WO2018137147A1 - 一种核电站安全级仪控系统通信协议的自诊断方法 - Google Patents

一种核电站安全级仪控系统通信协议的自诊断方法 Download PDF

Info

Publication number
WO2018137147A1
WO2018137147A1 PCT/CN2017/072495 CN2017072495W WO2018137147A1 WO 2018137147 A1 WO2018137147 A1 WO 2018137147A1 CN 2017072495 W CN2017072495 W CN 2017072495W WO 2018137147 A1 WO2018137147 A1 WO 2018137147A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
data frame
diagnosis
self
nuclear power
Prior art date
Application number
PCT/CN2017/072495
Other languages
English (en)
French (fr)
Inventor
江国进
王静伟
张春雷
张智慧
金成日
高超
马朝阳
马光强
Original Assignee
北京广利核系统工程有限公司
中国广核集团有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京广利核系统工程有限公司, 中国广核集团有限公司 filed Critical 北京广利核系统工程有限公司
Priority to EP17894461.7A priority Critical patent/EP3557816A4/en
Priority to PCT/CN2017/072495 priority patent/WO2018137147A1/zh
Publication of WO2018137147A1 publication Critical patent/WO2018137147A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0681—Configuration of triggering conditions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
    • Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
    • Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them

Definitions

  • the invention relates to a diagnostic method for a communication protocol of a safety level instrument control system of a nuclear power plant, in particular to a diagnostic method of a point-to-point communication protocol.
  • Nuclear power plant safety level instrument control system is the "neural center" of nuclear power plants, and is the most important means to ensure the safe and reliable operation of nuclear power plants.
  • the safety level instrument control systems for nuclear power plants that have been commercialized mainly include TXS, Meltec-N, Tricon and Common-Q.
  • TXS communication between redundant channels in the system uses Profibus-based SINEC L2 communication network
  • Meltac-N communication between control stations in the system uses point-to-point communication based on RS-485
  • Tricon system internal communication RS-232/485-based bus-type communication is adopted
  • Common-Q the transmission of voting logic signals between redundant channels in the system uses RS-232-based HSL point-to-point communication.
  • RS-232/485 is the mainstream serial communication interface in industrial control networks.
  • the processing unit (RPC) in Figure 1 need to perform logical compliance operations, there must be direct data interaction.
  • This kind of communication involves only two processing units, and the amount of data is not large, but the reliability, real-time and security requirements of data communication are very high.
  • the dotted line in Figure 1 is a point-to-point communication network. Due to the accidental failure of hardware components and the existence of bugs in the software itself, the following eight communication errors may occur, namely data crash, accidental retransmission, misordering, loss, delay timeout, invalid insertion. , camouflage message and error addressing.
  • the wrong network data may be misused, which may cause harm to the security and stability of the entire system nuclear power plant safety level instrument control system. This may result in an unexpected shutdown of the nuclear power plant, resulting in immeasurable property damage and personal safety incidents.
  • Self-diagnosis refers to the technology that the system detects and handles faults or failure events by setting diagnostic functions.
  • the core of self-diagnosis technology lies in diagnostic measures and fault handling after diagnosis.
  • the typical self-diagnosis process is: after a fault occurs during the operation, the system should identify the abnormal condition of the system through hardware or software, quickly report the abnormal information, and start the processing mechanism to enter the degraded operation or fail-safe state until After the fault is removed, the system can resume normal operation.
  • CN103457791A is a self-diagnosis of a smart substation network sampling and control link.
  • the break method can timely discover and classify and eliminate various network faults in the network operation, and manage and record the network fault information, further ensure the reliability and security of network sampling and network control in substation applications, and improve the intelligence of the substation. Level of development.
  • CN102984097A Transceiver self-diagnosis for balancing electromagnetic interference reduction in a channel, implementing a communication link supporting differential signaling to transmit a common mode signal, and any detected selectivity of appropriate processing such as signal energy corresponding to differential signal energy
  • the operation provides measurements of electromagnetic compatibility (EMC) corresponding to the communication link.
  • EMC electromagnetic compatibility
  • the existing network self-diagnosis technology is a self-diagnosis technology for the industry standard control network, and is not applicable to the point-to-point network communication protocol of the existing nuclear power plant safety level instrument control system.
  • the present invention proposes a self-diagnosis method for a communication protocol of a nuclear power plant safety level instrument control system, which can effectively judge network communication errors.
  • the invention provides a self-diagnosis method for a communication protocol of a nuclear power plant safety level instrument control system, the protocol is based on a point-to-point network protocol composed of an application layer, a data link layer and a physical layer, wherein the network protocol has a constant network data amount.
  • the interface mode is full-duplex asynchronous transmission mode, the transmission medium is multi-membrane fiber, and the operating period of the sender and receiver ranges from 8 milliseconds to 20 milliseconds.
  • the application layer data frame format includes destination MAC, source MAC, application mode, TICK, Message sequence number, total message length, frame valid data length, number of message frames, sequence page of the message frame, retransmission bit, reserved area, upper layer data, and CRC check code, where the destination MAC, source MAC, and frame are valid.
  • the data length and upper layer data are obtained by the configuration tool.
  • the length of the data frame of the application layer ranges from 256 bytes to 1500 bytes, preferably 512 bytes to 1200 bytes.
  • the data structure of the upper layer data includes the data value and the quality bit. section.
  • the self-diagnosis method specifically includes the following steps:
  • Step 1 The sender obtains the destination MAC address, the source MAC address, and the upper layer data, and encapsulates the obtained upper layer data according to the frame format.
  • the retransmission position of the first transmission data frame is 0, and the retransmission data frame retransmission position is 1. ;
  • Step 2 If the receiving party does not receive the data frame, the process proceeds to step 6. If the receiving party receives the data frame sent by the sender, the receiver checks the destination MAC address and the source MAC address of the data frame for diagnostic error addressing, and records the abnormal cause when the diagnosis is abnormal. Step 7: When the diagnosis is normal, proceed to step 3;
  • Step 3 judging the data frame TICK and the message sequence number, and checking whether the TICK value and the message sequence number value determine whether there are four network errors such as retransmission, misordering, loss, and invalid insertion.
  • the diagnosis is abnormal, the cause of the abnormality is recorded to step 7, and when the diagnosis is normal, the process proceeds to step 4;
  • Step 4 using the data frame CRC check code to check the diagnostic data crash error, when the abnormality is diagnosed, the cause of the abnormality is entered into the seventh step, and the upper layer data in the retransmitted data frame needs to be compared. If the inconsistency is also considered as the data collapse, the record is recorded. The cause of the abnormality proceeds to step seven, and when the diagnosis is normal, the process proceeds to step five;
  • Step 5 Check the data frame application mode and the application layer protocol number. If it is not the preset value, diagnose the cause of the spoofed message recording abnormality and enter step 7; when the diagnosis is normal, go to step VIII;
  • Step 6 When the receiving party does not receive the data frame in the time window exceeding the set receiving data frame, the diagnosis is a delay timeout, and the reason for recording the abnormality proceeds to step 7; if the time frame of the received data frame is not exceeded, the current state is maintained. The time when the data frame is not received is recorded, and the receiving data frame time window range set by the receiver is 2-4 times the maximum value of the sender and receiver periods.
  • Step 7 The number of diagnostic abnormalities is increased by 1. If the cumulative number of diagnostic abnormalities does not reach the tolerance threshold (the tolerance threshold is 2-5 times), the maintenance status remains unchanged. Otherwise, the fault is handled:
  • Appearance prompt Use the dot matrix to display the specific cause of the fault.
  • Step 8 The number of diagnostic abnormalities is cleared and the fault recovery process is performed:
  • the self-diagnosis method of the communication protocol of the safety level instrument control system of the nuclear power plant of the invention realizes full coverage of diagnosis of eight kinds of network errors; and accurately determines whether the upper data quality position is valid, thereby ensuring that the wrong data is not It is misused; set a reasonable network diagnostic fault tolerance threshold to ensure that the system is stable (no repeated state transitions due to sporadic errors), and can be reported in the first time when it is confirmed as a network failure.
  • the method of the invention has a very low false positive rate and can effectively ensure the point-to-point communication quality of the safety level instrument control system of the nuclear power plant.
  • Figure 1 is a schematic view showing the structure of a typical nuclear power plant safety level instrument control system
  • FIG. 2 is a block diagram showing a flow of a transmission process of a self-diagnosis method for a communication protocol of a safety level instrument control system of a nuclear power plant according to the present invention
  • FIG. 3 is a block diagram showing the process of receiving data diagnosis processing of the self-diagnosis method of the communication protocol of the safety level instrument control system of the nuclear power plant of the present invention.
  • the present invention is a self-diagnosis implementation method of a communication method according to the applicant's ZL200910238712.6 patent "a communication method based on the inter-column secure communication network protocol of a reactor protection system".
  • the patent ZL200910238712.6 relates to a secure network protocol for inter-column communication, in particular a communication method based on a secure communication network protocol between reactor protection systems.
  • the communication protocol is applicable to the nuclear power control system, according to IEC6178-3, IEC60880 and IEC61508, the self-diagnosis requirements for the safety network require data corruption, accidental retransmission, misordering, loss, delay timeout, invalid insertion, and spoofing.
  • the network residual rate is an important indicator of the security level of a secure network.
  • the network residual rate has a clear calculation formula, so that the residual rate of the designed network protocol can be quantitatively evaluated. The formula is as follows:
  • the residual error rate RSL (Pe) of a single security message is determined by the CRC check process selected.
  • the residual error rate of the CRC-checked message is calculated as:
  • Hamming distance the number of bits of the corresponding bits of the two codewords is called the two codewords. Hamming distance. In a valid coding set, the minimum Hamming distance of any two codewords is called the Hamming distance of the code set. For example: 10101 and 00110 have the first, fourth, and fifth positions from the first place, and the Hamming distance is 3.
  • the self-diagnosis method of the present invention involves the receiver and the sender using the asynchronous communication method, and the receiver cannot send the response frame to the sender.
  • the transmission and reception of network devices, when reading network data can only use the way of regular query to read network data frames, and can not use the interrupt mechanism to read network data.
  • the data frame structure of the present invention is shown in the following table, wherein the data frame structure is a destination address, a source address, an application layer protocol number, an application layer data portion, and a CRC check code.
  • the application layer protocol number is fixed to "0XAABB" in this embodiment.
  • the total length of the application layer data frame is defined as 1000 bytes.
  • the data frame of the application layer is shown in the following table:
  • the function code is a specific identifier for the data pattern
  • TICK value 1 is added per cycle, which is the number of cycle cycles
  • the sequence number of the packet is the sequence number of the packet sent during the period.
  • the field is strongly related to the retransmission bit.
  • the sequence number is 1, the first data frame is the first transmission, and the retransmission bit is 0.
  • the sequence number is 2.
  • Retransmit the data frame for this period retransmit the bit 1;
  • Registration length represents the length of the entire data frame, the starting position is the destination MAC address, and the ending position is the CRC check code;
  • Effective data length of the packet representing the effective data length of the upper layer data
  • Total number of groups represents the total number of data in this group
  • Packet sequence number the package number representing the data of this group
  • Retransmission bit 0 represents the first data frame of this cycle; 1 represents the retransmission data frame for this period.
  • the two packets of data frames are identical except for the message sequence number, retransmission bit, and CRC check code.
  • CRC check code The retransmission bit is 0, the CRC check value is 0x04C11DB7, the retransmission bit is 1, and the CRC check value is 0xBA0DC66B.
  • the sender obtains the local operating period of 10 milliseconds in the initialization phase
  • the local MAC is ⁇ 0x01, 0x05, 0x03, 0x07, 0x0a ⁇
  • the destination MAC is ⁇ 0x02, 0x03, 0x05, 0x0a, 0x0b ⁇
  • the receiver obtains its own running period of 10 milliseconds in the initialization phase
  • the local MAC is ⁇ 0x02, 0x03, 0x05, 0x0a, 0x0b ⁇
  • the destination MAC is ⁇ 0x01, 0x05, 0x03, 0x07, 0x0a ⁇ .
  • the receiving data frame time window set by the receiver is 20 milliseconds, and the tolerance threshold of the diagnostic abnormal number is 3 times.
  • the specific diagnosis method is as follows:
  • Step 1 After the sender enters the cycle period, as shown in FIG. 2, the upper layer data is periodically acquired and the upper layer data is encapsulated according to the protocol format, wherein the TICK value is a cycle period value, starting from 0.
  • the TICK value is a cycle period value, starting from 0.
  • the message sequence number is 0, the retransmission bit is 0, the CRC check value is 0x04C11DB7, and for the retransmission data frame, the message sequence number is 1, the retransmission bit is 1, and the CRC check value is used.
  • Step 2 After the receiver enters the cycle period, as shown in FIG. 3, the cycle diagnosis of the received data frame is started. If the receiver does not receive the data frame in the current period, the process proceeds to step 6; if the receiver receives the data frame sent by the sender, it checks whether the destination MAC address of the data frame is ⁇ 0x02, 0x03, 0x05, 0x0a, 0x0b ⁇ , Whether the source MAC is ⁇ 0x01, 0x05, 0x03, 0x07, 0x0a ⁇ , if the check is abnormal, the diagnosis is incorrectly addressed. When the diagnosis is abnormal, the cause of the abnormality is entered in step 7. When the check is normal, go to step 3.
  • Step 3 Determine whether there are four network errors such as retransmission, misordering, loss, and invalid insertion by diagnosing the data frame TICK, the message sequence number, and the retransmission bit.
  • the specific method is as follows:
  • TICK value of the previous data frame is 0X5A
  • sequence number of the message is 1, and the retransmission bit is 0.
  • the TICK value of the received data frame is 0X5B
  • the sequence number of the message is 1, and the retransmission bit is 0.
  • the sequence number of the message is 1, and the retransmission bit is 0.
  • the TICK value of the received data frame is 0X5A, the sequence number of the message is 1, and the retransmission bit is 0.
  • the sequence number of the message is 1, and the retransmission bit is 0.
  • the TICK value of the received data frame is 0X50, the sequence number of the message is 1, and the retransmission bit is 0. Can be diagnosed as a wrong order;
  • the sequence number of the message is 1, and the retransmission bit is 0.
  • the TICK value of the received data frame is 0X3C, the sequence number of the message is 9, and the retransmission bit is 0. Can be diagnosed as invalid insertion;
  • the TICK value of the previous data frame is 0X5A
  • the sequence number of the message is 0, and the retransmission bit is 0.
  • the TICK value of the received data frame is 0X5A
  • the sequence number of the message is 2, and the retransmission bit is 1.
  • step 7 when the diagnosis is abnormal, the cause of the abnormality is recorded to step 7, and when the check is normal, the process proceeds to step 4;
  • Step 4 performing a CRC checksum check on the first data frame and the retransmitted data frame, and if the verification is successful, performing binary comparison on the upper layer data of the two data frames. If the upper layer data of the two packets of data frames is compared, the diagnosis is normal, and the process proceeds to step 5, otherwise the diagnosis is data collapse, and the process proceeds to step 7.
  • Step 5 Check whether the application mode and the application layer protocol number of the data frame are preset values, that is, check whether the application mode is equal to 3, whether the application layer protocol number is equal to 0XAABB, and if not equal to the diagnosis, the masquerading message enters step VII. Otherwise diagnosed as normal, go to step eight;
  • Step 6 If no data frame is received in this cycle, when the accumulated unreceived data frame time exceeds 20 milliseconds, the diagnosis is delayed and the timeout proceeds to step 7. Otherwise, keep the current state and record the time when the data frame is not received, and go to the next cycle for diagnosis.
  • Step 7 The number of diagnostic abnormalities is increased by 1. If the cumulative number of diagnostic abnormalities does not reach 3 times, the maintenance status remains unchanged. Otherwise, the fault is handled:
  • the quality position of the upper layer data of the received data frame is 0X2C, and 0X2C represents the quality bit set by the receiving party, which is convenient for searching and positioning;
  • Appearance prompt Turn off the normal "RUN” light for the communication, and use the dot matrix to display the specific cause of the fault. If the diagnosis is data collapse, the dot matrix displays "W001", if the diagnosis is data accidental retransmission dot matrix display "W002", if the diagnosis "W003" is displayed for the wrong-order dot matrix. If the diagnosis is that the missing dot matrix displays "W004", if the diagnosis is delayed, the time-out dot matrix displays "W005", and if the diagnosis is invalid, the dot matrix displays "W006", and if the diagnosis is false, the report is false. The dot matrix displays "W007”, and if the diagnosis is incorrectly addressed, the dot matrix displays "W008".
  • the fault is processed and the next cycle is entered for diagnosis.
  • Step 8 The number of diagnostic abnormalities is cleared and the fault recovery process is performed:
  • the quality position of the upper layer data of the received data frame is valid. That is, the quality of the upper layer data
  • the position is 0;
  • Appearance prompt Lights up to indicate the normal "RUN” light of the communication.
  • the dot matrix does not display any information to indicate that the network is diagnosed as normal.
  • the application layer protocol number is fixed to “0XAABB”, and the application mode fixed value is 3.
  • the sender obtains the local operating period of 8 milliseconds in the initialization phase, the local MAC is ⁇ 0x01, 0x05, 0x03, 0x07, 0x0a ⁇ , and the destination MAC is ⁇ 0x02, 0x03, 0x05, 0x0a, 0x0b ⁇ , and the receiver obtains during the initialization phase.
  • the local operating period is 8 milliseconds
  • the local MAC is ⁇ 0x02, 0x03, 0x05, 0x0a, 0x0b ⁇
  • the destination MAC is ⁇ 0x01, 0x05, 0x03, 0x07, 0x0a ⁇ .
  • the receiving data frame time window set by the receiver is 32 milliseconds
  • the tolerance threshold of the diagnostic abnormal number is 5 times.
  • Step 1 After the sender enters the cycle period, as shown in FIG. 2, the upper layer data is periodically acquired and the upper layer data is encapsulated according to the protocol format, wherein the TICK value is a cycle period value, starting from 0.
  • the TICK value is a cycle period value, starting from 0.
  • the message sequence number is 0, the retransmission bit is 0, the CRC check value is 0x04C11DB7, and for the retransmission data frame, the message sequence number is 1, the retransmission bit is 1, and the CRC check value is used.
  • Step 2 After the receiver enters the cycle period, as shown in FIG. 3, the cycle diagnosis of the received data frame is started. If the receiver does not receive the data frame in the current period, the process proceeds to step 6; if the receiver receives the data frame sent by the sender, it checks whether the destination MAC address of the data frame is ⁇ 0x02, 0x03, 0x05, 0x0a, 0x0b ⁇ , Whether the source MAC is ⁇ 0x01, 0x05, 0x03, 0x07, 0x0a ⁇ , if the check is abnormal, the diagnosis is incorrectly addressed. When the diagnosis is abnormal, the cause of the abnormality is entered in step 7. When the check is normal, go to step 3.
  • Step 3 Determine whether there are four network errors such as retransmission, misordering, loss, and invalid insertion by diagnosing the data frame TICK, the message sequence number, and the retransmission bit.
  • the specific method is as follows:
  • TICK value of the previous data frame is 0X5A
  • sequence number of the message is 1, and the retransmission bit is 0.
  • the TICK value of the received data frame is 0X5B
  • the sequence number of the message is 1, and the retransmission bit is 0.
  • the sequence number of the message is 1, and the retransmission bit is 0.
  • the TICK value of the received data frame is 0X5A, the sequence number of the message is 1, and the retransmission bit is 0.
  • the sequence number of the message is 1, and the retransmission bit is 0.
  • the TICK value of the received data frame is 0X50, the sequence number of the message is 1, and the retransmission bit is 0. Can be diagnosed as a wrong order;
  • the sequence number of the message is 1, and the retransmission bit is 0.
  • the TICK value of the received data frame is 0X3C, the sequence number of the message is 9, and the retransmission bit is 0. Can be diagnosed as invalid insertion;
  • the TICK value of the previous data frame is 0X5A
  • the sequence number of the message is 0, and the retransmission bit is 0.
  • the TICK value of the received data frame is 0X5A
  • the sequence number of the message is 2, and the retransmission bit is 1.
  • step 7 when the diagnosis is abnormal, the cause of the abnormality is recorded to step 7, and when the check is normal, the process proceeds to step 4;
  • Step 4 performing a CRC checksum check on the first data frame and the retransmitted data frame, and if the verification is successful, performing binary comparison on the upper layer data of the two data frames. If the upper layer data of the two packets of data frames is compared, the diagnosis is normal, and the process proceeds to step 5, otherwise the diagnosis is data collapse, and the process proceeds to step 7.
  • Step 5 Check whether the application mode and the application layer protocol number of the data frame are preset values, that is, check whether the application mode is equal to 3, whether the application layer protocol number is equal to 0XAABB, and if not equal to the diagnosis, the masquerading message enters step VII. Otherwise diagnosed as normal, go to step eight;
  • Step 6 If no data frame is received in this cycle, when the accumulated unreceived data frame time exceeds 32 milliseconds, the diagnosis is that the delay timeout proceeds to step 7. Otherwise, keep the current state and record the time when the data frame is not received, and go to the next cycle for diagnosis.
  • Step 7 The number of diagnostic abnormalities is increased by 1. If the cumulative number of diagnostic abnormalities does not reach 5 times, the maintenance status is unchanged, otherwise the fault is handled:
  • the quality position of the upper layer data of the received data frame is 0X2C, and 0X2C represents the quality bit set by the receiving party, which is convenient for searching and positioning;
  • Appearance prompt Turn off the normal "RUN” light for communication, and use the dot matrix to display the specific cause of the fault. If the diagnosis is data crash, the dot matrix displays "W00a”, if the diagnosis is data accidental retransmission dot matrix display "W00b”, if the diagnosis "W00c” is displayed for the wrong-order dot matrix. If the diagnosis is that the missing dot matrix displays "W00d”, if the diagnosis is delayed, the dot matrix display "W00e”, if the diagnosis is invalid, the dot matrix displays "W00f”, if the diagnosis is false report The dot matrix displays "W00g”, and if the diagnosis is incorrectly addressed, the dot matrix displays "W00h”.
  • the fault is processed and the next cycle is entered for diagnosis.
  • Step 8 The number of diagnostic abnormalities is cleared and the fault recovery process is performed:
  • the quality position of the upper layer data of the received data frame is valid. That is, the quality position of the upper layer data is 0;
  • Appearance prompt Lights up to indicate the normal "RUN” light of the communication.
  • the dot matrix does not display any information to indicate that the network is diagnosed as normal.
  • the application layer protocol number is fixed to “0XAABB”, and the application mode fixed value is 3.
  • the sender obtains the local operating period of 20 milliseconds during the initialization phase, the local MAC is ⁇ 0x01, 0x05, 0x03, 0x07, 0x0a ⁇ , and the destination MAC is ⁇ 0x02, 0x03, 0x05, 0x0a, 0x0b ⁇ , and the receiver obtains during the initialization phase.
  • the local operating period is 20 milliseconds
  • the local MAC is ⁇ 0x02, 0x03, 0x05, 0x0a, 0x0b ⁇
  • the destination MAC is ⁇ 0x01, 0x05, 0x03, 0x07, 0x0a ⁇ .
  • the receiving data frame time window set by the receiver is 60 milliseconds
  • the tolerance threshold of the diagnostic abnormal number is 2 times.
  • Step 1 After the sender enters the cycle period, as shown in FIG. 2, the upper layer data is periodically acquired and the upper layer data is encapsulated according to the protocol format, wherein the TICK value is a cycle period value, starting from 0.
  • the TICK value is a cycle period value, starting from 0.
  • the message sequence number is 0, the retransmission bit is 0, the CRC check value is 0x04C11DB7, and for the retransmission data frame, the message sequence number is 1, the retransmission bit is 1, and the CRC check value is used.
  • Step 2 After the receiver enters the cycle period, as shown in FIG. 3, the cycle diagnosis of the received data frame is started. If the receiver does not receive the data frame in the current period, the process proceeds to step 6; if the receiver receives the data frame sent by the sender, it checks whether the destination MAC address of the data frame is ⁇ 0x02, 0x03, 0x05, 0x0a, 0x0b ⁇ , Whether the source MAC is ⁇ 0x01, 0x05, 0x03, 0x07, 0x0a ⁇ , if the check is abnormal, the diagnosis is incorrectly addressed. When the diagnosis is abnormal, the cause of the abnormality is entered in step 7. When the check is normal, go to step 3.
  • Step 3 Determine whether there are four network errors such as retransmission, misordering, loss, and invalid insertion by diagnosing the data frame TICK, the message sequence number, and the retransmission bit.
  • the specific method is as follows:
  • TICK value of the previous data frame is 0X5A
  • sequence number of the message is 1, and the retransmission bit is 0.
  • the TICK value of the received data frame is 0X5B
  • the sequence number of the message is 1, and the retransmission bit is 0.
  • the sequence number of the message is 1, and the retransmission bit is 0.
  • the TICK value of the received data frame is 0X5A, the sequence number of the message is 1, and the retransmission bit is 0.
  • the sequence number of the message is 1, and the retransmission bit is 0.
  • the TICK value of the received data frame is 0X50, the sequence number of the message is 1, and the retransmission bit is 0. Can be diagnosed as a wrong order;
  • the sequence number of the message is 1, and the retransmission bit is 0.
  • the TICK value of the received data frame is 0X3C, the sequence number of the message is 9, and the retransmission bit is 0. Can be diagnosed as invalid insertion;
  • the TICK value of the previous data frame is 0X5A
  • the sequence number of the message is 0, and the retransmission bit is 0.
  • the TICK value of the received data frame is 0X5A
  • the sequence number of the message is 2, and the retransmission bit is 1.
  • step 7 when the diagnosis is abnormal, the cause of the abnormality is recorded to step 7, and when the check is normal, the process proceeds to step 4;
  • Step 4 performing a CRC checksum check on the first data frame and the retransmitted data frame, and if the verification is successful, performing binary comparison on the upper layer data of the two data frames. If the upper layer data of the two packets of data frames is compared, the diagnosis is normal, and the process proceeds to step 5, otherwise the diagnosis is data collapse, and the process proceeds to step 7.
  • Step 5 Check whether the application mode and the application layer protocol number of the data frame are preset values, that is, check whether the application mode is equal to 3, whether the application layer protocol number is equal to 0XAABB, and if not equal to the diagnosis, the masquerading message enters step VII. Otherwise diagnosed as normal, go to step eight;
  • Step 6 If no data frame is received in this cycle, when the accumulated data frame time is not more than 60 milliseconds, the diagnosis is delayed and the timeout proceeds to step 7. Otherwise, keep the current state and record the time when the data frame is not received, and go to the next cycle for diagnosis.
  • Step 7 The number of diagnostic abnormalities is increased by 1. If the cumulative number of diagnostic abnormalities does not reach 2 times, the maintenance status is unchanged, otherwise the fault is handled:
  • the quality position of the upper layer data of the received data frame is 0X2C, and 0X2C represents the quality bit set by the receiving party, which is convenient for searching and positioning;
  • Appearance prompt Turn off the normal "RUN” light for the communication, and use the dot matrix to display the specific cause of the fault. If the diagnosis is data crash, the dot matrix displays "W00A”, if the diagnosis is data accidental retransmission dot matrix display "W00B”, if the diagnosis Display “W00C” for the wrong sequence, if the diagnosis is a lost point If the matrix is displayed as "W00D”, if the diagnosis is delayed, the dot matrix display "W00E”, if the diagnosis is invalid, the dot matrix display "W00F”, if the diagnosis is camouflage, the dot matrix displays "W00G”, if the diagnosis is the wrong addressing point. The array shows "W00H”.
  • the fault is processed and the next cycle is entered for diagnosis.
  • Step 8 The number of diagnostic abnormalities is cleared and the fault recovery process is performed:
  • the quality position of the upper layer data of the received data frame is valid. That is, the quality position of the upper layer data is 0;
  • Appearance prompt Lights up to indicate the normal "RUN” light of the communication.
  • the dot matrix does not display any information to indicate that the network is diagnosed as normal.
  • the nuclear power plant safety network needs to meet the residual rate of less than 10-9.
  • the self-diagnosis method of the present invention can correctly diagnose 8 kinds of transmission errors of the above network, and the network residual rate satisfies the SIL3 level standard requirement.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Detection And Prevention Of Errors In Transmission (AREA)
  • Maintenance And Management Of Digital Transmission (AREA)

Abstract

本发明提出了一种核电站安全级仪控系统通信协议的自诊断方法，基于由应用层、数据链路层和物理层构成的点对点网络协议，通过发送方获取目的MAC、源MAC和上层数据，并对获取的上层数据按照帧格式进行封装发送，检查数据帧目的MAC和源MAC诊断错误寻址，判断数据帧TICK和报文序列号，利用数据帧CRC校验码检查诊断数据崩溃错误，诊断为延时超时，故障诊断和故障恢复等步骤实现。本发明的自诊断方法，实现了对8种网络错误的诊断全覆盖；确保错误数据不会被误用；设置合理的网络诊断故障次数容限阈值，既保证系统稳定，又能在确认为网络故障的情况下第一时间上报，有效确保核电站安全级仪控系统点对点通信质量。

Description

一种核电站安全级仪控系统通信协议的自诊断方法 技术领域
本发明涉及一种用于核电站安全级仪控系统通信协议的诊断方法，特别是点对点通信协议的诊断方法。
背景技术
核电站安全级仪控系统是核电站的“神经中枢”，是确保核电厂安全、可靠运行的最重要手段。在国外，已经商用的核电站安全级仪控系统主要有TXS、Meltac-N、Tricon和Common-Q。对于TXS，系统内冗余通道间间的通信采用基于Profibus的SINEC L2通信网络；对于Meltac-N，系统内控制站之间的通信采用基于RS-485的点对点通信，；对于Tricon，系统内部通信采用基于RS-232/485的总线型通信；对于Common-Q，系统内冗余通道间表决逻辑信号的传输采用基于RS-232的HSL点对点通信。RS-232/485是现在工业控制网络中主流的串行通信接口。如图1所示是典型的核电站安全级仪控系统结构，图1中各处理单元(RPC)间需要进行逻辑符合操作，其间必然会有直接的数据交互。这类通信只涉及两个处理单元，数据量不大，但对数据通信的可靠性、实时性和安全性要求非常高。图1中虚线部分即为点对点通信网络，由于硬件元器件偶发故障以及软件自身存在的BUG都会导致以下8种通信错误出现，即数据崩溃、意外重传、错序、丢失、延迟超时、无效插入、伪装报文和错误寻址，如果没有对网络8错误进行诊断就会导致错误的网络数据被误用的可能，对整个系统核电站安全级仪控系统的安全性和稳定性造成危害，严重时会可能导致核电站意外停堆从而造成不可估量的财产损失和人身安全事故。
自诊断是指系统通过设置诊断功能对故障或失效事件进行自我检测并处理的技术，自诊断技术的核心在于诊断措施以及诊断后的故障处理。典型的自诊断流程为：在运行过程中发生了故障后，系统应通过硬件或软件来识别出系统的异常情况，迅速将异常信息上报，并启动处理机制，进入降级运行或故障安全状态，直到故障被排除后，系统方能恢复正常运行状态。
例如，CN103457791A一种智能变电站网络采样和控制链路的自诊 断方法，能够及时发现网络运行的各类网络故障并加以定位和排除，并对网络故障信息进行管理和记录，进一步保障网络采样和网络控制在变电站应用的可靠性和安全性，提高变电站的智能化水平。
CN102984097A用于平衡信道内电磁干扰降低的收发器自诊断，实现支持差分信令的通信链路传送共模信号、以及任何所检测到的诸如对应于差分信号能量的信号能量的适当处理的选择性操作提供了对应于通信链路的电磁兼容性(EMC)的测量结果。
目前现有的网络自诊断技术都是针对工业标准控制网络的自诊断技术，并不适用于现有核电站安全级仪控系统中点对点的网络通信协议。
发明内容
针对上述现有技术存在的不足，本发明提出了一种核电站安全级仪控系统通信协议的自诊断方法，可以有效判断网络通信错误。
本发明提出的一种核电站安全级仪控系统通信协议的自诊断方法，该协议是基于由应用层、数据链路层和物理层构成的点对点网络协议，所述网络协议的网络数据量恒定，接口模式为全双工异步传输模式，传输介质为多膜光纤，发送方和接收方的运行周期范围为8毫秒-20毫秒，应用层数据帧格式包括目的MAC、源MAC、应用模式、TICK、报文序号、报文总长、帧有效数据长、报文帧个数、本报文帧的序页、重传位、保留区、上层数据和CRC检验码，其中目的MAC、源MAC、帧有效数据长和上层数据通过组态工具获得，应用层的数据帧的长度范围为256字节-1500字节，优选为512字节-1200字节，上层数据的数据结构包括数据值以及质量位两部分。自诊断方法具体包括以下步骤：
步骤一，发送方获取目的MAC、源MAC和上层数据，并对获取的上层数据按照帧格式进行封装发送，其中首传数据帧的重传位置为0，重传数据帧的重传位置为1；
步骤二，接收方若没有接收到数据帧则进入步骤六；接收方若接收到发送方发送的数据帧后，检查数据帧目的MAC和源MAC诊断错误寻址，当诊断异常时记录异常原因进入步骤七，当诊断正常时，进入步骤三；
步骤三，判断数据帧TICK和报文序列号，通过检查TICK值和报文序列号的值判断是否发生重传、错序、丢失、无效插入四种网络错误， 当诊断异常时记录异常原因进入步骤七，当诊断正常时进入步骤四；
步骤四，利用数据帧CRC校验码检查诊断数据崩溃错误，当诊断异常时记录异常原因进入步骤七，并需要对重传数据帧里的上层数据进行比较，若不一致也认为是数据崩溃，记录异常原因进入步骤七，当诊断正常时进入步骤五；
步骤五，检查数据帧应用模式和应用层协议号，若不是预先设定值则诊断为伪装报文记录异常原因进入步骤七，当诊断正常时进入步骤八；
步骤六，当接收方在超过设定接收数据帧时间窗未接收到数据帧，则诊断为延时超时，记录异常原因进入步骤七；若未超过设定接收数据帧时间窗则保持当前状态并记录未接收到数据帧的时间，接收方设定的接收数据帧时间窗范围为发送方和接收方周期最大值的2-4倍。
步骤七，诊断异常次数加1，若诊断异常次数累计未达到容限阈值(所述容限阈值为2-5次)则维护状态不变，否则进行故障处理：
1)对接收数据帧的上层数据的质量位置为无效；
2)外观提示：利用点阵显示故障具体原因。
步骤八，诊断异常次数清零，进行故障恢复处理：
1)对接收数据帧的上层数据的质量位置为有效；
2)外观提示：点阵不在显示任何信息代表网络诊断一切正常。
与现有技术相比，本发明核电站安全级仪控系统通信协议的自诊断方法，实现了对8种网络错误的诊断全覆盖；通过准确判断上层数据质量位置是否有效，从而确保错误数据不会被误用；设置合理的网络诊断故障次数容限阈值，既保证系统稳定(不会因为偶发错误而反复状态跳变)，又能在确认为网络故障的情况下第一时间上报。本发明的方法，误判率极低，能有效确保核电站安全级仪控系统点对点通信质量。
附图说明
图1为典型的核电站安全级仪控系统结构示意图；
图2为本发明核电站安全级仪控系统通信协议的自诊断方法发送处理流程框图；
图3为本发明核电站安全级仪控系统通信协议的自诊断方法接收数据诊断处理流程框图。
具体实施方式
下面结合附图对本发明核电站安全级仪控系统通信协议的自诊断方法做进一步的描述。
本发明是基于本申请人的ZL200910238712.6号专利“一种基于反应堆保护系统列间安全通讯网络协议的通信方法”所涉及的通信方法的自诊断实现方法。ZL200910238712.6号专利涉及的是一种用于系统列间通讯的安全网络协议，尤指基于反应堆保护系统列间安全通讯网络协议的通信方法。该通信协议虽然适用于核电控制系统中，但是根据IEC6178-3、IEC60880以及IEC61508对于安全网络的自诊断要求，需要对数据崩溃、意外重传、错序、丢失、延迟超时、无效插入、伪装报文和错误寻址8种网络错误的诊断全覆盖，并且还要满足网络残差率的要求。网络残差率是衡量安全网络的安全等级的重要指标。在IEC61784-3中网络残差率有明确的计算公式，这样就可以定量评估所设计网络协议的残差率，其公式如下：
^SLPe＝RSL(Pe)×v×m
Figure PCTCN2017072495-appb-000001
单个安全报文的残余差错率RSL(Pe)是由所选用的CRC校验过程决定的，经过CRC校验的报文的残余差错率计算公式为：
RCRCPe＝2-r+k＝d minnCnk×Pek×(1-Pe)n-k
公式符号 意义
r 附加CRC校验字符串的长度
n 传输数据报文的长度
dmin 最小海明距离
海明距离：两个码字的对应比特取值不同的比特数称为这两个码字 的海明距离。在一个有效编码集中，任意两个码字的海明距离的最小值称为该编码集的海明距离。举例如下：10101和00110从第一位开始依次有第一位、第四、第五位不同，则海明距离为3。
实施例一
本发明的自诊断方法涉及接收方和发送方使用异步通信方式，接收方不能向发送方发送应答帧。网络设备的发送和接收，读取网络数据时只可以使用定期查询的方式来读取网络数据帧，不能使用中断机制读取网络数据。本发明的数据帧结构如下表所示，其中的数据帧结构是目的地址、源地址、应用层协议号、应用层数据部分和CRC校验码。其中应用层协议号在本实施例中固定为“0XAABB”。
目的MAC地址 源MAC地址 应用层协议号 应用层数据 CRC校验
对应用层数据帧的总长度定义为1000个字节，应用层的数据帧如下表所示：
Figure PCTCN2017072495-appb-000002
其中功能码，是对数据模式做了特定标识；
应用模式，按照协议规定，固定数值为3；
TICK值：每周期累加1，即为周期循环数；
报文序列号：即本周期内发送报文的序列号，该字段和重传位强相关，当序列号为1代表为本周期首传数据帧，重传位0；当序列号为2代表为本周期重传数据帧，重传位1；
报名长度：代表整个数据帧的长度，起始位置为目的MAC地址，终止位置为CRC校验码；
本分组有效数据长度：代表上层数据的有效数据长度；
分组总数：代表本组数据总包数；
分组序号：代表本组数据的包号；
重传位：0代表本周期首传数据帧；1代表为本周期重传数据帧。两包数据帧除了报文序列号、重传位以及CRC校验码，其他字段完全一致。
保留区：数值为0，为协议扩展字段；
上层数据：系统采集或需要发送的命令；
CRC校验码：重传位为0，使用CRC校验值为0x04C11DB7；重传位1，使用CRC校验值为0xBA0DC66B。
在本实施例中，发送方在初始化阶段获取本方运行周期为10毫秒，本地MAC为{0x01，0x05，0x03，0x07，0x0a}，目的MAC为{0x02，0x03，0x05，0x0a，0x0b}，接收方在初始化阶段获取本方运行周期为10毫秒，本地MAC为{0x02，0x03，0x05，0x0a，0x0b}，目的MAC为{0x01，0x05，0x03，0x07，0x0a}。接收方设定的接收数据帧时间窗为20毫秒，诊断异常次数的容限阈值为3次。具体诊断方法如下：
步骤一，发送方进入循环周期后，如图2所示，周期性获取上层数据并对上层数据按照协议格式进行封装，其中TICK值取值为循环周期值，从0开始。对于首传数据帧，报文序列号为0，重传位为0，使用CRC校验值为0x04C11DB7；对于重传数据帧，报文序列号为1，重传位1，使用CRC校验值为0xBA0DC66B；
步骤二，接收方进入循环周期后，如图3所示，开始对接收的数据帧进行周期诊断。接收方若在当前周期没有接收到数据帧则进入步骤六；接收方若接收到发送方发送的数据帧后，则检查数据帧的目的MAC是否为{0x02，0x03，0x05，0x0a，0x0b}，源MAC是否为{0x01，0x05，0x03，0x07，0x0a}，若检查异常则诊断错误寻址，当诊断异常时记录异常原因进入步骤七，当检查正常时，进入步骤三；
步骤三，通过诊断数据帧TICK、报文序列号和重传位判断是否发生重传、错序、丢失、无效插入四种网络错误，具体方法如下：
假设上一数据帧TICK值为0X5A，报文序列号为1，重传位为0，本次接收到的数据帧TICK值为0X5B，报文序列号为1，重传位为0。则可诊断为数据帧丢失；
假设上一数据帧TICK值为0X5A，报文序列号为1，重传位为0，本次接收到的数据帧TICK值为0X5A，报文序列号为1，重传位为0。则可诊断为重传；
假设上一数据帧TICK值为0X5A，报文序列号为1，重传位为0，本次接收到的数据帧TICK值为0X50，报文序列号为1，重传位为0。则可诊断为错序；
假设上一数据帧TICK值为0X5A，报文序列号为1，重传位为0，本次接收到的数据帧TICK值为0X3C，报文序列号为9，重传位为0。则可诊断为无效插入；
假设上一数据帧TICK值为0X5A，报文序列号为0，重传位为0，本次接收到的数据帧TICK值为0X5A，报文序列号为2，重传位为1，则可为诊断正常。
根据上面诊断信息，当诊断异常时记录异常原因进入步骤七，当检查正常时，进入步骤四；
步骤四，对首传数据帧和重传数据帧进行各自CRC校验和进行校验，若校验成功则对两包数据帧的上层数据进行二进制比较。若比较两包数据帧的上层数据完成一致，则诊断为正常，进入步骤五，否则诊断为数据崩溃，进入步骤七。
步骤五，检查数据帧的应用模式和应用层协议号是否为预先设定值，即检查应用模式是否等于3，应用层协议号是否等于0XAABB，若不等于则诊断为伪装报文进入步骤七，否则诊断为正常进入步骤八；
步骤六，若本周期没有接收到数据帧，当累计未接收到数据帧时间超过20毫秒，则诊断为延时超时进入步骤七。否则保持当前状态并记录未接收到数据帧时间，进入下一周期进行诊断。
步骤七，诊断异常次数加1，若诊断异常次数累计未达到3次则维护状态不变，否则进行故障处理：
对接收数据帧的上层数据的质量位置为0X2C，0X2C代表为本接收方置的质量位，便于查找和定位；
外观提示：关闭代表通信正常“RUN”灯，并且利用点阵显示故障具体原因，若诊断为数据崩溃点阵显示“W001”代表，若诊断为数据意外重传点阵显示“W002”，若诊断为错序点阵显示“W003”，若诊断为丢失点阵显示“W004”，若诊断为延迟超时点阵显示“W005”，若诊断为无效插入点阵显示“W006”，若诊断为伪装报文点阵显示“W007”，若诊断为错误寻址点阵显示“W008”。
故障处理完毕进入下一周期进行诊断。
步骤八，诊断异常次数清零，进行故障恢复处理：
对接收数据帧的上层数据的质量位置为有效。即对上层数据的质量 位置为0；
外观提示：点亮代表通信正常“RUN”灯，点阵不在显示任何信息代表网络诊断一切正常。
故障恢复处理完毕后，进入下一周期进行诊断。
实施例二
在本实施例中，应用层协议号固定为“0XAABB”，应用模式固定数值为3。发送方在初始化阶段获取本方运行周期为8毫秒，本地MAC为{0x01，0x05，0x03，0x07，0x0a}，目的MAC为{0x02，0x03，0x05，0x0a，0x0b}，接收方在初始化阶段获取本方运行周期为8毫秒，本地MAC为{0x02，0x03，0x05，0x0a，0x0b}，目的MAC为{0x01，0x05，0x03，0x07，0x0a}。接收方设定的接收数据帧时间窗为32毫秒，诊断异常次数的容限阈值为5次。具体诊断方法如下：
步骤一，发送方进入循环周期后，如图2所示，周期性获取上层数据并对上层数据按照协议格式进行封装，其中TICK值取值为循环周期值，从0开始。对于首传数据帧，报文序列号为0，重传位为0，使用CRC校验值为0x04C11DB7；对于重传数据帧，报文序列号为1，重传位1，使用CRC校验值为0xBA0DC66B；
步骤二，接收方进入循环周期后，如图3所示，开始对接收的数据帧进行周期诊断。接收方若在当前周期没有接收到数据帧则进入步骤六；接收方若接收到发送方发送的数据帧后，则检查数据帧的目的MAC是否为{0x02，0x03，0x05，0x0a，0x0b}，源MAC是否为{0x01，0x05，0x03，0x07，0x0a}，若检查异常则诊断错误寻址，当诊断异常时记录异常原因进入步骤七，当检查正常时，进入步骤三；
步骤三，通过诊断数据帧TICK、报文序列号和重传位判断是否发生重传、错序、丢失、无效插入四种网络错误，具体方法如下：
假设上一数据帧TICK值为0X5A，报文序列号为1，重传位为0，本次接收到的数据帧TICK值为0X5B，报文序列号为1，重传位为0。则可诊断为数据帧丢失；
假设上一数据帧TICK值为0X5A，报文序列号为1，重传位为0，本次接收到的数据帧TICK值为0X5A，报文序列号为1，重传位为0。则可诊断为重传；
假设上一数据帧TICK值为0X5A，报文序列号为1，重传位为0，本次接收到的数据帧TICK值为0X50，报文序列号为1，重传位为0。则可诊断为错序；
假设上一数据帧TICK值为0X5A，报文序列号为1，重传位为0，本次接收到的数据帧TICK值为0X3C，报文序列号为9，重传位为0。则可诊断为无效插入；
假设上一数据帧TICK值为0X5A，报文序列号为0，重传位为0，本次接收到的数据帧TICK值为0X5A，报文序列号为2，重传位为1，则可为诊断正常。
根据上面诊断信息，当诊断异常时记录异常原因进入步骤七，当检查正常时，进入步骤四；
步骤四，对首传数据帧和重传数据帧进行各自CRC校验和进行校验，若校验成功则对两包数据帧的上层数据进行二进制比较。若比较两包数据帧的上层数据完成一致，则诊断为正常，进入步骤五，否则诊断为数据崩溃，进入步骤七。
步骤五，检查数据帧的应用模式和应用层协议号是否为预先设定值，即检查应用模式是否等于3，应用层协议号是否等于0XAABB，若不等于则诊断为伪装报文进入步骤七，否则诊断为正常进入步骤八；
步骤六，若本周期没有接收到数据帧，当累计未接收到数据帧时间超过32毫秒，则诊断为延时超时进入步骤七。否则保持当前状态并记录未接收到数据帧时间，进入下一周期进行诊断。
步骤七，诊断异常次数加1，若诊断异常次数累计未达到5次则维护状态不变，否则进行故障处理：
对接收数据帧的上层数据的质量位置为0X2C，0X2C代表为本接收方置的质量位，便于查找和定位；
外观提示：关闭代表通信正常“RUN”灯，并且利用点阵显示故障具体原因，若诊断为数据崩溃点阵显示“W00a”代表，若诊断为数据意外重传点阵显示“W00b”，若诊断为错序点阵显示“W00c”，若诊断为丢失点阵显示“W00d”，若诊断为延迟超时点阵显示“W00e”，若诊断为无效插入点阵显示“W00f”，若诊断为伪装报文点阵显示“W00g”，若诊断为错误寻址点阵显示“W00h”。
故障处理完毕进入下一周期进行诊断。
步骤八，诊断异常次数清零，进行故障恢复处理：
对接收数据帧的上层数据的质量位置为有效。即对上层数据的质量位置为0；
外观提示：点亮代表通信正常“RUN”灯，点阵不在显示任何信息代表网络诊断一切正常。
故障恢复处理完毕后，进入下一周期进行诊断。
实施例三
在本实施例中，应用层协议号固定为“0XAABB”，应用模式固定数值为3。发送方在初始化阶段获取本方运行周期为20毫秒，本地MAC为{0x01，0x05，0x03，0x07，0x0a}，目的MAC为{0x02，0x03，0x05，0x0a，0x0b}，接收方在初始化阶段获取本方运行周期为20毫秒，本地MAC为{0x02，0x03，0x05，0x0a，0x0b}，目的MAC为{0x01，0x05，0x03，0x07，0x0a}。接收方设定的接收数据帧时间窗为60毫秒，诊断异常次数的容限阈值为2次。具体诊断方法如下：
步骤一，发送方进入循环周期后，如图2所示，周期性获取上层数据并对上层数据按照协议格式进行封装，其中TICK值取值为循环周期值，从0开始。对于首传数据帧，报文序列号为0，重传位为0，使用CRC校验值为0x04C11DB7；对于重传数据帧，报文序列号为1，重传位1，使用CRC校验值为0xBA0DC66B；
步骤二，接收方进入循环周期后，如图3所示，开始对接收的数据帧进行周期诊断。接收方若在当前周期没有接收到数据帧则进入步骤六；接收方若接收到发送方发送的数据帧后，则检查数据帧的目的MAC是否为{0x02，0x03，0x05，0x0a，0x0b}，源MAC是否为{0x01，0x05，0x03，0x07，0x0a}，若检查异常则诊断错误寻址，当诊断异常时记录异常原因进入步骤七，当检查正常时，进入步骤三；
步骤三，通过诊断数据帧TICK、报文序列号和重传位判断是否发生重传、错序、丢失、无效插入四种网络错误，具体方法如下：
假设上一数据帧TICK值为0X5A，报文序列号为1，重传位为0，本次接收到的数据帧TICK值为0X5B，报文序列号为1，重传位为0。则可诊断为数据帧丢失；
假设上一数据帧TICK值为0X5A，报文序列号为1，重传位为0，本次接收到的数据帧TICK值为0X5A，报文序列号为1，重传位为0。则可诊断为重传；
假设上一数据帧TICK值为0X5A，报文序列号为1，重传位为0，本次接收到的数据帧TICK值为0X50，报文序列号为1，重传位为0。则可诊断为错序；
假设上一数据帧TICK值为0X5A，报文序列号为1，重传位为0，本次接收到的数据帧TICK值为0X3C，报文序列号为9，重传位为0。则可诊断为无效插入；
假设上一数据帧TICK值为0X5A，报文序列号为0，重传位为0，本次接收到的数据帧TICK值为0X5A，报文序列号为2，重传位为1，则可为诊断正常。
根据上面诊断信息，当诊断异常时记录异常原因进入步骤七，当检查正常时，进入步骤四；
步骤四，对首传数据帧和重传数据帧进行各自CRC校验和进行校验，若校验成功则对两包数据帧的上层数据进行二进制比较。若比较两包数据帧的上层数据完成一致，则诊断为正常，进入步骤五，否则诊断为数据崩溃，进入步骤七。
步骤五，检查数据帧的应用模式和应用层协议号是否为预先设定值，即检查应用模式是否等于3，应用层协议号是否等于0XAABB，若不等于则诊断为伪装报文进入步骤七，否则诊断为正常进入步骤八；
步骤六，若本周期没有接收到数据帧，当累计未接收到数据帧时间超过60毫秒，则诊断为延时超时进入步骤七。否则保持当前状态并记录未接收到数据帧时间，进入下一周期进行诊断。
步骤七，诊断异常次数加1，若诊断异常次数累计未达到2次则维护状态不变，否则进行故障处理：
对接收数据帧的上层数据的质量位置为0X2C，0X2C代表为本接收方置的质量位，便于查找和定位；
外观提示：关闭代表通信正常“RUN”灯，并且利用点阵显示故障具体原因，若诊断为数据崩溃点阵显示“W00A”代表，若诊断为数据意外重传点阵显示“W00B”，若诊断为错序点阵显示“W00C”，若诊断为丢失点 阵显示“W00D”，若诊断为延迟超时点阵显示“W00E”，若诊断为无效插入点阵显示“W00F”，若诊断为伪装报文点阵显示“W00G”，若诊断为错误寻址点阵显示“W00H”。
故障处理完毕进入下一周期进行诊断。
步骤八，诊断异常次数清零，进行故障恢复处理：
对接收数据帧的上层数据的质量位置为有效。即对上层数据的质量位置为0；
外观提示：点亮代表通信正常“RUN”灯，点阵不在显示任何信息代表网络诊断一切正常。
故障恢复处理完毕后，进入下一周期进行诊断。
根据IEC61508SIL3(安全完整性等级)等级标准要求，核电站安全网络需要满足残差率小于10-9。经过实际测试和插入故障，本发明的自诊断方法对于上述网络8种传输错误均可正确诊断，且网络残差率满足SIL3等级标准要求。

Claims (11)

  1. 一种核电站安全级仪控系统通信协议的自诊断方法，基于由应用层、数据链路层和物理层构成的点对点网络协议，发送方和接收方周期性运行，数据帧结构包括目的MAC、源MAC、应用层协议号、应用层数据部分和CRC校验码，所述应用层数据帧格式包括应用模式、TICK、报文序号、报文帧个数、重传位、上层数据和CRC检验码，所述上层数据的数据结构包括数据值以及质量位，具体包括以下步骤：
    步骤一，发送方获取目的MAC、源MAC和上层数据，并对获取的上层数据按照帧格式进行封装发送，其中首传数据帧的重传位置为0，重传数据帧的重传位置为1；
    步骤二，接收方若没有接收到数据帧则进入步骤六；接收方若接收到发送方发送的数据帧后，检查数据帧目的MAC和源MAC诊断错误寻址，当诊断异常时记录异常原因进入步骤七，当诊断正常时，进入步骤三；
    步骤三，判断数据帧TICK和报文序号，通过检查TICK值和报文序号的值判断是否发生重传、错序、丢失、无效插入四种网络错误，当诊断异常时记录异常原因进入步骤七，当诊断正常时进入步骤四；
    步骤四，利用数据帧CRC校验码检查诊断数据崩溃错误，当诊断异常时记录异常原因进入步骤七，并对重传数据帧里的上层数据进行比较，若不一致也认为是数据崩溃，记录异常原因进入步骤七，当诊断正常时进入步骤五；
    步骤五，检查数据帧应用模式和应用层协议号，若不是预先设定值则诊断为伪装报文记录异常原因进入步骤七，当诊断正常时进入步骤八；
    步骤六，当接收方在超过设定接收数据帧时间窗未接收到数据帧，则诊断为延时超时，记录异常原因进入步骤七；若未超过设定接收数据帧时间窗则保持当前状态并记录未接收到数据帧的时间；
    步骤七，诊断异常次数加1，若诊断异常次数累计未达到容限阈值则维护状态不变，否则进行故障处理：对接收数据帧的上层数据的质量位置为无效，利用点阵显示故障具体原因；
    步骤八，诊断异常次数清零，进行故障恢复处理：对接收数据帧的上层数据的质量位置为有效，利用点阵显示网络诊断正常。
  2. 根据权利要求1所述的核电站安全级仪控系统通信协议的自诊断方法，其特征在于所述网络协议的网络数据量恒定，接口模式为全双工异步传输模式，传输介质为多膜光纤。
  3. 根据权利要求1所述的核电站安全级仪控系统通信协议的自诊断方法，其特征在于所述目的MAC、源MAC和上层数据通过组态工具获得。
  4. 根据权利要求1所述的核电站安全级仪控系统通信协议的自诊断方法，其特征在于所述应用层数据帧格式还包括报文总长、帧有效数据长、本报文帧的序页和保留区。
  5. 根据权利要求4所述的核电站安全级仪控系统通信协议的自诊断方法，其特征在于所述帧有效数据长通过组态工具获得。
  6. 根据权利要求1所述的核电站安全级仪控系统通信协议的自诊断方法，其特征在于所述应用层的数据帧的长度范围为256字节-1500字节。
  7. 根据权利要求6所述的核电站安全级仪控系统通信协议的自诊断方法，其特征在于所述应用层的数据帧的长度范围为512字节-1200字节。
  8. 根据权利要求1所述的核电站安全级仪控系统通信协议的自诊断方法，其特征在于所述发送方和接收方的运行周期相同。
  9. 根据权利要求1所述的核电站安全级仪控系统通信协议的自诊断方法，其特征在于所述发送方和接收方的运行周期范围为8毫秒-20毫秒。
  10. 根据权利要求1所述的核电站安全级仪控系统通信协议的自诊断方法，其特征在于所述接收方设定的接收数据帧时间窗为发送方和接收方运行周期最大值的2-4倍。
  11. 根据权利要求1所述的核电站安全级仪控系统通信协议的自诊断方法，其特征在于所述诊断异常次数的容限阈值为2-5次。
PCT/CN2017/072495 2017-01-24 2017-01-24 一种核电站安全级仪控系统通信协议的自诊断方法 WO2018137147A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP17894461.7A EP3557816A4 (en) 2017-01-24 2017-01-24 SELF-DIAGNOSIS PROCESS FOR AN INSTRUMENTATION SYSTEM COMMUNICATION PROTOCOL AND SAFETY LEVEL CONTROL OF A NUCLEAR POWER PLANT
PCT/CN2017/072495 WO2018137147A1 (zh) 2017-01-24 2017-01-24 一种核电站安全级仪控系统通信协议的自诊断方法

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2017/072495 WO2018137147A1 (zh) 2017-01-24 2017-01-24 一种核电站安全级仪控系统通信协议的自诊断方法

Publications (1)

Publication Number Publication Date
WO2018137147A1 true WO2018137147A1 (zh) 2018-08-02

Family

ID=62978452

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/072495 WO2018137147A1 (zh) 2017-01-24 2017-01-24 一种核电站安全级仪控系统通信协议的自诊断方法

Country Status (2)

Country Link
EP (1) EP3557816A4 (zh)
WO (1) WO2018137147A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109526023A (zh) * 2019-01-02 2019-03-26 上海第二工业大学 一种数据包的封装及校验方法
CN112235827A (zh) * 2020-09-15 2021-01-15 郑州景璇电子科技有限公司 一种用于提高无线组网数据通信成功效率的方法
CN113238535A (zh) * 2021-06-03 2021-08-10 中国核动力研究设计院 一种核安全级dcs模拟量输入模块故障诊断方法及系统
CN113608521A (zh) * 2021-08-09 2021-11-05 北京康吉森自动化技术股份有限公司 一种tricon自动化仿真模拟测试系统
CN113949561A (zh) * 2021-10-15 2022-01-18 杭州和利时自动化有限公司 一种安全控制器的站间安全通信方法、装置及介质

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112118042B (zh) * 2020-09-16 2023-04-14 西安空间无线电技术研究所 一种基于星载光纤接口的数据传输方法及装置
CN114338339B (zh) * 2021-11-24 2023-05-26 华电电力科学研究院有限公司 数字电厂集成系统和集成方法
CN117131110B (zh) * 2023-10-27 2024-01-23 南京中鑫智电科技有限公司 一种基于关联分析的容性设备介质损耗监测方法及系统

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020010874A1 (en) * 1999-01-26 2002-01-24 Siemens Aktiengesellschaft System, device and method for determining the reliability of data carriers in a failsafe system network
CN102082773A (zh) * 2009-11-30 2011-06-01 北京广利核系统工程有限公司 一种基于反应堆保护系统列间安全通讯网络协议的通信方法
CN102984097A (zh) 2011-06-07 2013-03-20 美国博通公司 用于平衡信道内电磁干扰降低的收发器自诊断
CN103391223A (zh) * 2013-06-28 2013-11-13 吉林省电力有限公司长春供电公司 一种iec101协议报文快速自动检测方法
CN103457791A (zh) 2013-08-19 2013-12-18 国家电网公司 一种智能变电站网络采样和控制链路的自诊断方法
CN105450469A (zh) * 2015-12-01 2016-03-30 许继电气股份有限公司 一种工业设备中快速通信总线故障检测方法

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR100600608B1 (ko) * 2004-11-16 2006-07-13 한국전자통신연구원 물리계층 구성모듈의 검증장치, 검증방법 및 이를 이용한통신시스템
DE102007028766A1 (de) * 2007-06-22 2008-12-24 Continental Teves Ag & Co. Ohg Prüfverfahren und elektronische Schaltung zur sicheren seriellen Übertragung von Daten
EP2053774B1 (en) * 2007-10-23 2013-05-08 Nokia Siemens Networks Oy Method and device for data processing and communication system comprising such device
US9300602B2 (en) * 2012-11-02 2016-03-29 Qualcomm Incorporated Method, device, and apparatus for error detection and correction in wireless communications

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020010874A1 (en) * 1999-01-26 2002-01-24 Siemens Aktiengesellschaft System, device and method for determining the reliability of data carriers in a failsafe system network
CN102082773A (zh) * 2009-11-30 2011-06-01 北京广利核系统工程有限公司 一种基于反应堆保护系统列间安全通讯网络协议的通信方法
CN102984097A (zh) 2011-06-07 2013-03-20 美国博通公司 用于平衡信道内电磁干扰降低的收发器自诊断
CN103391223A (zh) * 2013-06-28 2013-11-13 吉林省电力有限公司长春供电公司 一种iec101协议报文快速自动检测方法
CN103457791A (zh) 2013-08-19 2013-12-18 国家电网公司 一种智能变电站网络采样和控制链路的自诊断方法
CN105450469A (zh) * 2015-12-01 2016-03-30 许继电气股份有限公司 一种工业设备中快速通信总线故障检测方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3557816A4

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109526023A (zh) * 2019-01-02 2019-03-26 上海第二工业大学 一种数据包的封装及校验方法
CN109526023B (zh) * 2019-01-02 2021-09-07 上海第二工业大学 一种数据包的封装及校验方法
CN112235827A (zh) * 2020-09-15 2021-01-15 郑州景璇电子科技有限公司 一种用于提高无线组网数据通信成功效率的方法
CN113238535A (zh) * 2021-06-03 2021-08-10 中国核动力研究设计院 一种核安全级dcs模拟量输入模块故障诊断方法及系统
CN113608521A (zh) * 2021-08-09 2021-11-05 北京康吉森自动化技术股份有限公司 一种tricon自动化仿真模拟测试系统
CN113949561A (zh) * 2021-10-15 2022-01-18 杭州和利时自动化有限公司 一种安全控制器的站间安全通信方法、装置及介质
CN113949561B (zh) * 2021-10-15 2024-05-17 杭州和利时自动化有限公司 一种安全控制器的站间安全通信方法、装置及介质

Also Published As

Publication number Publication date
EP3557816A1 (en) 2019-10-23
EP3557816A4 (en) 2020-07-22

Similar Documents

Publication Publication Date Title
WO2018137147A1 (zh) 一种核电站安全级仪控系统通信协议的自诊断方法
CN106888114B (zh) 一种核电站安全级仪控系统通信协议的自诊断方法
CN105871623B (zh) 一种现场总线的偶发性故障诊断方法
CN102785681B (zh) 列车在途安全状态监测方法、设备和系统
EP3700137B1 (en) Monitoring can nodes
CN103927285A (zh) 一种高可靠的双通道串行总线的数据传输方法
CN110912652B (zh) 矿用抗干扰通信模块及通信控制方法
US7808917B2 (en) Method and system for transmitting telegrams
US6907542B2 (en) System, device and method for determining the reliability of data carriers in a failsafe system network
CN112249088B (zh) 双显示系统互诊断与数据同步的方法、双显示系统和列车
CN108429729B (zh) 工业大数据采集环境下的数据通信隔离系统及其隔离方法
CN104468301A (zh) 一种基于mvb通信的安全输出方法
US10397380B2 (en) Network device for computer network and method for transmitting data with network device
CN206781785U (zh) 微机半自动闭塞设备
CN114051182A (zh) 一种基于can协议的电流数据采集分析与传输系统及方法
CN106301841A (zh) 故障信息采集的方法及装置
CN108958228B (zh) 一种带状态诊断及反馈的中继器及其故障诊断方法
CN108631914A (zh) 蓝牙数据校验、接收方法及装置和蓝牙设备
CN114124745A (zh) 一种用于诊断mvb通信故障的方法与系统
EP1443696A1 (de) Verfahren und Vorrichtung zur Überwachung einer maximalen Paketfehlerrate zu deren Messung empfangsseitig bekannte Kontrolldaten herangezogen werden
US20050149631A1 (en) Safety Modbus Protocol
CN115230772B (zh) 一种城轨列车测速测距冗余保护方法
CN107798906A (zh) 一种用于地下停车库引导的通信系统及其方法
CN115314362B (zh) 一种基于遥测网络的远端调度终端故障检测方法及系统
CN103731314B (zh) 一种通信业务行为异常的检测方法、系统及设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17894461

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017894461

Country of ref document: EP

Effective date: 20190716