UA139373U - PLATFORM FOR FORMATION OF SECURE INFORMATION AND MANAGEMENT SYSTEMS (ICS) - Google Patents

Abstract

The platform contains a set of self-diagnostic modules with a unified architecture based on FPGA. The software contains platform logic and application logic. The ICS tool environment is RPCT software and / or FPGA software. ICS is configured from self-diagnostic platform modules that run under software control, so that platform logic performs control logic and diagnostic logic, application logic performs user-defined functions.

Description

The useful model belongs to the field of automatic devices, namely to the digital equipment of control and control systems of technological processes, and is intended for use in various areas of industry: in critical safety systems of dangerous productions and in systems of normal operation of industrial enterprises.

Known "Digital processing and control device", application MS 2009/147820, IPC СОбЕ11/34.

A digital processing and control device includes a plurality of modules and a motherboard connected to each module. Each module includes a main board with a main control FPGA and a control FPGA for sub-board installed, a human-machine interface processing sub-board with an interface processing FPGA installed, a data storage device for storing information about the human-machine interface sub-board that can be installed on the sub-board or on the main board. Each of the FPGAs is made with the possibility of recording transmission data in a given section of the transmission area and has a common transmission protocol for sharing transmission data between the corresponding modules. Modules can contain an I/O processing sub-board, with an installed I/O processing FPGA and an I/O element. The main control FPGA of the main board of the module is made with the possibility of performing the external input-output process. The modules may contain a diagnostic sub-board for determining the state of the main board and information within the data transmission area and determining the state of the I/O sub-board and other modules based on the state of the main board and information within the data transmission area, which makes it possible to perform diagnostics of each board within the module.

Disadvantages of this invention include: - modules consist of multiple universal boards, each of which performs its own functions. When any of the boards fails, the entire board needs to be replaced, accordingly, there is a need for a large number of spare boards, which requires significant costs and additional time to install a new board; - diagnosis of all devices is performed on the basis of the state of the main board and information inside the data transmission area, which does not provide complete control, the required depth of diagnosis, deterministic time of diagnosis. In addition, the use of a separate board for diagnostics leads to additional costs.

From Known "Configuration for a control system" according to the application UUO 2006/071918, IPC СО5В 15/00, which includes a set of control devices, each of which includes software objects, an application program, a system application program, an execution mechanism for executing application programs, which provides a single interface to internal functions in control devices. Software objects implement different types of internal functions for control devices, and standard functions that are common to all software devices of the same type. The program includes application program unified instructions that reflect the numbering and function calls for the entire system from the specified program objects, whose functions are used in building the functionality of control devices in application programs. The disadvantages of this invention include: - the use of software devices, each of which performs only its prescribed functions, and software that is developed for each of the software devices, the maintenance and verification of which is difficult and expensive; - the difficulty of verifying files before uploading them to the FPGA; - high probability of interruptions; - completeness of control is not ensured, depth of diagnosis, deterministic time of diagnosis is required.

Known "System and method for use in automation tools"! according to application 05 2015331400, which includes at least one field device with embedded basic software, a higher-order unit, operating programs for maintenance, a bus for communication of the higher-order unit with at least one field device.

The central unit contains a set of special software applications that are configured in accordance with the features of the technological process. The central unit provides the application specific software to the field device.

The disadvantages of this invention include: - the use of field devices and higher-order blocks, each of which is designed to perform only its prescribed functions, requires the manufacture of a large number of different blocks and field devices, which have a low level of manufacturability, which complicates the process of verification and licensing, not ensures the functional safety of devices and the operation of devices in the mode - work "at pace", and accordingly complicates the design of systems and leads to large

Gs10) costs;

- configuration of a set of special application software for field devices does not allow to minimize the risks of failures due to a common cause, does not ensure resistance against viruses of any kind, is inherent in modification, requires large costs for the development of a set of special application software.

All this does not provide the necessary resistance to the imposition of failures, as well as the integrity, functional safety and high reliability of the IC.

The creation of a group of inventions is based on the principle of modular development, the concept of safety and support for diversity, which ensure a high level of functional safety and reliability of ICs, the unification and simplicity of the design of modules and ICs, the completeness of the diagnostic and self-diagnostic process, and the minimization of the risks of failures due to a common cause.

One objective of this utility model is to provide a way to implement a platform and software for the development of secure information and control systems (ICS), which is based on the configuration of secure ICS from self-diagnostic platform modules with a unified architecture that operate under the control of software based on

FPGA, development and configuration of modules according to a unified architecture from unified nodes, development and configuration of software, provision of mutual diagnostics and self-diagnosis of the hardware part, electronic projects, interfaces and means of data transmission at the level of modules and the system as a whole, implemented by means of hardware design and electronic projects modules, the use of various software tools to create subversive application logic, allows you to ensure the functional security of ICS, simplify the design of modules and ICS, unify the process and ensure the completeness of diagnostics and self-diagnosis, simplify the user's work, simplify maintenance and support of ICS.

Another task of the useful model is to create a platform based on a hardware-changeable part, the hardware design and electronic projects of which are intended for the development of safe information and control systems (ICS), by creating self-diagnostic modules with a unified architecture based on FPGAs from unified nodes, use in the implementation of modules, the operation of nodes in various clock domains and diverse technologies, provision of diagnostic tools with the function of self-diagnosis and mutual diagnostics, the use of connections according to a proprietary protocol, completeness with individual protection means, allows to simplify the design of modules and ICS, to ensure their maximum manufacturability and adaptability to verification , certification and licensing, to ensure the work of modules in the "work at a pace" mode.

Another task is to create software for secure information and control systems (ICS), built from platform modules by implementing software in the FPGA of each module in the form of a finite state machine with a strictly deterministic execution time, and based on platform logic (Rianogt Iodis) and logic applications (arriisayop

Iodis), provides resistance against viruses of any kind, minimizes the risks of common cause failures within the framework of one platform, does not allow external users to recompile FPGA projects.

The task is solved by the fact that in the method of implementing the platform and software for the development of secure information and control systems (ICS), where the platform is implemented using programmable logic integrated circuits (PLCs) and contains hardware, electronic projects, interfaces and data transmission means, according to the utility model, provide a plurality of self-diagnostic platform modules that have a unified architecture and implement different types of functions for said ICs, provide software that includes platform logic for performing various types of functions for the ICs in said modules and application logic for performing the functions, defined by the user for each of the applications in the specified ICS, provide interfaces and means of data transmission, configure the ICS from self-diagnostic modules with a unified architecture based on FPGAs, working under software control in such a way that the platform logic using the FPGAs of each of the modules executes control logic and diagnostic logic, application logic performs functions defined by the user for each of the applications in the specified ICS, which are performed by the platform logic using the FPGA logic module, while the control logic, diagnostic logic and watchdog operation are performed in different clock domains of each of the specified modules using various technologies, in addition to diagnostics and self-diagnosis of electronic projects, hardware, interfaces, and data transmission devices are performed in such a way as to ensure the detection of errors at the level of modules and the system as a whole, as well as the selection of errors by level of criticality. They provide the construction of both safe simple single-channel information and control systems and systems resistant to common cause failures by combining diverse channels using optical communication lines into two-, three-, and four-channel systems using majority voting of signals by principle "1002", "2003" and "2004". The method provides the possibility of using different software tools on the same hardware. VRST software is used as an instrumental environment for creating ICS based on the platform. The software tool of the FPGA manufacturer is used as an instrumental environment for creating ICS based on the platform. The diversity of the application logic is provided by implementing: - the possibility of using VRST software and/or the manufacturer's software

FPGA and/or other software tools; - various development and verification processes; - different implementation principles.

Diagnostics and self-diagnosis of electronic projects, hardware, interfaces and means of data transmission at the level of modules and the system as a whole provides detection of 3 types of errors: errors of type I and II, which bring the system to a safe state: - errors of critical type (type I) , which are detected by the watchdog means, when the platform control logic may not guarantee a transition to a safe state; - critical type errors (II type), when hardware or part of electronic projects cannot perform their functions correctly; - and errors (PI type), the criticality and processing algorithm of which is determined by the user and executed by the application logic.

Self-diagnosis of electronic projects is performed with the help of electronic FPGA projects themselves. Diagnostics of hardware is carried out by means of hardware design of nodes or their layout within the module. In the configuration, there are two logic modules - the logic modules diagnose each other's status. Self-diagnosis of nodes is performed with the help of electronic projects of each of the modules and the module with the help of such nodes.

Mutual diagnostics of hardware is performed using a combination of clock generator nodes as a result of exchanging data and signals between different clock domains.

Self-diagnosis of interfaces and means of data transmission is performed using

From electronic projects FPLIS. Diagnostics of the FPGA operation is provided by a watchdog timer. Self-diagnostics of the performed functions are provided by the diagnostic functions of electronic FPGA projects. Diagnostics is performed at the platform level, which is configured by the platform manufacturer, and at the application logic level, which is configured by the user or the platform manufacturer.

A platform for the development of secure information and control systems (ICS) that is implemented using a FPGA and includes hardware and electronic designs, according to a useful model, contains a plurality of self-diagnostic modules that have a unified architecture based on the FPGA and implement various types of functions to provide functionality

ICS that operate under the control of software that includes platform logic and application logic, contains interfaces and means of data transmission, while each of the plurality of self-diagnostic modules with a unified architecture contains nodes that perform unified functions that are common to all nodes of the same type in in different modules of the platform, nodes that perform different types of internal functions specific to each of the modules, independent means of checking and diagnosing hardware, software, interfaces and data transmission means, which are made with the function of self-diagnosis and with the function of mutual diagnosis of these means in real time , the functioning of which is based on the operation of nodes in different clock domains and the use of various technologies for the implementation of these nodes, modules exchange data with each other using "point-to-point" communication channels according to a proprietary exchange protocol, the platform contains individual means of protection against overloads by current and voltage for each of the modules. The platform contains several modules of inputs, outputs, optical communication and logical modules. Each of the modules is connected to a logical module through a common cross board. Each of the specified modules contains at least one: FPGA node, clock generator node IC A, clock generator node IC B, clock generator node IC C, display node, communications node, because the power supply and watchdog node,

EERVOM non-volatile memory node.

The clock generator nodes (SIK) are implemented in different clock domains, each of which performs the functions defined for it: clock generator node SIKA - generation of watchdog timer clocks, clock generator node SIKV - generation of diagnostic logic clocks, clock generator node SI KS - generation of clocks of the control logic.

The watchdog timer is implemented on diversions of the technology in relation to the main computing power of the FPGA. The logical module additionally contains at least one: addressing node, BOVAM RAM node, real-time node, input node, output node, external communications node, bypass node.

The optical communication module additionally contains at least one external communications node.

The input module additionally contains at least one input node. The output module additionally contains at least one: output node, bypass node.

Modification of work algorithms (platform logic) of modules for the user is impossible.

The function of mutual diagnosis of independent means of verification and diagnosis in real time is ensured by the operation of nodes in different clock domains and the use of various technologies in the implementation of these nodes. Individual means of protection against current and voltage overloads for each of the modules are implemented in the form of a separate board. The platform contains independent means of ensuring the temperature regime - at least one ventilation module independent of operating conditions and power circuits. Modules are installed in a hardware operating-autonomous product, which can be represented by a chassis, etc. Depending on the configuration, the platform provides for the use of two logical modules, which

They are installed in an operating-autonomous product. In a configuration with two logic modules, the logic modules are interconnected by means of at least two full-duplex communication lines of the MOB type (Iom/-moMade ayegepia! zidpaiitaoa, low-voltage differential signaling). In a configuration with two logical modules - one of the logical modules works in hot standby. Modules are connected to each of the logical modules using at least one dedicated full-duplex type I MO5 communication line.

Software for secure information and control systems (ICS) built from platform modules, according to a utility model, is software implemented on a FPGA in the form of a finite state machine with strictly deterministic execution time and contains platform logic to perform various types of functions for the ICS in the specified modules for managing system operation and implementing diagnostic functions of the system, and application logic containing a set of instructions that contain function calls from the library of functional blocks defined by the user for each of the applications in the specified ICS, which are executed by the platform logic.

Platform logic and application logic are divided into independent parts. The platform logic using the FPGA of each of the modules performs control of module nodes, diagnostic and communication functions, and also performs application logic. Platform logic is developed by the manufacturer, loaded into non-volatile memory at the manufacturing stage at the manufacturer's factory and is not subject to modification. The application logic performs user-defined functions for each of the applications that the platform logic performs using the FPGA logic module.

Application logic is configured from the contents of the library of functional blocks using the PRST tool environment and/or the software of the FPGA manufacturer. Application logic (user algorithms) is developed at the stage of operational design, after which it is loaded into non-volatile memory and executed in logical modules. Application logic is stored on external non-volatile memory and/or is part of the FPGA logic module.

The software is made with the possibility of adaptation to new devices regardless of the model (family, etc.) of the hardware. Modification of application logic algorithms without interrupting the operation of the system on digital networks is not possible and is carried out only when installing using special download devices. For the logic of applications (user algorithms) through the engineering station with the observance of access rights, it is possible to change the parameters of the signals within the previously allowed limits, as well as to change the settings of the delay elements of the formation of signals in time. For input/output modules through the engineering station with the observance of access rights, the possibility of configuring settings (scale, signal level, corrections, damping time, delay time to eliminate rattle, etc.) is provided. Diagnostics is performed at the platform level and at the application logic level, if necessary.

The tooling environment for ICs built on the basis of the platform, according to the useful model, is HPST software for creating application logic, verifying the created application logic and loading it into the logic module of the platform, while the platform logic contains an environment for executing application logic, a library of functional of blocks is the same for all systems, the application logic is a set of calls of functional blocks from the library, in addition, the platform logic and the library of functional blocks are developed by the platform manufacturer, are loaded into non-volatile memory at the manufacturing stage at the manufacturing plant and are not subject to modification, the application logic is developed by the user or platform manufacturer.

The tooling environment for ICs built on the basis of the platform, according to the utility model, is software for creating application logic ready for execution, while the platform logic is developed by the platform manufacturer, the library of functional blocks is the same for all systems, the application logic is created in the software environment provision of the FPGA manufacturer by the user or platform manufacturer.

The proposed group of inventions is distinguished by the presence of a new set of features that provide new technical properties. The technical result is the maximum manufacturability of modules, unification and simplicity of design of modules and ICS, unification of the process of diagnosis and self-diagnosis, completeness of control and the necessary depth of diagnosis, resistance to the imposition of failures, integrity, functional safety and high reliability of ICS, increases the speed of operation, simplifies the user's work.

The creation of a group of inventions "Method of implementation of a platform and software for the development of secure information and control systems (ICS)" is the basis for creating a group of inventions: - the principle of modular development (todshiag devzidp), which includes hardware, software (riayogpt iodis), application logic (arriisayop odis), allows to maximally unify the structure of modules with self-checking means of diagnosis,

Zo ensures the simplicity of the design of modules and ICs and the possibility of creating new platform modules built in accordance with this principle in the future; - the concept of security (Zaieiyu SopserO, according to which modules are created according to a unified architecture, ensures their maximum manufacturability (ease of development and configuration), adaptability to verification and licensing due to the repeatability of components and devices, allows use on the same hardware as a tool environment, various software tools (VRST, FPGA manufacturer’s software tools, or other software tools), provides the possibility of using diverse technologies to increase the reliability of IC, gives the user the opportunity to choose; - diversity support - it is possible to use different VRST software tools on the same hardware, FPGA manufacturer's software tools, etc.) to create subversive application logic, allows you to minimize the risks of common cause failures within the framework of one platform.

The configuration of the indicated ICS with self-diagnostic modules with a unified architecture based on FPGAs, operating under the control of software in the form of a state machine with a strictly deterministic execution time and implemented in the FPGAs of each of the modules ensures the integrity, high level of functional safety and reliability of the systems.

Using a configuration in the platform with two logical modules (LMs) operating in hot standby, connected to each other by means of at least two full-duplex communication lines of type I! МО5 and perform diagnostics of each other's condition, increases the reliability of ICS - in case of failure of one of the IMs, the work will be continued by the other IM.

The configuration of modules according to a unified architecture based on FPGAs from the same type of nodes with self-verifying means of diagnostics allows to maximally unify and thereby simplify the structure of modules, which ensures their maximum manufacturability, ease of development and configuration, adaptability to verification and licensing due to the repeatability of components and devices, allows to simplify user work.

Platform modules have a high level of determinism: the entire work cycle is divided into phases (processing of input information, execution of the program, formation of output information, waiting, etc.), control of the execution time of each phase is implemented.

The design of the modules provides the possibility of flexible configuration of the redundant structures of 60 systems due to the introduction of the required level and types of redundancy.

The implementation of ventilation modules in the form of separate boards significantly simplifies the maintenance of systems based on the platform, because if the ventilation module fails, it can be quickly replaced.

The use of independent tools for checking and diagnosing hardware, software, interfaces and data transmission tools, performed with the self-diagnosis function and the function of mutual diagnosis of these tools in real time (within the system operation cycle), based on the operation of nodes in different clock domains and the use of subversive technologies in the implementation of these nodes to ensure the function of mutual diagnostics, ensures the completeness of control and the necessary depth of diagnostics in a strictly determined execution time, makes the decision-making process more flexible.

Performing diagnostics at the platform level, which is configured by the platform manufacturer, and at the level of application logic, which is configured by the user, if necessary, provides the necessary level of failure detection (99.9 95), the flexibility of implementing ICS diagnostics.

The use of software in the form of an automaton with a deterministic execution time (without interruptions) and divided into independent parts - platform logic (riancogt

Iodis), and application logic (arriisayop Iodis), does not allow external users to recompile FPGA projects, provides resistance against viruses of any kind, minimizes the risks of common cause failures within the framework of one platform, allows ICS to perform its functions without interruptions and the operating system.

The implementation of control logic, diagnostic logic and watchdog operation in different clock domains (clock generator nodes: SIK A, SIK S, SIK B) of each of the specified modules allows you to separate the control and management functions from the diagnostic functions, make them independent of each other.

Implementation of the watchdog timer (U/aisnasoa) on diversionary technology (sotrieh rgodgattabie

Iodis demise SRIO) in relation to the main computing capacities of the FPGA (Tieia rgodgattaibie daie atau ERSA) allows to minimize failures due to a common cause within the framework of the module and the system as a whole.

Use of the tool environment in the form of VRST software (a set of tools for configuring the Naidib5 platform (Rianopt Sopiidigayop Tooizei VRST) and/or software of the FPGA manufacturer and/or other software, as well as

From different processes of development and verification and different principles of execution, it allows to create diverse application logic.

When implementing software in FPGA and dividing it into platform logic (rianogt

Iodis) and application logic (arriisaiop Iodis) there is no possibility of remote ICS configuration and software replacement, which excludes the possibility of a cyber attack on technological equipment by viruses of any kind.

The platform logic (opt odyssey) is developed by the platform manufacturer, includes exclusively proprietary software, is loaded into non-volatile memory at the manufacturing stage and is not subject to modification, which ensures a high level of security

ICs that are being developed. The platform logic is easily ported to new devices, there is no dependence on the model/family, etc. hardware.

The application logic (arriysayop Iodis) is developed for each of the applications by the user or platform manufacturer at the stage of operational design, while the modification of the application logic algorithms without interrupting the operation of the system over digital networks is not possible and is carried out only when installed using special download devices, which ensures absolute stability to viruses of any kind.

The use of a proprietary data exchange protocol between modules provides multi-level protection of the integrity of notifications from damage and external attacks.

On-line control of data integrity and protection against unauthorized intervention is ensured by a set of measures, which includes monotonicity control, checksum verification (SVC), IS identifier verification, frame numbering control, and others.

The modular principle of IC construction, the implementation of algorithms in FPGAs and the use of software in the form of a finite state machine with a strictly deterministic usage time, divided into independent parts, allows the design of ICs of various types of configuration and different levels and types of redundancy, and ensures the simplicity of the development of ICs based on the platform.

List of figures.

Fig. 1. Classification of self-diagnosis techniques.

Fig. 2. Context diagram of the platform.

Fig. 3. Context diagram of a multi-chassis platform.

Fig. 4. General appearance of the chassis. because Fig. 5. Chassis configuration.

Fig. 6. Typical module architecture.

Fig. 7. Exchange of data and signals between different clock domains.

Fig. 8. Diagram of transitions between states.

The method of implementation of the platform and software for the development of secure information and control systems (ICS) is carried out as follows.

Provide a set of self-diagnostic modules of the platform, which have a unified architecture and which implement different types of functions for the specified ICS. Provide software that contains platform logic (Rianzopt Iodis) to perform various types of functions for ICS in the specified modules and application logic (arriysayop Iodis) to perform functions defined by the user for each of the applications in the specified ICS. As a tool environment for creating systems based on the platform, the VRST software and/or the FPGA manufacturer's software are used. They provide interfaces and means of data transmission.

Configure the ICS with self-diagnostic modules with a unified architecture based on FPGAs, operating under software control in such a way that the platform logic using the FPGAs of each of the modules performs control logic and diagnostic logic, the application logic performs functions defined by the user for each of the applications in the specified ICS , which are performed by the platform logic using the FPGA logic module (IM). The control logic, diagnostic logic, and watchdog operation (UMaisnaod) are performed in different clock domains of each of the specified modules using various technologies. Diagnostics "(and self-diagnosis of electronic projects, hardware, interfaces and means of data transmission are performed in such a way as to ensure the detection of errors at the level of modules and the system as a whole, as well as the selection of errors by the level of criticality.

The method provides for the construction of both safe simple single-channel information and control systems and systems resistant to common cause failures by combining diverse channels with the help of optical communication lines into two-, three-, and four-channel systems using the majority voting signals according to the principle of "1002", "2003" and "2004".

The method provides the possibility of using different software tools on the same hardware, including for the implementation of application logic.

Zo As an instrumental environment for creating ICS on the basis of the platform, the software tool VRST of its own development (pote-tade) is used (instrumental environment for the development of Nadibe Rianopt Sopiidigayop Tooisei VRST) and/or the software tool of the manufacturer

FPGA (for example, Otsapiz (AppPega) tool development environment);

To ensure the diversity of the application logic, the following software tool is used: AVRST (Vaidis5 Rianogt development tool

Sopiidigayop Tooizei VRST); the software tool of the FPGA manufacturer (for example, the tool development environment

covered); other software tools; various development and verification processes; different implementation principles.

Diagnostics and self-diagnosis of electronic projects, hardware, interfaces and means of data transmission at the level of modules and the system as a whole provides detection of 3 types of errors: errors of type I and II, which bring the system to a safe state: errors of critical type (type |) , which are detected by the means of the watchdog timer (U/aisnaso), when the platform control logic may not guarantee the transition to a safe state and the watchdog timer (U/aispaod) must stop the supply of voltage, errors, critical type (Ii type), when the hardware means (NMU ) or a part of electronic projects (EF) cannot perform its functions correctly, but the transition to a safe state will be ensured by another part of the platform; and errors (type I), the criticality and processing algorithm of which is determined by the user and executed by the application logic.

Approaches to ensuring the integrity and functional security used in the platform are divided into three main groups: 1) Self-diagnosis of hardware (NUU 50); 2) Self-diagnosis of interfaces and means of data transmission (IE 50); 3) Self-diagnosis of electronic projects (EU 50).

They are all integrated with each other. 60 Hardware self-diagnosis (NMU 50).

Errors detected by the self-diagnosis are divided into three types (Types II, II and II) at the level of modules and at the level of the system.

At the level of modules: a) Errors of the level of detection by means of the watchdog timer (U/aisndod) (type I) - the platform control logic may not guarantee the transition to a safe state, then the watchdog timer must stop supplying voltage (for example, when a FPGA error is detected); b) Errors of a critical level (type II) - hardware means (NMU) or part of electronic projects (EO) cannot perform their functions correctly, but another part of the platform, which controls the outputs that are related to safety, can guarantee their automatic transition to a safe state (for example, when the module receives damaged data, its outputs will be transferred to a safe state); c) Errors of the level defined by the user (type I), - the user defines the criticality of the detected errors and the algorithm for their processing (which is performed by the application logic). The platform control logic and the application logic guarantee the transition to a safe state (for example, input signal values that are outside the limits, input channel failure, input module failure, in this case, the application logic makes a decision about the severity of the failure).

At the system level:

If a type I error occurs in the I/O module, the application logic in the logic module (LM) decides how to handle it (this is the responsibility of the end user), but with a type I or II error in the logic module (IM), it is interpreted as type product level error and all outputs are placed in a safe state.

If the output module detects a type II error, it must transfer its outputs to a safe state and notify the logic module (II M); if the I/O module detects a type I error, it must be de-energized and the platform will enter a safe state due to the lack of communication between the logic module (I M) and this module (type I for I M).

Thus, there are three ways for the platform to enter a safe state. Each of them can perform a transition of outputs.

Self-diagnosis is performed in a time not exceeding 300 m.

Self-diagnosis notifies you when a failure is detected at a speed that allows you to perform

From the transition in a time not exceeding 10 ms.

The classification of self-diagnosis techniques is shown in Fig. 1.

The hardware of the platform (NM/) directly interacts with the interfaces, determining the validity and integrity of the data. Hardware nodes are covered with diagnostics, which is implemented by means of their hardware design (NUMO 50), which allows diagnosing the functioning of each component, and/or their arrangement within the module (NUMO 50).

In the configuration, there are two logical modules (LMs) - the logical modules diagnose each other's status.

Self-diagnosis of electronic projects (EU 50).

Self-diagnosis of electronic projects is carried out with the help of electronic projects

PLIS.

FPGA electronic projects directly accept, process and form data for the functioning of the platform. Perform the task of covering diagnostics of interfaces and hardware, as well as their own components. Thus, based on the diagnostic results, a decision is made to transfer the system to the appropriate state.

Self-diagnosis of electronic projects (EO 50) includes: self-diagnosis of data with random access (NAO 50); self-diagnosis of packet data (RO 50); self-diagnosis of electronic project modules (MEO 50); self-diagnosis of the library of functional blocks (AEVI 50).

The electronic projects of each of the modules perform self-diagnosis of the nodes themselves and the module with the help of such nodes.

Mutual diagnostics of hardware is carried out using a combination of clock generator nodes (CGC) as a result of exchanging data and signals between different clock domains.

Self-diagnosis of interfaces and means of data transmission (IEE 50). Self-diagnosis of interfaces and means of data transmission is performed with the help of electronic FPGA projects.

Measures to ensure IE 50: checking the checksum of the CAC - provides a check of data integrity, the counter - provides control of monotony,

IU identifier check - provides identification of the data transmission protocol (including identification of the source and recipient), frame numbering control - provides a check of the monotony of frame transmission, timeout - provides a diagnosis of the integrity of the communication line, confirmation - provides a diagnosis of the functioning of the source and recipient, a unique check of the IO for of transmitted data via optical channels OSM to OSM, I Mdo1M and

IM to OSM).

Also, electronic projects provide self-diagnosis of data transmission protocols (OTR 50) and verification of EERVOM data compatibility.

Diagnostics of the operation of the FPGA is provided by the watchdog timer (U/aisnas).

Self-diagnosis of the performed functions is provided by the diagnostic functions of the FPGA electronic projects: continuous checksum check (CAC) of the FPGA configuration: as part of the platform logic; as part of the FPGA hardware function.

Diagnostics is performed at the platform level, which is configured by the platform manufacturer, and, if necessary, at the application logic level, which is configured by the user or the platform manufacturer.

The platform is a safety controller (E5C), which is based on the architecture of a hardware-changeable part, the technical and software tools of which are designed for the construction of safe information and control systems (ICS), for the performance of various tasks at nuclear and thermal plants, oil and gas, chemical and others industries. Examples of such systems can be automated technological process control systems (ASCP), safety control systems (CSS), critical control systems (CSC), etc., which are used in nuclear and thermal energy, chemical production, etc.

From the point of view of functionality, the platform is a safety controller (E5C), which is fundamentally different in that the logic is executed by FPGAs, not by microprocessors.

The platform is based on the joint work of a set of self-diagnostic modules that have a unified architecture based on FPGAs, from which safe information and control systems are configured

From the system (ICS). However, ICs built on the basis of the platform can work even if there is only a logical module.

The hardware-changeable part of the platform can be represented by a chassis (etc.), which contains the required number of inputs, outputs, logic processing, which are designed to implement application logic.

The platform contains several input modules (AIIM, AIEM, BIM, etc.), outputs (AOM, COM, etc.), optical communication (OSM) and logic modules (IM). Each of the modules is connected to a logical module through a common cross board. Modules exchange data with each other using point-to-point communication channels using a proprietary exchange protocol.

Each of the modules is equipped with individual means of protection against current and voltage overloads, which are implemented in the form of a separate board.

The platform contains independent means of ensuring the temperature regime - at least one ventilation module independent of operating conditions and power circuits, which provides forced cooling of the chassis.

The following ICS configurations are provided, which correspond to level 51! C: 1) Single-channel (hardware redundancy - 0); 2) Multi-channel (hardware redundancy 20).

The operation of the platform is ensured by the joint operation of the basic configuration (set) of modules during their normal functioning and connected to the source of input signals and consumers of output signals.

The basic configuration refers to the implementation in the form of one chassis (Fig. 2), but expansion using several chassis (Fig. 3) is provided for the construction of large ICs or to ensure an increased level of safety.

The general appearance of the chassis is presented in Fig. 4. Structurally, the chassis is a metal case that contains 16 slots 1 for modules, interface connectors 2, slots C for ventilation modules and their control boards, slots 4 for protection modules. Each slot is equipped with rails for correct and safe installation of modules. Each module is fixed from above and below. The electrical connection of each module is carried out after installing the module in the interface connector 2.

The chassis of the platform can contain one or two logical modules of I M and the required number of input modules, output modules, and optical communication modules.

Depending on the number of logical modules used, the following configurations are possible: with one logical module I M; with two logic modules AND M.

In a configuration with two logic modules, the logic modules have the same work algorithms and provide mutual redundancy of each other within the chassis, that is, they work in hot standby. Logical modules are connected to each other using at least 2 full-duplex communication lines of the IMO5 type. Modules are connected to each of the logical modules using at least one dedicated full-duplex type I MO5 communication line.

The configuration of the chassis is shown in Fig. 5.

The platform chassis contains two slots (E1 and Eg) for logic modules and 14 slots for modules of another type. Slots 1-14 may contain input modules, output modules, optical communication modules, or may not contain any modules.

A typical platform module architecture is shown in Fig. 6.

Each of the plurality of self-diagnostic modules with a unified architecture includes node 5

PLC (Rianogt Iodis ERSA), node 6 SIK A - generation of watchdog timer clocks (U/aisnaoov), node 7 SIK B - generation of diagnostic logic clocks, node 8 SIK C - generation of control logic clocks, node 9 indication (IVI), node 10 of communications (GAM, ORTO, and MO5), node 11 of power supply and watchdog timer (Rozhsheg Zirriu e UMaisndod), node 12 of non-volatile memory

EERVOM. At the same time, the watchdog timer (UUaisndod) is implemented on a diversionary technology (sotrieh rgodgattabie Iodis demise SRIO) in relation to the main computing power of the FPGA (Tieid rgodgattabie daie atau ERSA).

Each logic module of the IM additionally contains node 13 of addressing (Adage55), node 14 of RAM (Z5VAM), node 15 of real time (Veai Tite), node 16 of inputs, node 17 of outputs, node 18 of external communications (VOR, VTE), junction 19 of the bypass (Zaieiu Omeitide). Each logical module of IM can contain several nodes 12 non-volatile memory (EERVOM) for storing software.

Each module of optical communication additionally contains a node of 18 external communications.

Each input module additionally contains a node of 16 inputs.

Each output module additionally contains a node 17 outputs, a node 19 bypass.

The platform, if necessary, can include other modules and devices to ensure its functioning.

Nodes of the clock generator (SIK A, B, C).

SI K A, B, C clock generator nodes are a source of frequency clocks for FPGA projects.

Functions: node SIKA - generation of clocks of the watchdog timer (UUaisnaso) (UMO SIK), node SIKV - diagnostics of processing of the PLC node (Oiayad SIK), node SIKS - the main functions of the PLC node - control and configuration of the control logic (Maip

JUICE).

Safety functions: FPGA and watchdog diagnostics (U/AIsnaood), the combination of IC nodes provides mutual diagnostics due to the exchange of data and signals between different clock domains. The exchange of data and signals between different clock domains is shown in figure 7.

PLIS node.

Functions: provision of safety-critical functions: receiving input data, performing basic module functions (data processing, implementation of application logic, etc.) and diagnostics, generating output data, exchanging data with other modules (as within the chassis, as well as beyond it) with the help of interfaces AND! MO5 Ipiepase, Rireg Oriis (VRR) Ipiepase and H5-232 Ipiepase; provision of functions not critical from the point of view of safety (which do not affect functions critical from the point of view of safety): interaction with external memory (critical for safety in the START mode), data transfer using Rirbeg Oriis OOR-razei (VIR) interfaces

Ipiepassee and Rireg Oriis Tipipu (VR) Ipiepassee to external devices.

Security functions: separation of control logic functions and diagnostic functions by using two separate clock domains (Fig. 7): IC KV is used for processing diagnostics, IC C - for control logic processing and configuration; self-diagnosis of the performed functions is provided by the functions of the electronic FPGA projects:

a) continuous checking of the checksum of the SAC of the FPGA configuration, which is stored in the configuration device and comparison with the pre-calculated value of the SAC obtained from

Zeglise EERVOM, in order to check the loading of the corresponding configuration into the module configuration device (critical for safety only in the START mode), b) continuous check of the SAC checksum for the 558AM configured by the FPGA and comparison with the pre-calculated SAC value obtained at the end of the configuration (built-in function for the FPGA), c) diagnosis of the FPGA operation is provided by a watchdog timer (U/aisnasa), d) the FPGA reads the temperature value, and the end user is responsible for the appropriate action (notification or shutdown).

Indication node (IV).

Functions: provision of information display for the user (information depends on the mode and type of the module) and the possibility of switching to the CONFIGURATION mode.

Security functions: the node can affect the operation of the module only during the first 10 or 20 seconds of the START mode, to transfer the module to the CONFIGURATION mode, you need to press the buttons in a certain sequence for a certain period of time (no more than 20 seconds).

The node of entrances (apaiod-tyu-aidya! sopmegviop AOS, aivsteiee iprshii tspii OO, peshhop o ХЯih teazigetepi MEM).

Functions: provision of receiving input data through interaction with the input-output interface (/0 Ipiepasse).

Security functions: the hardware design includes means of ensuring NU 50,

NU 50 is provided by several approaches: NM design and electronic project

FPGA, providing diagnostics of the integrity of interfaces 1/0.

Koo) Node of exits (aizsteie oshiryi ipii OO, aidyaI-yu-apaod sopmegviop SAS).

Functions: ensuring the formation of output data by means of interaction with the input-output interface (1/0 Ipiepasse).

Security functions: the hardware design includes means of ensuring NU 50,

NU 50 is provided by several approaches: NM design and electronic project

FPGA, ensuring diagnostics of the integrity of interfaces 1/0, when the power is turned off, the outputs are transferred to a safe state.

Communications nodes (Iosa! atea peimoiKk GAM, ORTO, I MO5 and H5-232)

Functions: provision of data and implementation of data exchange within and between the chassis, direct interaction with all communication interfaces, use of various protocols (Nadiu Rgoriieiagu RgoisoI-APP, Nadiu OOR Bazey Rgoiso!-

VIR, Nadiu A5-232 times Rgoiyuso-H5-232).

Security features: node diagnosis is performed by diagnosing the data transmitted through it, diagnosis of the data transmitted is performed by the data transfer protocol and the electronic design of the FPGA,

Eireg Oriis (VOR) Ipiepasse is de-energized unless the Setup switch is in the SETUP position and the platform is not in SETUP mode, all external communication channels are optically isolated, output to the monitoring station is unidirectional.

Power and watchdog node (Romzheg Zirriu is UMaispaod).

Functions: supply of voltage to all hardware nodes, voltage control and hardware self-diagnosis (NMU 50) of the FPGA node.

Security features:

diagnostics of the supply voltage is performed by Omeitapde and Monyade zireguizog a Maisnasad controllers, FPGA diagnostics is performed on the basis of data exchange Moiiade ziregmizog b UMaisnaoa and

FPGA with the help of Uu/aisnaod Ipiepasse, when type I errors are detected, the supply of voltage to all nodes of the module is stopped, with the exception of the power node and the watchdog timer.

Bypass node (Zaieiu Ome!tiae).

Functions: ensuring the transition of the modules to a safe state by de-energizing the output nodes, regardless of the control signals for them from the FPGA node. Direct interaction with Zaieiu Omeitide Ipiepase interface.

Safety functions: three channels of the input signal of the module are implemented according to scheme 2003 to transfer the output nodes to a safe state (set the signal (ZOV (bypass node)), when power is supplied to the module, the output nodes go to a safe state until the operator sets the signal to cancel the stay module output nodes in safe mode (BOM restart); the OB signal must be high at this time, provides an OK status signal for the FPGA to check its activity/inactivity during the set 5OB keys.

Addressing node (Adagev5).

Functions: providing voltage to the jumpers located on the rear panel, which allow you to set the unique ID of the IM module within the entire security system.

Direct interaction with the Aaagezz Ipiepasse interface. The unique identifier of the IM module does not affect its security functions. If an error occurs when reading such jumpers at power-on, the mismatch between the value of such read identifier and the value stored in the EERVOM will cause the boot to fail and the platform to enter a safe state.

Immediately after starting the IM logic module, it sets its own IP address based on the identifier. If its value differs from the expected value of the monitoring station and

From the settings (MAT) or the settings station (Shipa 5iayop), the connection with the logic module I! M will not occur: transmission to the monitoring machine may not occur or setup may not be possible, which is not critical from a security point of view. However, security-related checks will be performed to ensure system availability.

Reliability functions: a separate source of the unique identifier IM for each logical module Г M,

САС-4-И1Т (ех) to ensure the verification of the integrity of the data of the unique identifier

IM, data storage only in START mode, and comparison with input data in other modes, node configuration information is displayed on the indicator.

EERVOM non-volatile memory node.

Functions: storage of various information necessary for the functioning of the module.

Security functions: write/read frames, data integrity check, frame numbering check, data identification.

RAM node (FOVAM).

Functions: data storage of application logic, necessary for the operation of the ICs.

Security features: data integrity check.

Real Time Node (Neai Tite).

Functions: receiving real-time data.

Safety features: no use of the time signal of any of the safety-critical functions, use of a special data format, galvanic isolation.

Software for secure information and control systems (ICS) built from platform modules is software implemented on a FPGA in the form of a finite state machine with a strictly deterministic execution time, and contains platform logic (Iodis feedback) to perform various types of functions for the ICS in the specified modules for managing the system operation and implementing diagnostic functions of the system, and the logic of applications (arriisayop odis), which contains a set of instructions that contain function calls from the library of functional blocks (arriisayop Tipsiop bBiosk Ibgagu), defined by the user for each of the applications in the specified ICS , which are performed by the platform logic.

Platform logic and application logic are divided into independent parts.

The platform logic using the FPGA of each of the modules performs control of module nodes, diagnostic and communication functions, and also performs application logic.

Platform logic is developed by the manufacturer, loaded into non-volatile memory at the manufacturing stage at the manufacturing plant and is not subject to modification.

The application logic performs functions defined by the user for each of the applications, which are performed by the platform logic using the FPGA logic module I M.

Depending on the tasks, the application logic is configured from the contents of the library of functional blocks using the VRST tool environment and/or the software of the FPGA manufacturer.

The application logic (user algorithms) is developed at the stage of operational design, after which it is loaded into non-volatile memory and executed in logic modules of I M.

Application logic is stored on external non-volatile memory and/or is part of the FPGA logic module I M.

The software is made with the possibility of adaptation to new devices regardless of the model (family, etc.) of the hardware.

Modification of application logic algorithms without interrupting the operation of the system on digital networks is not possible and is carried out only when installed at the stage of the working project using special loading devices (for example, proprietary programmers).

For the logic of applications (user algorithms) through the engineering station with the observance of access rights, the possibility of changing the parameters of the signals within the previously allowed limits is provided,

Зо as well as changing the settings of the delay elements of signal formation in time.

For input/output modules, through the engineering station with respect for access rights, the possibility of configuring settings (scale, signal level, corrections, damping time, delay time to eliminate rattle, etc.) is provided.

Diagnostics is performed at the platform level and at the application logic level, if necessary.

As an instrumental environment for creating systems based on the platform, it is possible to use the ARST software or the software of the FPGA manufacturer (for example, Otsapiv, AMega).

The hardware of the platform is the same for any software. The differences are: application logic (arriisaiop Iodis); platform logic (rianogt Iodis).

In the case of using ARST, the platform logic additionally contains an environment for executing application logic, as well as a library of functional blocks, which is the same for all systems, the application logic is a set of calls to functional blocks from the library.

In the case of using the software of the FPGA manufacturer (for example, Otsapiv,

The AI library of functional blocks is the same for all systems, and the application logic is ready-to-run and created directly in the manufacturer's software environment

PLIS.

The tool environment for ICs built on the basis of the platform is ARST software for creating application logic, verifying the created application logic and loading it into the platform logic module, while the platform logic contains an environment for executing the application logic, the library of functional blocks is the same for all systems , application logic is a set of calls of functional blocks from the library, in addition, the platform logic and the library of functional blocks are developed by the platform manufacturer, are loaded into non-volatile memory at the manufacturing stage at the manufacturing plant and are not subject to modification, the application logic is developed by the user or the platform manufacturer.

The tooling environment for ICs built on the basis of the platform is 60 software for creating application logic ready for execution, while the platform logic is developed by the platform manufacturer, the library of functional blocks is the same for all systems, the application logic is created in the software environment of the FPGA manufacturer by the user or platform manufacturer.

The principle of operation of the platform.

The principle of operation of the platform with one chassis is shown in Fig. 2.

The platform accepts security-critical inputs, executes application logic, and generates security-critical outputs. A download device (programmer) is used to download application logic. With the observance of access rights through the setting device (engineering station), it is possible to change the parameters of the signals within the previously allowed limits, change the settings of the delay elements of the formation of signals in time, the configurations of the settings of the input/output modules (scale, signal levels, corrections, damping time, delay time for elimination of rattles, etc.). The monitoring device allows viewing the status of input/output data at any time, the connection to the monitoring device is unidirectional. The keys allow you to safely put the platform into mode

SETTINGS to perform settings.

The principle of operation of a platform with several chassis is shown in Fig. 3.

The platform can consist of several shavsi.

Security-critical inputs flow into each platform chassis, where application logic is executed and security-critical outputs are generated. Based on the safety-critical output data of each chassis, the resulting safety-critical output data is generated. Data exchange between the chassis of the platform is carried out constantly via optical communication channels. A download device (programmer) is used to download application logic. With the observance of access rights through the settings device (engineering station), it is possible to change the signal parameters within the previously allowed limits, change the settings of the delay elements of the formation of signals in time, the configurations of the settings of the input/output modules (scale, signal levels, corrections, damping time, delay time for elimination of rattles, etc.). The monitoring device allows viewing the status of input/output data at any time, the connection to the monitoring device is unidirectional. The keys allow you to safely put the platform into CONFIGURATION mode for execution

From settings.

Modes of operation of the platform.

Possible operating modes of platform modules and transitions between them are shown in fig. 8.

Platform modules work in the following modes:

Initial mode - power off "Power off." from which transitions to other modes are possible according to the diagram in Fig. 8.

"Power off" mode.

This mode consists in turning off the power supply of the platform module or the platform as a whole in the following cases: human action (or operator), loss of power source.

"Launch" mode.

In this mode, the FPGA receives the configuration from the EERV and performs checksum verification (CAC) of the configuration. Then the FPGA goes into regular mode of operation, including execution of application logic, self-diagnosis. When a failure occurs (error type Y), the module switches to "Failure" mode. If no failures are detected, the module switches to the "Operation (safe)" or "Operation" mode (depending on the module type), however, the operator can initiate the transition to the "Configuration" mode.

"Work (safe)" mode.

In this mode, the application logic is executed, but the outputs are overridden by the given values (50 (bypass node)) and are in a safe state. Operator intervention is required to enter Operation mode or Setup mode. Automatic transition to "Operation" or "Settings" mode is not possible. This mode is not provided for input modules, as they do not have outputs. In this mode, self-diagnostic tests similar to the tests of the "Work" mode are also performed.

"Work" mode.

In this mode, application logic is executed, signals are issued to the outputs, and self-diagnosis tests are performed.

"Settings" mode.

In this mode, it is possible to adjust the parameters by connecting the bo to the computer platform with special software. This mode requires the use of the "Settings" key, while the issuing of commands is blocked, which allows the end user to test changing the settings in safe mode.

"Failure" mode.

In this mode, all outputs are forcibly transferred to a safe state. Switching to this mode is carried out when a critical error is detected. The only way out of this mode is to turn off the power to the platform.

"Configuration" mode. This mode has two functions: configuration and calibration. 1. Configuration:

Changes to application logic or platform configuration are performed using a special Yuomupioai biaiop boot device (015). All modules store authentication data in EERVOM, including version information. This information is sent to the MAT monitoring device. To change or load this data, use this mode and the engineering station to load the configuration (01 5). 2. Calibration:

Analog modules (AIM, AOM and AIEM) use this mode for hardware calibration. Calibration can be performed in a chassis that is in service, but the designer must ensure safety during calibration. Calibration can also be performed in ORI 5.

Claims (11)

20 USEFUL MODEL FORMULA 1. A platform for the formation of safe information and control systems (ICS), which contains an interconnected input module, an output module, an optical communication module, a logic module, where each of the modules contains at least one FPGA node, one display node, one node 25 of power supply and watchdog timer, one communication node, one node of non-volatile EERVOM coil, clock generator device, means of verification and diagnostics, which is distinguished by the fact that the FPGA node of each of the modules is made with the possibility of forming calculation means in it in the form of a finite an automaton with a strictly deterministic execution time and built-in platform logic, in which the environment for the execution of application logic is formed, the FPGA node of the logic module is made with the possibility of creating, verifying and loading application logic using the VRST tool environment, the clock generator device contains the nodes of the SIK A clock generator for generating clocks of the watchdog timer, SIK B for generation of diagnostic logic clocks, SIC C for generating application logic clocks (control), which are performed in different clock domains, watchdog timer 35 is performed on a subversive technology in relation to the hardware base of application logic and diagnostic logic, means of verification and diagnosis are performed with the possibility of self-diagnosis and mutual diagnosis of platform logic, hardware, calculation tools, interfaces and data transmission tools in real time, the functioning of which is based on the operation of nodes in different clock domains and the use of various technologies 40 for the implementation of these nodes, and made with the possibility of detecting errors at the module and system level in general, as well as with the selection of errors by level of criticality: errors of type I and II, which transfer the system to a safe state, namely: errors of critical type (type I), which are detected by means of the watchdog timer, when the platform logic cannot guarantee the transition to safe state; 45 errors of the critical type (type II), when hardware or part of the platform logic cannot perform its functions correctly; as well as errors of type (type I), criticality and algorithm, the processing of which is performed by user-defined application logic, data exchange modules are interconnected using point-to-point communication channels with 50 proprietary exchange protocol, platform contains individual means of protection against current and voltage overloads for each of the modules, which are implemented as a separate board. 2. The platform according to claim 1, which differs in that the platform additionally uses several modules of inputs, outputs, optical communication and logical modules. 55 3. The platform according to one of claims 1, 2, which differs in that each of the modules is connected to a logical module through a common cross-board. 4. The platform according to one of claims 1, 2, which is characterized by the fact that the logical module additionally contains at least one: addressing node, 60 BOVAM RAM node, real-time node, input node, output node, external communications node, bypass node. 5. The platform according to one of claims 1, 2, which is characterized by the fact that the optical communication module additionally contains at least one external communications node. 6. The platform according to one of claims 1, 2, which is characterized by the fact that the input module additionally contains at least one input node. 7. The platform according to one of claims 1, 2, which is characterized by the fact that the output module additionally contains at least one: output node, bypass node. 8. The platform according to claim 1, which is distinguished by the fact that it contains independent means of ensuring the temperature regime - at least one ventilation module independent of operating conditions and power circuits. 9. The platform according to one of claims 1, 2, which is characterized by the fact that in the configuration and two logical modules, the logical modules are connected to each other by means of at least two full-duplex communication lines of the type ! MO5. 10. The platform according to one of claims 1, 2, 9, which differs in that in the configuration with two logical modules - one of the logical modules works in hot standby. 11. The platform according to one of claims 1, 2, 9, which is characterized by the fact that the modules are connected to each of the logical modules using at least one dedicated full-duplex communication line of the IHMO5 type. Self-diagnosis from the Apparatus. nm interface; about B 80) Ep. projects PLIS t t shi (EO 50) ro OKO and transmission of strange! 1010 Arbitrary o Meoduliv GO OTRBOYU 0 st access to data) ronUm o Moennnnnnnniatnnnnni 10 DVYUBT (1 Layout data of GEO BO and El.projects - module and SO MEOBO) and Library and func. blocks! I (AB VO) Fig. 1 And the device is connected to the monitoring configuration using the external interface Dan platfok setting platfovnyaya an nn M y Vkhady; rods r N Z Exits, dobyanaky g i fo zvieni da Y - safety. кн PI VTKIK Ge nnnlyanniknynnnnflnnndyadniachn to the students of osa svosvnnyh zoovvvnvnnnne I M and Zoya n dit se . and and and vysh ezya dekhinten o nutttuvuchinyankya: device: anu zimchaAsOk and zabaamenia and tchachasov Volume lostaziu ECO opVEVIV Е BO); penyu SOTYUSTIYKI, hl pay p o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o settings baths ! platforms rn urny py Exits, Walks, critical r N ts critical to safety and safety and Platform dnk Y Fig ra chassis) and on x t y roinya . cluzi I och i M chn ia oz teku zkptint t inttlutnyatya N Devices jasonh temporary 1 loading - timchUagOVI - h . M Volume of delivery of NEBO swabs from RO) snknnu 0 LOSTIYNI g platforms in Ulkonkinnikidkol nina platform zesnn-ya Optical connections between t seams I 2x 248 Fig. Z z OK about WHO» KK KO otvet -- х Z ох: ХОМ х о same B. ОХ M. that God disk Pooonn aoya an and osa pe "o ZEEVEEEEEShnnnshi wav and 00 r and sn KN 10, eMMEE LE somiv mya oyu ma nava Vi you for Am, and and sov KI it 2-4 pn I EN vs KO ollje Mov certain BU pass NEs :i High and zar td dsraynya zm aqua tu nt schi VK Zh schi " z skh nyukh, | N y I be TE | : Y i NeENENIM NNYA TI ak ve i V she: I HE, What DINNENINYKNN I te hr ne an her shi I KK Nai kn y : What HER ' i au NYA y: Z re I Ж I ZINEKENNYNeVVE i re I i si u "BEANS OF VENNINAVIE - and MA; more BKEBAEVYVI a SHE tb ORANKA SHWAD iv IN C NN N we and and MIC with what I NOT I KO VKOVK Ve yi crane ooo uncle these V tu for NN Z VK Sho ee odnin to BU sn NIGHT and with ok SHY OY -shcha May Fig. 4 : mn nn pa zh nm pom ol zm km om oyu nomen o i : i i | i 1 i N N I N I I i N: "we ate Her and WE ate a Still ate that ta ni iz a i: r tr r r Ei Pa ra NK EK re r NI ra NE I N o No 6" NYA SHI b NO shu MI B NO NO Ne I N : i y ih y i te te " zh yy Y N shi: y: SHE AN NS NI. WE: NO NN NO: : KU! ' and: I s I o ? Not that their NK) ' ! g in PE Z and Z pEezh Not b aa o rr re ! and which Ve kv BIV yah s BIV i: -sh- EB, 5, v, vych, cho, H : VIV VV VO VVIV ICoIUI hvo i N hu ish dok shi hi x x -e xx xx xx bok be y 1 Cho I N ra ah v a you v 5 V VE 5 V sha aa ah EE N - se nekneEnenEnvE nene neE she ME shEy SHE SHE RUSH I: zara i vva vay you vi oi you vn shi N : 8185 ' aB5'ВBE a va B va still she shh VO VE : : se y ny sy y she NE NP I ov I AGE YOU NK ZNU : : х х TE х х ы х GU дух их Х Х Y : Н KZ NYA ik NYA NE U ish v вх т НЯ i5 R p N N d PZ va PKU NIC NE in PC a PShkYA Pe PKU PU PU SCHI : : Kk E "ie E NU TE E a yiv TE still ge a g ! : ish ish BE BE y 0 shchi 0 00 : : 2. 8 RU PK r 2 re "2 id 12 sa PI 15 :8 : N x W xx - F F Z X F x F x F their SV : shck NO NI ZSH NN NE v i p E: ZV S ZK PM pr Z VO: VO TEN I V V V V V S VYN E o MY Z ZU: - AP SHA POR5SHPuR add. longer 1-1. SHA. PO M Fig. 5 interofryu svo N pi deno sl rovk y and ' pn SHIA N t. nty eo Dyshgn St N PA 7 st pen-yu) and "TPU NENYA shlililichitiitiy | Davytya Tomtych ia tauhu. 1; and deryuennnya N INBER with ZUYNe N Ru pt kzhznazhchchanyayannnnnya y pffnnnnnnntnnhya vk and terem I SHK N N zo intere vash Grobarusyanoya N yaiskr In MD yah freon and BU fan 15 Mo zh and M Hrushak: oh ! nnia: the land and KD Shanvecheui! нения зыхам кепи Va ' PO UVO. and the interest of the MKU KOMOM LYAH 47 and winter ZHK I N i N gYa tticidiu Y N Y N z pvduye. | and i nyu I Uss uza i N Management from exitV Dakku rt Suepiv roetrfelo o Zaiou Soetsu: N rennya 33 dnya i I i a intere iktureyo psdh uzi pezlnago masu - ge: real misu strreukeyus and exits av Y oder rn Y: padmyru i. Jesus I 48: B vats and 4 pn Her still fuychyamh thinking EV: , and oder ofkeettntjettkyatttktjettkyanyai N Mlzhlnnianilitik and and shi; y ' i oh suvuokhetino taimatsu intorvne rytitihiyutyanaya cancer and N y SK t VDDSOM 4 NI ! and x her: m 1 and 8 Khainikhychlyuktyny Z: N N and Bk N and: nepufeno access TO valyastuvanh, ODTIIIIIILITITII pterfedh nan pivna There are 2 pk, x IZ z t N their OV 7 ' zh Sitim : 15 urefettichn : YN U inerfetsi : 1 Nii tro» i m fakayuviyuyutyuchkyan PshnitE NN ad: i rynv p Masu M KO VeY: Mi" : dtchyajntlynichechnkh KRHCCIRENI z ne Sho ZI snterruye : o BOKAM : z 18 z: Te : iy Mfentnityu : i roya Mann Z Kezhnnnianyaniya fonom Yannia N Not with Not Fig. 6 EI on nnya MODUL vyshen SHY D OV mnyanyi in IZ: I and ri y U Ek NN plnshe a shiny nyn - A 3 7 y Ooborovavnik dispriyutyak y ! and a A HIGHER difficulty of testing the haruecha popa them and Bydyachen no: p a YOU CELLS ik data KI p. shk nan na s nm nn i a. VO on v NK ZY she CE pn dnk Fig 7 TE V net pe anna shiya ne Z Ba bh eh UKH OO Z i ODEMYYMyuZhya che UNO 5 ie zha v. bot navashtuv U EE U v V BI Zh, x y tri iz -- zho. ia gu CJSC VASHE i VE She cha i 7 i i NV in. xx NN NI dn Shk xx i; With her Rejection IN NANU - VSH still NN oh I B s BU YAN r pdrkyatnyannya pdtkc MU SUYA EK ra; still at 4 xx to her her X "There's THIS THING at 1; Ж гай ПОШХ "I CONE Noya un ET I Z z 1: How PI and a we SE I I KE U y : and mya her pearl yak "and I lyzh KI give East Kh zhЮU y i ; GAY ho village. x ve what her still ke de i: і 0 ZDpuyuj o zh - V Esh i Ki poha KK some have not yet narrowed her Not dk o 7 Off. their SUM y v i: y x . Pd Ku ЖЯЯ y y: 5 ШЩ She Kon Zazhomiandov rewrote Z Oh ZaeostvinaMmy y z Vyimayutya v'vasi Fig. 2