15 ms period to achieve millisecond -level fault detection and master -slave role 2 management. The consecutive loss threshold of N equals 4 is selected to tolerate one to two transient packet losses commonly observed on industrial Ethernet while maintaining fast detection speed. The data synchronization task is initiated by the primary VM and passively received by the standby VM through a dedicated server thread. IO data are fully synchronized through a dedicated thread, while FBD intermediate variables follow their respective logic execution task cycles ranging from 5 0 ms to 1 000 ms using a macro -level comprehensive yet micro-level tiered synchronization strategy—all intermediate variables are covered in their respective task cycles at the macro level, while the transmission is distributed acros s different time slots at the micro level to avoid instantaneous network congestion, thereby reducing master-standby computation deviation. 

[Results] A prototype system was built on the Phytium S5000C ARM processor and an embedded Type-1 Hypervisor platform, and experimentally verified using the actual control logic of a 600 MW ultra -supercritical thermal power unit as the workload. Under four fault injection scenarios —primary VM forced power -off (simulating server power supply failure), simultaneous disconnection of both A/B redundant link ports (simulating optical fiber interruption), vDCS runtime process abnormal exit, and Host single network disconnection —the master-standby switchover time is approximately 60 ms. The IO data end-to-end synchronization latency is approximately 85 μs for 2 KB of data transmitted in a 15 ms cycle. The FBD intermediate variable synchronization latency ranges from 76 μs to 185 μs, corresponding to data volumes from 0.2 KB to 18.6 KB, all substantially below their respective control task cycles of 5 ms to 1 000 ms. During the switchover process, the control output remains continuous and smooth, with no visible glitches on SCADA trend curves. A sinusoidal test signal generat ed by an FBD function block was monitored through the SCADA trend display, and no amplitude or phase discontinuity was observed at the switchover moment, providing intuitive visual verification of bumpless transfer. The FBD master -standby computation devia tion is controlled within a single task cycle. 

[Conclusions] The proposed mechanism can provide reliable fault-tolerant capability for virtual DCS controllers, offering engineering reference value for promoting the reliability and engineering application of domestically-produced autonomous controllable virtual DCS technology.