WO2022142529A1 - 一种安全与常规控制应用间数据隔离的方法及装置 - Google Patents

一种安全与常规控制应用间数据隔离的方法及装置 Download PDF

Info

Publication number
WO2022142529A1
WO2022142529A1 PCT/CN2021/120687 CN2021120687W WO2022142529A1 WO 2022142529 A1 WO2022142529 A1 WO 2022142529A1 CN 2021120687 W CN2021120687 W CN 2021120687W WO 2022142529 A1 WO2022142529 A1 WO 2022142529A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
data area
control
safety
exchange
Prior art date
Application number
PCT/CN2021/120687
Other languages
English (en)
French (fr)
Inventor
裘坤
平志明
江竹轩
毛钦晖
朱燕萍
Original Assignee
浙江中控技术股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 浙江中控技术股份有限公司 filed Critical 浙江中控技术股份有限公司
Priority to JP2023501611A priority Critical patent/JP2024500196A/ja
Publication of WO2022142529A1 publication Critical patent/WO2022142529A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B19/00—Programme-control systems
    • G05B19/02—Programme-control systems electric
    • G05B19/418—Total factory control, i.e. centrally controlling a plurality of machines, e.g. direct or distributed numerical control [DNC], flexible manufacturing systems [FMS], integrated manufacturing systems [IMS] or computer integrated manufacturing [CIM]
    • G05B19/41885—Total factory control, i.e. centrally controlling a plurality of machines, e.g. direct or distributed numerical control [DNC], flexible manufacturing systems [FMS], integrated manufacturing systems [IMS] or computer integrated manufacturing [CIM] characterised by modeling, simulation of the manufacturing system
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B2219/00—Program-control systems
    • G05B2219/30—Nc systems
    • G05B2219/32—Operator till task planning
    • G05B2219/32339—Object oriented modeling, design, analysis, implementation, simulation language
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
    • Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
    • Y02P90/02—Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]

Definitions

  • the present application relates to the technical field of industrial process control, and in particular, to a method and device for data isolation between safety and conventional control applications.
  • safety control functions require high reliability and high availability, and must be developed and implemented in accordance with relevant standards for functional safety.
  • safety control applications that implement safety control functions generally include safety input data (generally refers to safety input signal points, such as DI, AI, etc.), safety control algorithms/function blocks, safety output data (generally refers to safety output signal points) , such as DO, etc.).
  • safety input data generally refers to safety input signal points, such as DI, AI, etc.
  • safety output data generally refers to safety output signal points
  • DO safety output signal points
  • conventional data including conventional input/output signal points, conventional intermediate variables, etc.
  • Integrity that is, the need to ensure the isolation of security control applications from conventional control applications. As a result, regular data that security controls access to applications is limited and small.
  • the system architecture of multi-channel voting is generally used to improve the fault margin.
  • Each controller channel contains the same safety control application and general control application, and runs all control applications independently.
  • the control system selects one channel as the master channel and the other channels as the slave channels.
  • the safety control application is output externally through a specific software and hardware voting mechanism, and the conventional control application is generally output by the main channel and not output by the slave channel.
  • the control system will redundantly synchronize the conventional data of the master channel to each slave channel, including conventional input/output signal points and their associated conventional variables.
  • the cycle for completing a round of redundant synchronization is relatively long, generally multiple control cycles.
  • the control system needs to avoid the problem that the normal data from the channel enters the safety control application, which may easily lead to the data bounce of the output of the safety application.
  • each slave channel will receive the redundant regular data (data value A) from the master channel before the change in a short period of time.
  • each slave channel will immediately vote to output the data before the change (data value A).
  • the voting output is changed data (data value B).
  • the regular data area, the security data area, and the exchange data area are all structured data or a combination of multiple data.
  • the purpose of this application is to solve the functional safety integrity, functional correctness and control response characteristics of safety control applications in industrial control systems with multi-task control and multi-channel operation.
  • a method and apparatus for data isolation between security and conventional control applications are provided.
  • a first aspect of the present application provides a method for data isolation between security and conventional control applications
  • the security control application includes a security data area and several security control tasks, the security control tasks include several security control programs
  • the conventional control The application includes a conventional data area and several conventional control tasks, and the conventional control task includes several conventional control programs
  • the method for data isolation includes: S1. Allocate an exchange data area for the control tasks in the safety control application/regular control application; S2 , Based on the allocated exchange data area, perform data isolation exchange between safety and conventional control applications.
  • step S1 specifically includes assigning independent security exchange data areas for a number of security control tasks of the security control application, and the size is limited based on the first capacity threshold, wherein the security exchange data area includes the security exchange input data area. and the safety exchange output data area; separate regular exchange input data areas of a size limited based on the second capacity threshold are allocated for several regular control tasks of the regular control application respectively.
  • the safety exchange input data area is used to store the required conventional data copied from the conventional data area, which is then read by the safety control program under the safety control task;
  • the safety exchange output data area is used to store the safety control program.
  • the regular exchange input data area is used to copy the specified safety data from the safety exchange data area of the relevant safety control task, and then be read by the regular control program under the regular control task.
  • the data isolation exchange in step S2 includes, but is not limited to, through different memory, memory space division, and access attribute settings, thereby limiting the routine control task to be unable to directly read and write the safe exchange input data area, but can read the conventional exchange input data area. And the safety exchange output data area, and the restricted safety control task cannot directly read and write the regular exchange input data area, but can read the safety exchange input data area and rewrite the safety exchange output data area.
  • step S21 specifically includes: S211, in the safety exchange input data area, allocate the memory of the corresponding exchange variable for the routine data read by the safety control task, in the safety exchange output data area, for the routine data rewritten by the safety control task. Allocate the memory of the corresponding exchange variable for the data; S212, in the regular exchange input data area, allocate the corresponding memory of the exchange variable for the safety data read by the regular control task.
  • step S22 specifically includes: S221, run the safety control task, copy the required routine data from the routine data area to the safety exchange input data area; and/or, S222, run the routine control task, from the safety exchange output of the relevant control task
  • the data area copies the safety data to the regular exchange input data area; S223, based on the running safety control task/routine control task, run the safety control task/routine control program.
  • the method for data isolation also includes an access conflict resolution mechanism based on presetting the regular data area and the safe exchange output data area respectively, so as to avoid the safety control task, the regular control task to the regular data area and the safe exchange input data area, and the safe exchange output. Read and write conflicts in the data area.
  • the access conflict resolution mechanism includes, but is not limited to, setting priorities of control tasks, read-write locks between tasks, data double buffering, and MMU memory protection.
  • a second aspect of the present application provides an apparatus for data isolation between safety and conventional control applications, comprising at least two systems with a multi-channel architecture, wherein each channel is used to run several safety control applications and/or several conventional control applications Application, among which, the safety control application includes the safety data area and several safety control tasks, the regular control application includes the regular data area and several regular control tasks, and the safety data area and the regular data area are isolated from each other; the regular control task cannot rewrite the safety data area , can only read and cannot rewrite the conventional exchange input area of the conventional data area; the security control task cannot directly access the conventional data area, but can only read and cannot rewrite the security exchange input data area of the security data area.
  • one channel in the multi-channel architecture system is used as the master channel, and the other channels are slave channels, and security data and normal data can be transmitted between the channels.
  • the security control task of the master channel is used to copy the normal data from the normal data area to the security exchange input data area of the security control task, and distribute it to the slave channel.
  • the safety control task of the slave channel selects the safety exchange input data distributed by the master channel, and covers the safety exchange input data area of the safety control task of the slave channel.
  • the slave channel and the master channel cannot communicate, copy the required general data from the general data area of the current channel to the safety exchange input data area of the safety control task.
  • FIG. 1 is a schematic flowchart of a method for data isolation between security and conventional control applications in an embodiment of the present application.
  • FIG. 2 is a schematic flowchart of a method for isolating and exchanging data between security and conventional control applications according to an embodiment of the present application.
  • FIG. 3 is a partial schematic diagram of an apparatus for data isolation between security and conventional control applications in an embodiment of the present application.
  • FIG. 4 is a partial schematic diagram of data isolation between security and conventional control applications in a single channel according to an embodiment of the present application.
  • FIG. 5 is a partial schematic diagram of data isolation between multiple tasks of safety and conventional control applications in a single channel according to an embodiment of the present application.
  • Safety hybrid control system refers to an industrial control system that includes both safety control applications and conventional control applications.
  • a channel A term specific to system devices with multiple voting structures, such as functional safety control systems.
  • a channel is the basic processing unit of a multiplexed voting system architecture.
  • a channel generally contains a CPU, corresponding memory, and associated microelectronics.
  • Each system channel runs control logic independently, working asynchronously in parallel with other channels.
  • each channel contains the same safety control application and conventional control application, wherein the safety control application is output externally through a specific software and hardware voting mechanism (the master and slave channels participate at the same time); the conventional control application Generally it is a work/standby mechanism: the master channel outputs, and the slave channel does not output.
  • Safety control application refers to the control application oriented to functional safety.
  • the function is to monitor the operation status of the production equipment. When abnormal conditions occur, they can be quickly handled according to the established safety control logic, so as to minimize the harm and ensure that the personnel and equipment are in a safe state of production. . It is characterized by high reliability, and is mostly used in the protection and control of key devices and equipment, monitoring and protection of gas and fire, safety of oil and gas transportation, monitoring and protection of steam boilers, and protection of unit control.
  • the standards to be followed mainly include IEC 61508, GB/T20438 and so on.
  • Security control applications do not allow arbitrary access to non-secure signal point data.
  • the safety control application includes a safety data area and several safety control tasks, each safety control task includes a task background control program and several safety control programs, and each safety control program includes several safety control loops. Each safety control loop contains safe signal input/output points and safe control logic.
  • Conventional control application refers to the control application oriented to process control, which is applied to the continuous measurement, conventional control, and operation control management of the conventional production process to ensure the smooth operation of the production device.
  • the conventional control application includes a conventional data area and several conventional control tasks, each conventional control task includes a task background control program and several conventional control programs, and each conventional control program includes several conventional control loops.
  • Each conventional control loop contains conventional signal input/output points, as well as conventional control logic.
  • Safety data area refers to the data area subordinate to the safety control application, generally including safety input signal data, safety output signal data, safety internal data, etc.
  • the data area is generally structured data or closely related data combinations. It is necessary to ensure that the control task or control program can completely read and write the entire data structure or data combination when reading and writing data, instead of only reading and writing. part of data.
  • Conventional data area refers to the data area belonging to conventional control applications, generally including conventional input signal data, conventional output signal data, conventional internal data, etc.
  • the data area is generally structured data or closely related data combinations. It is necessary to ensure that the control task or control program can completely read and write the entire data structure or data combination when reading and writing data. Some data was read and written.
  • Task contains several control programs, some data, and task background control programs, and is the main object of control logic scheduling control in the control system.
  • the execution of tasks is asynchronous and relatively independent, and there may be scenarios where multiple tasks access the same data at the same time.
  • Control program contains several program segments, and generally uses a programming language that conforms to the IEC61131-3 standard to write control logic.
  • Control loop The basic unit of control logic, generally including input signal point data, output signal point data, control algorithm or function block, etc., such as the classic PID control loop.
  • the purpose of this application is to solve the problem of data isolation between safety control applications and conventional control applications in a safety hybrid control system, and a set of methods and corresponding devices for data isolation between safety and conventional control applications are designed.
  • a method and apparatus for data isolation between security and conventional control applications are described in detail so that those skilled in the art can better understand the technical solutions of the present application.
  • FIG. 1 is a schematic flowchart of a method for data isolation between security and conventional control applications of the present application, which includes the following steps:
  • Allocate the exchange data area Allocate an independent, limited-size safety exchange data area for each safety control task in the safety control application, including the safety exchange input data area and the safety exchange output data area; assign an independent safety exchange data area to each routine control task in the routine control application.
  • a regular swap input data area of limited size The safety exchange input data area is used to store the designated regular data copied from the regular data area, and then read by the safety control program under the safety control task.
  • the safety exchange output data area is used to store exchange variables for general data overwritten by the safety control task.
  • the normal exchange input data area is used to copy the designated safety data from the safety exchange data area of the relevant safety control task, and then be read by the normal control program under the normal control task.
  • the data exchange includes, but is not limited to, through different memory, memory space division, and access attribute settings, thereby limiting the routine control tasks to be unable to directly read and write the secure exchange input data area, but to read the regular exchange input data. area and secure exchange output data area, and the restricted security control task cannot directly read and write the regular exchange input data area, but can read the secure exchange input data area and rewrite the secure exchange output data area.
  • the routine control tasks to be unable to directly read and write the secure exchange input data area, but to read the regular exchange input data.
  • area and secure exchange output data area and the restricted security control task cannot directly read and write the regular exchange input data area, but can read the secure exchange input data area and rewrite the secure exchange output data area.
  • the restricted security control task cannot directly read and write the regular exchange input data area, but can read the secure exchange input data area and rewrite the secure exchange output data area.
  • the memory of the corresponding transformation variable is allocated for each general data input to the safety control task.
  • the exchange variable corresponding to the regular data read by the safety control task is allocated in the safety exchange input data area;
  • the exchange variable of the regular data rewritten by the safety control task is allocated in the safety exchange output data area;
  • the safety exchange variable read by the regular control task The regular exchange input variable corresponding to the exchange variable is allocated in the regular exchange input data area.
  • each safety control task includes updating and reading the safety exchange input data area.
  • each safety control task When each safety control task is running, first copy the specified part of the regular data from the regular data area to the corresponding safety exchange input data area, and then run the subordinate to the safety control task.
  • Each safety control program Each safety control program.
  • each safety control task and routine control task is mutually independent and asynchronous, and step update, read safety exchange input data area and update, read routine exchange input data area can be executed concurrently.
  • the device adopts "setting the priority of the control task” and “setting the priority of the control task”.
  • Access conflict resolution mechanisms such as "read-write locks between tasks", “data double buffering” or "MMU memory protection”.
  • it is prioritized to ensure that the regular control task is allowed to rewrite the regular data area after reading the regular data area by the security control task.
  • FIG. 3 a partial schematic diagram of an apparatus for data isolation between security and conventional control applications of the present application.
  • the device includes at least two systems of multi-channel architecture, wherein each channel is used to run several safety control applications and/or several conventional control applications, wherein the safety control applications include a safety data area and a number of safety control tasks, the conventional control applications include The normal data area and some normal control tasks, the safety data area and the normal data area are isolated from each other.
  • the regular control task cannot rewrite the security data area, but can only read and cannot rewrite the regular exchange input area of the regular data area; the security control task cannot directly access the regular data area, but can only read and cannot rewrite the security exchange input data of the security data area. Area.
  • the device includes one master channel and two slave channels, and the control tasks and the control programs included in each channel are the same.
  • the safety control task of the master channel copies the specified part of the regular data from the regular data area of the master channel to the safety exchange input data area of the master channel, and quickly distributes it to the slave channel 1# and the slave channel 2#. Said fast generally refers to selecting safe exchange input data from the master channel from the safety control tasks of channel 1# and slave channel 2# within a basic control cycle or task cycle.
  • the safety control task of slave channel 1# or slave channel 2# copies the specified part of the regular data from its corresponding regular data area to the safety exchange input data area of the safety control task.
  • a single channel includes a conventional control application and a safety control application.
  • the data and programs of the safety control application and the conventional control application are relatively independent and isolated from each other.
  • the conventional control application mainly includes the conventional data area and several conventional control tasks
  • the safety control application mainly includes the safety data area and several safety control tasks.
  • routine control tasks can directly read the data in the secure data area.
  • the data is assigned to the safe exchange output data area and passed to the regular control task via the regular exchange input data area.
  • Each security control task is allocated a dedicated security exchange input data area.
  • each safety control task runs each time, it first copies the specified part of the regular data from the regular data area to the safety exchange input data area, and then runs each safety control program under the safety control task.
  • the device restricts the security control program to only read but not to rewrite the security exchange input data area through memory space division, access attribute setting, etc.
  • each security control task is allocated a dedicated security exchange output data area, and each regular control task is allocated a dedicated normal exchange input data area.
  • the device limits the regular control task to directly read the regular exchange input data area, while the security control task cannot directly access the regular exchange input data area.
  • the safety control task can read and write the safety exchange output data area, and each conventional control program in the regular control task cannot directly access the safety exchange output data area.
  • the Access conflict resolution mechanisms such as "read-write lock”, “data double buffering” or “MMU memory protection mechanism” ensure that the security control task is allowed to read the security exchange output data only after the security control task rewrites the security exchange output data area. Area.
  • FIG. 5 is a partial schematic diagram of data isolation between multiple safety control tasks and multiple conventional control tasks
  • one conventional control application and one safety control application run in a single channel of the device in the embodiment of the present application
  • the safety control application includes the safety control application.
  • Task 1# and safety control task 2#; general control applications include general control task 1# and general control task 2#.
  • the safety control application and the conventional control application may respectively include several control tasks, and each of the safety control tasks and the conventional control tasks run relatively independently and asynchronously. In this embodiment, for the sake of clarity, only two control tasks are shown in each.
  • the rules for the operation of security control tasks and the operation of general control tasks are as follows:
  • Safety control task 1# and safety control task 2# can simultaneously and independently read the respective specified data in the conventional data area, and copy them to safety exchange input data 1# and safety exchange input data 2# respectively;
  • Regular control task 1# and regular control task 2# can simultaneously and independently read the data specified in the safety exchange output data area 1# and safety exchange output data area 2# of the related safety tasks, and copy them to Regular exchange input data area 1# and regular exchange input data area 2#.

Landscapes

  • Engineering & Computer Science (AREA)
  • Manufacturing & Machinery (AREA)
  • General Engineering & Computer Science (AREA)
  • Quality & Reliability (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Automation & Control Theory (AREA)
  • Storage Device Security (AREA)
  • Safety Devices In Control Systems (AREA)

Abstract

一种安全与常规控制应用间数据隔离的方法，包括：S1、为安全/常规控制任务分配交换数据区；S2、基于分配的交换数据区，进行安全与常规控制应用间数据隔离交换；一种安全与常规控制应用间数据隔离的装置，至少包括两个多通道架构的系统，每个通道均包括隔离的安全数据区和常规数据区；常规控制任务不能改写安全数据区，只能读取不能改写常规交换输入区，安全控制任务不能直接访问常规数据区，只能读取不能改写安全交换输入数据区。

Description

一种安全与常规控制应用间数据隔离的方法及装置
相关申请
本申请要求2020年12月29日申请的，申请号为202011590531.2，发明名称为“一种安全与常规控制应用间数据隔离的方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及工业过程控制技术领域，特别是涉及一种安全与常规控制应用间数据隔离的方法及装置。
背景技术
为了综合安全控制系统和常规过程控制系统的功能优点，提升控制系统部署和应用拓展的灵活性，降低控制系统的生产和使用成本等，在油气传输、小型关键系统控制等工业应用领域，已越来越多地需要在同一套控制系统中同时支持安全控制功能和常规控制功能。
安全控制功能要求具备高可靠性、高可用性，需遵循功能安全的相关标准开发和实施。安全控制应用中，实施安全控制功能的安全控制应用一般包括安全输入数据(一般指安全输入信号点，比如DI、AI等)，安全控制算法/功能块、安全输出数据(一般指安全输出信号点，比如DO等)。一般情况下，不允许常规数据(包括常规输入/输出信号点，常规中间变量等)直接进入或影响安全应用，以及避免常规控制应用的运行直接影响安全控制应用，否则会降低安全控制功能的安全完整性，即需要保障安全控制应用与常规控制应用的隔离。因此，安全控制应用访问的常规数据是受限的、规模较小的。
在安全混合控制系统中，为保障安全控制应用的功能完整性，一般采用多通道表决的系统架构来提高故障裕度。每个控制器通道均包含相同的安全控制应用和常规控制应用，并独立地运行所有的控制应用。控制系统根据一定的策略，选取一个通道作为主通道，其它通道作为从通道。其中，安全控制应用通过特定的软硬件表决机制对外输出，常规控制应用一般是主通道输出，从通道不输出。
为了保障控制系统的容错性和常规控制功能的可用性，控制系统会将主通道的常规数据冗余同步给各个从通道，这些数据包括常规输入/输出信号点，及与其相关的常规变量。完成一轮冗余同步的周期较长，一般为多个控制周期。控制系统需避免从通道的常规数据 进入安全控制应用后容易导致安全应用输出发生数据回跳的问题，例如当常规数据发生变化时(从数据值A变化为数据值B)，各从通道的安全控制应用受该常规数据(数据值B)影响会立即表决输出(输出数据值B)，此后短时间内各从通道又收到来自主通道变化前的冗余常规数据(数据值A)，此时各从通道受该常规数据影响又会立即表决输出为变化前的数据(数据值A)，此后只有当各从通道收到来自主通道变化后的冗余常规数据时(数据值B)，才会受此影响表决输出为变化后的数据(数据值B)。
另外，由于实际控制应用场景中，常规数据区、安全数据区、交换数据区中均为结构化数据或多个数据的组合，当有多个异步的任务可能同时读写这些数据区时，需保障任务间读写的互斥，避免一个任务在改写部分结构化数据时，另一个任务在读取该结构数据，则会导致后者读取的数据不完整，甚至错误。
相关技术中有用于执行不安全应用的第一处理器和专用于执行安全应用的第二处理器。其中安全应用中只有一个任务，通过一片全局数据区交换数据，仅是基于微控制器系统，对安全控制、常规控制对存储器的共享访问进行互斥保护。
发明内容
本申请的目的在于解决多任务控制、多通道运行的工业控制系统中安全控制应用的功能安全完整性，功能正确性和控制响应特性。提供了一种安全与常规控制应用间数据隔离的方法及装置。
本申请的第一个方面提供了一种安全与常规控制应用间数据隔离的方法，安全控制应用包括安全数据区和若干安全控制任务，所述安全控制任务包括若干安全控制程序；所述常规控制应用包括常规数据区和若干常规控制任务，所述常规控制任务包括若干常规控制程序；所述数据隔离的方法包括：S1、为安全控制应用/常规控制应用中的控制任务分配交换数据区；S2、基于分配的交换数据区，进行安全与常规控制应用间数据隔离交换。
进一步的，步骤S1具体包括，为安全控制应用的若干安全控制任务分别分配独立的，并基于第一容量阈值限定大小的安全交换数据区，其中，所述安全交换数据区包括安全交换输入数据区和安全交换输出数据区；为常规控制应用的若干常规控制任务分别分配独立的，并基于第二容量阈值限定大小的常规交换输入数据区。
进一步的，所述安全交换输入数据区用于存储从常规数据区拷贝的所需常规数据，进而被安全控制任务下的安全控制程序读取；所述安全交换输出数据区用于存储被安全控制任务改写的常规数据的交换变量；所述常规交换输入数据区用于从相关的安全控制任务的安全交换数据区拷贝指定的安全数据，进而被常规控制任务下的常规控制程序读取。
进一步的，步骤S2中数据隔离交换包括但不限于通过不同的存储器、内存空间划分、访问属性设置，从而限定常规控制任务不能直接读写安全交换输入数据区，但可以读取常规交换输入数据区和安全交换输出数据区，以及，限定安全控制任务不能直接读写常规交换输入数据区，但可以读取安全交换输入数据区和改写安全交换输出数据区。
进一步的，步骤S21具体包括：S211、在安全交换输入数据区，为被安全控制任务读取的常规数据分配对应的交换变量的内存，在安全交换输出数据区，为被安全控制任务改写的常规数据分配对应的交换变量的内存；S212、在常规交换输入数据区，为被常规控制任务读取的安全数据分配对应的交换变量内存。
进一步的，步骤S22具体包括：S221、运行安全控制任务，从常规数据区拷贝需要的常规数据到安全交换输入数据区；和/或，S222、运行常规控制任务，从相关控制任务的安全交换输出数据区拷贝安全数据至常规交换输入数据区；S223、基于运行的安全控制任务/常规控制任务，运行安全控制任务/常规控制程序。
进一步的，数据隔离的方法还包括基于分别预设常规数据区和安全交换输出数据区的访问冲突解决机制，避免安全控制任务、常规控制任务对常规数据区和安全交换输入数据区、安全交换输出数据区的读写冲突。
进一步的，所述访问冲突解决机制包括但不限于设置控制任务的优先级、任务间的读写锁、数据双缓冲以及MMU内存保护。
本申请的第二个方面提供了一种安全与常规控制应用间数据隔离的装置，至少包括两个多通道架构的系统，其中每个通道均用于运行若干安全控制应用和/或若干常规控制应用，其中，安全控制应用包括安全数据区和若干安全控制任务，常规控制应用包括常规数据区和若干常规控制任务，安全数据区和常规数据区之间相互隔离；常规控制任务不能改写安全数据区，只能读取、不能改写常规数据区的常规交换输入区；安全控制任务不能直接访问常规数据区，只能读取、不能改写安全数据区的安全交换输入数据区。
进一步的，多通道架构的系统中的一个通道作为主通道，其余通道为从通道，通道间可以传递安全数据和常规数据。
进一步的，所述主通道的安全控制任务用于从常规数据区拷贝所述常规数据至安全控制任务的安全交换输入数据区，并分发至从通道。
进一步的，所述从通道的安全控制任务选取主通道分发的安全交换输入数据，并覆盖从通道的安全控制任务的安全交换输入数据区。
进一步的，若从通道和主通道无法通讯，则从当前通道的常规数据区拷贝所需的常规数据到安全控制任务的安全交换输入数据区。
本申请的有益技术效果如下：
1、可支持多个安全控制任务。
2、有效保障安全数据免受常规控制应用的数据、任务/程序的影响，保障安全控制应用的功能安全完整性。
3、保障多任务运行过程中任务间交换数据的完整性。
4、能较好地解决多通道间任务交换数据的同步实时性，保障控制响应实时性。
5、不止适用于安全控制应用和常规控制应用，可更广泛地使用于需要实现多任务间交换数据的受控性、完整性或实时性等较高的任何工业控制系统或装置。
附图说明
此处所说明的附图用来提供对本申请的进一步理解，构成本申请的一部分，本申请的示意性实施例及其说明用于解释本申请，并不构成对本申请的不当限定。在附图中：
图1为本申请实施例中安全与常规控制应用间数据隔离的方法的流程示意图。
图2为本申请实施例中安全与常规控制应用间数据隔离交换的方法的流程示意图。
图3为本申请实施例中安全与常规控制应用间数据隔离的装置局部示意图。
图4为本申请实施例中单个通道内安全与常规控制应用间数据隔离的局部示意图。
图5为本申请实施例中单个通道内安全与常规控制应用的多个任务间数据隔离的局部示意图。
具体实施方式
为了进一步理解本申请，下面结合实施例对本申请优选实施方案进行描述，但是应当理解，这些描述只是为进一步说明本申请的特征和优点，而不是对本申请权利要求的限制。
为了方便对本申请的理解，首先对本申请中提到的一些专业术语进行说明。
安全混合控制系统：是指同时包含安全控制应用、常规控制应用的工业控制系统。
通道：是功能安全控制系统等具有多重表决架构的系统装置特有的术语。通道是多重化表决系统架构的基本处理单元。一个通道一般包含一个CPU，相应的存储器，以及相关的微电子设备。每个系统通道独立地运行控制逻辑，与其它通道并行异步工作。一般地，一个安全混合控制系统中，每个通道均包含相同的安全控制应用和常规控制应用，其中安全控制应用通过特定的软硬件表决机制(主、从通道同时参与)对外输出；常规控制应用一般是工作/备用机制：主通道输出，从通道不输出。
安全控制应用：指面向功能安全的控制应用，功能是监视生产装置的运行状况，出现 异常工况时能按既定的安全控制逻辑迅速处理，使危害降到最低，保障人员、装置处于生产安全状态。特点是具备高可靠性，多应用于关键装置和设备的保护与控制、瓦斯与火灾的监测与保护、油气输送过程的安全、蒸汽锅炉监测与保护、机组控制的保护等领域。遵循的标准主要有IEC 61508，GB/T20438等。
安全控制应用不允许随意接入非安全的信号点数据。安全控制应用包含安全数据区和若干安全控制任务，每个安全控制任务包含任务后台控制程序和若干安全控制程序，每个安全控制程序包含若干安全控制回路。每个安全控制回路包含安全的信号输入\输出点，以及安全的控制逻辑。
常规控制应用：指面向过程控制的控制应用，应用于常规生产过程的连续测量、常规控制、操作控制管理，保障生产装置的平稳运行。常规控制应用包含常规数据区和若干常规控制任务，每个常规控制任务包含任务后台控制程序和若干常规控制程序，每个常规控制程序包含若干常规控制回路。每个常规控制回路包含常规的信号输入\输出点，以及常规的控制逻辑。
安全数据区：指从属于安全控制应用的数据区，一般包含安全输入信号数据、安全输出信号数据、安全内部数据等。数据区里一般都是结构化的数据或有紧密关联的数据组合，需保障控制任务或控制程序在读写数据时能完整地读写整个数据结构或数据组合，而不应出现只读写了部分数据。
常规数据区：指从属于常规控制应用的数据区，一般包含常规输入信号数据、常规输出信号数据、常规内部数据等。相同地，数据区里一般都是结构化的数据或有紧密关联的数据组合，需保障控制任务或控制程序在读写数据时能完整地读写整个数据结构或数据组合，而不应出现只读写了部分数据。
任务：包含若干控制程序、部分数据、以及任务后台控制程序，是控制系统中控制逻辑调度控制的主体对象。任务的执行是异步的、相对独立的，可能存在多个任务同时访问同一数据的场景。
控制程序：包含若干程序段，一般采用符合IEC61131-3标准的编程语言编写控制逻辑。
控制回路：控制逻辑的基本单元，一般包含输入信号点数据、输出信号点数据、控制算法或功能块等，比如经典的PID控制回路。
本申请的目的在于解决安全混合控制系统中安全控制应用和常规控制应用间数据隔离的问题，设计了一套安全与常规控制应用间数据隔离的方法和相应的装置，下面结合实施例对本申请的一种安全与常规控制应用间数据隔离的方法和装置进行详细说明，以便本领域技术人员能够更好地理解本申请的技术方案。
如图1所示为本申请的一种安全与常规控制应用间数据隔离的方法流程示意图，其中包括以下步骤：
S1、分配交换数据区。为安全控制应用的每一个安全控制任务分配一个独立的、限定大小的安全交换数据区，包括安全交换输入数据区和安全交换输出数据区；为常规控制应用中的每一个常规控制任务分配一个独立的、限定大小的常规交换输入数据区。安全交换输入数据区用于存储从常规数据区拷贝的指定常规数据，进而被安全控制任务下的安全控制程序读取。安全交换输出数据区用于存储被安全控制任务改写的常规数据的交换变量。常规交换输入数据区用于从相关的安全控制任务的安全交换数据区拷贝指定的安全数据，进而被常规控制任务下的常规控制程序读取。
S2、基于分配的交换数据区，进行安全与常规控制应用间数据隔离交换。
如图2所示，其中，数据交换包括但不限于通过不同的存储器、内存空间划分、访问属性设置，从而限定常规控制任务不能直接读写安全交换输入数据区，但可以读取常规交换输入数据区和安全交换输出数据区，以及，限定安全控制任务不能直接读写常规交换输入数据区，但可以读取安全交换输入数据区和改写安全交换输出数据区。具体包括：
S21、分配变量内存；
在安全交换输入数据区中为每一个输入到安全控制任务的常规数据分配对应的变换变量的内存。其中：被安全控制任务读取的常规数据对应的交换变量分配在安全交换输入数据区；被安全控制任务改写的常规数据的交换变量分配在安全交换输出数据区；被常规控制任务读取的安全交换变量对应的常规交换输入变量分配在常规交换输入数据区。
S22、更新、读取安全交换输入数据区/常规交换输入数据区。
具体包括，更新、读取安全交换输入数据区，每个安全控制任务运行时，先从常规数据区拷贝指定的部分常规数据到对应的安全交换输入数据区，然后再运行该安全控制任务下属的各安全控制程序。
还包括，更新、读取常规交换输入数据区，每个常规控制任务运行时，先从相关的安全控制任务的安全交换输出数据区拷贝指定的部分数据到常规交换输入数据区，然后再运行该常规控制任务下属的各常规控制程序。
需要说明的是，各个安全控制任务、常规控制任务的运行是相互独立、异步的，步骤更新、读取安全交换输入数据区和更新、读取常规交换输入数据区是可以并发执行。
并且，为了保障安全控制任务读取的常规数据的正确性、完整性，避免安全控制任务、常规控制任务对常规数据区的读写冲突，该装置采用了“设置控制任务的优先级”、“任务间的读写锁”、“数据双缓冲”或“MMU内存保护”等访问冲突解决机制。
在一些实施方式中，优先保障安全控制任务在读取常规数据区完毕后，才允许常规控制任务改写常规数据区。
下述示出实施例中，如图3所示，本申请的一种安全与常规控制应用间数据隔离的装置局部示意图。装置包括至少两个多通道架构的系统，其中每个通道均用于运行若干安全控制应用和/或若干常规控制应用，其中，安全控制应用包括安全数据区和若干安全控制任务，常规控制应用包括常规数据区和若干常规控制任务，安全数据区和常规数据区之间相互隔离。常规控制任务不能改写安全数据区，只能读取、不能改写常规数据区的常规交换输入区；安全控制任务不能直接访问常规数据区，只能读取、不能改写安全数据区的安全交换输入数据区。
图3中，装置包括一个主通道和2个从通道，各通道间的控制任务及其包含的控制程序均相同。主通道的安全控制任务从主通道的常规数据区拷贝指定的部分常规数据到主通道的安全交换输入数据区，并快速分发到从通道1#和从通道2#。所述的快速一般指在一个基本控制周期或者任务周期内，从通道1#和从通道2#的安全控制任务选取来自主通道的安全交换输入数据。当从通道与主通道之间断开连接时，则从通道1#或从通道2#的安全控制任务从自身对应的常规数据区拷贝指定的部分常规数据到安全控制任务的安全交换输入数据区。
下面通过实际操作实例对上述实施例中示出的安全与常规控制应用间数据隔离的方法和装置进行进一步说明，以便本领域技术人员能够更好地理解本申请的技术方案。
如图4所示，为单个通道内的局部示意图，图示中单个通道包括一个常规控制应用和一个安全控制应用，安全控制应用与常规控制应用的数据、程序相对独立，相互隔离。常规控制应用主要包含常规数据区和若干常规控制任务，安全控制应用主要包含安全数据区和若干安全控制任务。
一般地，常规控制任务可直接读取安全数据区中的数据。但是为了有利于常规控制任务执行过程中读取的安全数据的完整性、前后一致性，在本申请中的实施例中，如图4所示，可将结构化或前后一致性要求较高的数据赋值到安全交换输出数据区，并经常规交换输入数据区传递给常规控制任务。
每一个安全控制任务分配一片专属的安全交换输入数据区。每个安全控制任务每次运行时，先从常规数据区拷贝指定的部分常规数据到安全交换输入数据区，然后运行该安全控制任务下属的各安全控制程序。该装置通过内存空间划分、访问属性设置等，限定安全控制程序只能读取、不能改写安全交换输入数据区。
如图4所示，每一个安全控制任务分配一片专属的安全交换输出数据区，每一个常规控制任务分配一片专属的常规交换输入数据区。该装置通过不同的存储器、内存空间划分、访问属性设置等，限定常规控制任务可直接读取常规交换输入数据区，安全控制任务不能直接访问常规交换输入数据区。类似地，安全控制任务能读写安全交换输出数据区，常规控制任务中的各常规控制程序不能直接访问安全交换输出数据区。
常规控制任务每次运行时，从相关的安全控制任务的安全交换输出数据区拷贝指定的部分数据到常规交换输入数据区，然后再运行该常规控制任务下属的各常规控制程序。为了保障常规控制任务读取的安全交换输出数据的正确性、完整性，避免安全控制任务、常规控制任务对安全交换输出数据区的读写冲突，通过“设置控制任务的优先级”、“任务间的读写锁”、“数据双缓冲”或“MMU内存保护机制”等访问冲突解决机制，保障安全控制任务在改写安全交换输出数据区完毕后，才允许常规控制任务读取安全交换输出数据区。
如图5所示，为多安全控制任务和多常规控制任务间数据隔离的局部示意图，本申请实施例中装置的单个通道内运行一个常规控制应用和一个安全控制应用，安全控制应用包括安全控制任务1#和安全控制任务2#；常规控制应用包括常规控制任务1#和常规控制任务2#。需要说明的是，安全控制应用和常规控制应用中分别可包括若干个控制任务，各安全控制任务、常规控制任务间均相对独立、异步地运行。本实施例中为了说明清楚，仅示出各包括2个控制任务。安全控制任务运行和常规控制任务运行的规则如下：
1、安全控制任务1#和安全控制任务2#可同时并各自独立的读取常规数据区各自的指定数据，并分别拷贝到安全交换输入数据1#和安全交换输入数据2#；
2、常规控制任务1#和常规控制任务2#可同时并各自独立的读取相关的安全任务的安全交换输出数据区1#和安全交换输出数据区2#中指定的数据，并分别拷贝到常规交换输入数据区1#和常规交换输入数据区2#。
以上实施例的说明只是用于帮助理解本申请的方法及其核心思想。应当指出，对于本技术领域的普通技术人员来说，在不脱离本申请原理的前提下，还可以对本申请进行若干改进和修饰，这些改进和修饰也落入本申请权利要求的保护范围内。以上所述实施例的各技术特征可以进行任意的组合，为使描述简洁，未对上述实施例中的各个技术特征所有可能的组合都进行描述，然而，只要这些技术特征的组合不存在矛盾，都应当认为是本说明书记载的范围。

Claims (14)

  1. 一种安全与常规控制应用间数据隔离的方法，其特征在于，
    安全控制应用包括安全数据区和若干安全控制任务，所述安全控制任务包括若干安全控制程序；
    所述常规控制应用包括常规数据区和若干常规控制任务，所述常规控制任务包括若干常规控制程序；
    所述数据隔离的方法包括：
    S1、为安全控制应用/常规控制应用中的控制任务分配交换数据区；
    S2、基于分配的交换数据区，进行安全与常规控制应用间数据隔离交换。
  2. 如权利要求1所述的数据隔离的方法，其特征在于，步骤S1包括：
    为所述安全控制应用的若干安全控制任务分别分配独立的，并基于第一容量阈值限定大小的安全交换数据区，其中，所述安全交换数据区包括安全交换输入数据区和安全交换输出数据区；
    为所述常规控制应用的若干常规控制任务分别分配独立的，并基于第二容量阈值限定大小的常规交换输入数据区。
  3. 如权利要求2所述的数据隔离的方法，其特征在于，所述安全交换输入数据区用于存储从所述常规数据区拷贝的所需常规数据，进而被所述安全控制任务下的所述安全控制程序读取；
    所述安全交换输出数据区用于存储被所述安全控制任务改写的常规数据的交换变量；
    所述常规交换输入数据区用于从相关的安全控制任务的安全交换数据区拷贝指定的安全数据，进而被所述常规控制任务下的所述常规控制程序读取。
  4. 如权利要求2所述的数据隔离的方法，其特征在于，步骤S2中数据隔离交换包括通过不同的存储器、内存空间划分以及访问属性设置，从而限定所述常规控制任务不能直接读写所述安全交换输入数据区，但可以读取所述常规交换输入数据区和所述安全交换输出数据区，以及，限定所述安全控制任务不能直接读写所述常规交换输入数据区，但可以读取所述安全交换输入数据区和改写所述安全交换输出数据区。
  5. 如权利要求1所述的数据隔离的方法，其特征在于，步骤S2包括：
    S21、分配变量内存；
    S22、更新、读取所述安全交换输入数据区/所述常规交换输入数据区。
  6. 如权利要求5所述的数据隔离的方法，其特征在于，步骤S21包括：
    S211、在所述安全交换输入数据区，为被所述安全控制任务读取的常规数据分配对应 的交换变量的内存；在所述安全交换输出数据区，为被所述安全控制任务改写的常规数据分配对应的交换变量的内存；
    S212、在所述常规交换输入数据区，为被所述常规控制任务读取的安全数据分配对应的交换变量内存。
  7. 如权利要求5所述的数据隔离的方法，其特征在于，步骤S22包括：
    S221、运行所述安全控制任务，从所述常规数据区拷贝需要的常规数据到所述安全交换输入数据区；
    和/或，S222、运行所述常规控制任务，从相关控制任务的安全交换输出数据区拷贝安全数据至所述常规交换输入数据区；
    S223、基于运行的安全控制任务/常规控制任务，运行安全控制程序/常规控制程序。
  8. 如权利要求2所述的数据隔离的方法，其特征在于，所述方法还包括基于分别预设所述常规数据区和所述安全交换输出数据区的访问冲突解决机制，避免所述安全控制任务、所述常规控制任务对所述常规数据区以及所述安全交换输入数据区、所述安全交换输出数据区的读写冲突。
  9. 如权利要求8所述的数据隔离的方法，其特征在于，所述访问冲突解决机制包括设置控制任务的优先级、任务间的读写锁、数据双缓冲以及MMU内存保护。
  10. 一种安全与常规控制应用间数据隔离的装置，其特征在于，所述装置至少包括两个多通道架构的系统，其中每个通道均用于运行若干安全控制应用和/或若干常规控制应用，其中，所述安全控制应用包括安全数据区和若干安全控制任务，所述常规控制应用包括常规数据区和若干常规控制任务，所述安全数据区和所述常规数据区之间相互隔离；
    所述常规控制任务不能改写所述安全数据区，只能读取、不能改写所述常规数据区的常规交换输入区；
    所述安全控制任务不能直接访问所述常规数据区，只能读取、不能改写所述安全数据区的安全交换输入数据区。
  11. 如权利要求10所述的数据隔离的装置，其特征在于，所述多通道架构的系统中的一个通道作为主通道，其余通道为从通道，通道间用于传递安全数据和常规数据。
  12. 如权利要求11所述的数据隔离的装置，其特征在于，所述主通道的安全控制任务用于从所述常规数据区拷贝所述常规数据至所述安全控制任务的安全交换输入数据区，并分发至从通道。
  13. 如权利要求11所述的数据隔离的装置，其特征在于，所述从通道的安全控制任务选取所述主通道分发的安全交换输入数据，并覆盖所述从通道的安全控制任务的安全交换 输入数据区。
  14. 如权利要求11所述的数据隔离的装置，其特征在于，若所述从通道和所述主通道无法通讯，则从当前通道的常规数据区拷贝所需的常规数据到所述安全控制任务的安全交换输入数据区。
PCT/CN2021/120687 2020-12-29 2021-09-26 一种安全与常规控制应用间数据隔离的方法及装置 WO2022142529A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
JP2023501611A JP2024500196A (ja) 2020-12-29 2021-09-26 安全及びプロセス制御アプリケーション間のデータ分離のための方法及び装置

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011590531.2A CN112783117B (zh) 2020-12-29 2020-12-29 一种安全控制应用与常规控制应用间数据隔离的方法及装置
CN202011590531.2 2020-12-29

Publications (1)

Publication Number Publication Date
WO2022142529A1 true WO2022142529A1 (zh) 2022-07-07

Family

ID=75753177

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/120687 WO2022142529A1 (zh) 2020-12-29 2021-09-26 一种安全与常规控制应用间数据隔离的方法及装置

Country Status (3)

Country Link
JP (1) JP2024500196A (zh)
CN (1) CN112783117B (zh)
WO (1) WO2022142529A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112783117B (zh) * 2020-12-29 2022-05-10 浙江中控技术股份有限公司 一种安全控制应用与常规控制应用间数据隔离的方法及装置
WO2023093757A1 (zh) * 2021-11-24 2023-06-01 浙江中控技术股份有限公司 一种控制系统中的系统数据的防护方法及相关装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101655824A (zh) * 2009-08-25 2010-02-24 北京广利核系统工程有限公司 一种双口ram互斥访问的实现方法
US20100192217A1 (en) * 2009-01-28 2010-07-29 The Boeing Company System and method for information sharing between non-secure devices
CN106341397A (zh) * 2016-08-25 2017-01-18 柏盟（北京）科技发展有限公司 一种工业安全隔离网闸
CN110320829A (zh) * 2018-03-30 2019-10-11 欧姆龙株式会社 安全控制系统以及安全控制单元
CN110597646A (zh) * 2019-09-16 2019-12-20 五八有限公司 一种数据读写方法、系统、电子设备及存储介质
CN112783117A (zh) * 2020-12-29 2021-05-11 浙江中控技术股份有限公司 一种安全与常规控制应用间数据隔离的方法及装置

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1272931C (zh) * 2002-11-08 2006-08-30 联想(北京)有限公司 一种确保数据安全性的数据存储方法及其安全存储装置
CN101788958A (zh) * 2010-02-04 2010-07-28 杭州晟元芯片技术有限公司 一种存储器数据保护的方法
DE102010027906A1 (de) * 2010-04-19 2011-10-20 Beckhoff Automation Gmbh Datenverwaltungsverfahren und speicherprogrammierbare Steuerung
CN101840230B (zh) * 2010-06-04 2012-02-01 浙江中控技术股份有限公司 一种监控和管理数据的方法及系统
DE102011005239B4 (de) * 2011-03-08 2019-10-24 Siemens Aktiengesellschaft Sicherheitssystem sowie Verfahren zum Austauschen von sicherheitsgerichteten Daten in einem Sicherheitssystem
CN102567256B (zh) * 2011-12-16 2015-01-07 龙芯中科技术有限公司 处理器系统及其多通道内存拷贝dma加速器和方法
CN104239096A (zh) * 2014-09-02 2014-12-24 艾体威尔电子技术(北京)有限公司 Android系统实现安全数据区的方法及装置
CN104486336A (zh) * 2014-12-12 2015-04-01 冶金自动化研究设计院 工业控制网络安全隔离交换装置
CN110620791A (zh) * 2019-10-10 2019-12-27 江苏亨通工控安全研究院有限公司 一种带有预警功能的工业安全数据摆渡系统
CN110968534B (zh) * 2019-11-26 2021-11-30 航天恒星科技有限公司 一种基于fpga的多通道分片合并处理方法及系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100192217A1 (en) * 2009-01-28 2010-07-29 The Boeing Company System and method for information sharing between non-secure devices
CN101655824A (zh) * 2009-08-25 2010-02-24 北京广利核系统工程有限公司 一种双口ram互斥访问的实现方法
CN106341397A (zh) * 2016-08-25 2017-01-18 柏盟（北京）科技发展有限公司 一种工业安全隔离网闸
CN110320829A (zh) * 2018-03-30 2019-10-11 欧姆龙株式会社 安全控制系统以及安全控制单元
CN110597646A (zh) * 2019-09-16 2019-12-20 五八有限公司 一种数据读写方法、系统、电子设备及存储介质
CN112783117A (zh) * 2020-12-29 2021-05-11 浙江中控技术股份有限公司 一种安全与常规控制应用间数据隔离的方法及装置

Also Published As

Publication number Publication date
CN112783117A (zh) 2021-05-11
CN112783117B (zh) 2022-05-10
JP2024500196A (ja) 2024-01-05

Similar Documents

Publication Publication Date Title
WO2022142529A1 (zh) 一种安全与常规控制应用间数据隔离的方法及装置
US9547492B2 (en) Arithmetic units accessing redundantly stored data in shared memory as part of a control device for a vehicle
US9794340B2 (en) Mechanism and method for accessing data in a shared memory
US4466098A (en) Cross channel circuit for an electronic system having two or more redundant computers
JPH01251258A (ja) ネットワークシステムにおける共用領域管理方法
US20120110303A1 (en) Method for Process Synchronization of Embedded Applications in Multi-Core Systems
US20090193229A1 (en) High-integrity computation architecture with multiple supervised resources
WO2024109239A1 (zh) 集群数据同步方法、装置、设备及非易失性可读存储介质
US8201179B2 (en) Multi-threaded shared state variable control
CN116909741A (zh) 一种基于新一代申威众核处理器提高从核并行写共享主存临界资源速度的方法及系统
JP2001022720A (ja) マルチプロセッサシステム
CN111190345B (zh) 每个硬件单元配有多个处理器单元的冗余的自动化系统
US20230055743A1 (en) Information processing device, control method, and non-transitory computer readable medium
KR20200083017A (ko) 멀티코어 프로세서 기반의 이중화된 plc 제어시스템
US5522060A (en) Multiprocessor memory managing system and method for executing sequentially renewed instructions by locking and alternately reading slave memories
JP2022065218A (ja) 車両制御装置
JP2021026717A (ja) プロトコルコンバータ、データ伝送方法、データ伝送プログラム、及び、データ伝送システム
CN116166606B (zh) 基于共享紧耦合存储器的高速缓存控制架构
WO2022185582A1 (ja) データ処理装置、データ処理方法およびプログラム
JP2003345407A (ja) 二重化ｐｌｃ間のデータ等価方式
CN103198023A (zh) 缓冲存储器管理方法与相关缓冲存储器控制器
Weber et al. EPTL-A temporal logic for weakly consistent systems
Brzezinski et al. Consistency requirements of distributed shared memory for Dijkstra's mutual exclusion algorithm
JPS62156756A (ja) 浮動割込処理方法
JP2006178614A (ja) フォルトトレラント・コンピュータとそのバス選択制御方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21913274

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2023501611

Country of ref document: JP

WWE Wipo information: entry into national phase

Ref document number: 202317028746

Country of ref document: IN

NENP Non-entry into the national phase

Ref country code: DE

WWE Wipo information: entry into national phase

Ref document number: 523440582

Country of ref document: SA

122 Ep: pct application non-entry in european phase

Ref document number: 21913274

Country of ref document: EP

Kind code of ref document: A1