Safety instrument system, data voting method and related device

Abstract

The invention provides a safety instrument system, a data voting method and a related device, and relates to the technical field of safety control. The safety instrument system can comprise an input module, a main control module and an output module, the main control module is respectively connected with the input module and the output module; each of the input module and the main control module comprises a plurality of parallel processors, each processor comprises a one-out-of-multiple structure, and the one-out-of-multiple structure is used for voting data of the processor and data obtained by exchange from other processors; the output module comprises a plurality of parallel processors and a one-out-of-multiple structure, and the one-out-of-multiple structure is connected with the processors and used for voting output data of the processors. According to the technical scheme, the problem that an existing safety instrument system is low in reliability can be solved.

Description

Technical Field

[0001] The present application relates to the field of safety control technology, and in particular to a safety instrument system, a data voting method and related devices. Background Art

[0002] A Safety Instrumented System (SIS) is an automated safety system used in the field of industrial process control. Its main purpose is to ensure the safe operation of industrial processes, prevent accidents, and take emergency protective measures when necessary to protect the safety of personnel, equipment, and the environment by monitoring and controlling key parameters in the industrial process.

[0003] Safety instrumented systems typically use redundant architectures to provide higher levels of reliability while reducing the likelihood of unnecessary shutdowns impacting the process. However, the reliability of existing safety instrumented systems still needs to be improved. Summary of the Invention

[0004] Based on the above-mentioned defects and deficiencies of the prior art, the present application proposes a safety instrument system, a data voting method and related devices, which can overcome the problem of low reliability of the existing safety instrument system.

[0005] According to a first aspect of the present application, a safety instrumented system is provided, comprising: an input module for receiving sensor data, a main control module for processing the sensor data and outputting control data, and an output module for sending the control data output by the main control module to an actuator; the main control module is connected to the input module and the output module respectively;

[0006] The input module and the main control module both include multiple parallel processors, each processor includes a multiple-choice structure, and the multiple-choice structure is used to vote on the processor's own data and data exchanged from other processors;

[0007] The output module includes: a plurality of parallel processors and a multiple-choice structure, wherein the multiple-choice structure is connected to the plurality of processors and is used to vote on output data of the plurality of processors.

[0008] According to a second aspect of the present application, a data voting method is provided, the method comprising:

[0009] Voting on sensor data directly obtained by the processor and sensor data exchanged from other processors through a multiple-choice structure in each processor of the input module;

[0010] Voting on the control data obtained by the processor based on sensor data and the control data exchanged from other processors through a multiple-choice structure in each processor of the main control module;

[0011] The output data of the multiple processors are voted through the multiple-choice structure in the output module to obtain a final output result.

[0012] According to a third aspect of the present application, there is provided an electronic device, comprising: a memory and a processor;

[0013] The memory is connected to the processor and is used to store programs;

[0014] The processor is used to implement the data voting method as described in the second aspect by running the program in the memory.

[0015] According to a fourth aspect of the present application, a storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the data voting method as described in the second aspect is implemented.

[0016] According to a fifth aspect of the present application, a computer program product or computer program is provided. The computer program product includes the computer program, and when a processor executes the computer program, the steps of the data voting method described in the second aspect are implemented. Optionally, the computer program can be stored on a computer-readable storage medium or in the cloud; the processor of the computer device reads the computer program from the computer-readable storage medium or the cloud.

[0017] In the technical solution provided in this application, the input module, main control module and output module in the safety instrument system all adopt a redundant architecture. The redundant mode and voting strategy are guaranteed in the overall process of data acquisition, calculation, and output, which can reduce the problems of data anomalies and loss caused by problems with a certain module, components within the module, and communication. For the safety instrument system, improving data security means improving the security of the entire system, thereby improving the reliability of the safety instrument system. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without any creative work.

[0019] Figure 1 One of the block diagrams of a safety instrument system provided in an embodiment of the present application;

[0020] Figure 2 This is a second block diagram of a safety instrument system provided in an embodiment of the present application;

[0021] Figure 3 The third block diagram of a safety instrument system provided in an embodiment of the present application;

[0022] Figure 4 A flowchart of a data voting method provided in an embodiment of the present application;

[0023] Figure 5 A block diagram of a data voting device provided in an embodiment of the present application;

[0024] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0026] Application Overview

[0027] Safety instrumented systems typically utilize a triple redundant system, each consisting of three main processors, A, B, and C. Each main processor controls an independent channel and operates in parallel with the other two main processors. A dedicated I / O (input / output) control processor on each main processor manages data exchange between the main processor and the I / O modules. I / O bus cables connect each column of I / O modules on the system motherboard, forming a triple I / O bus. The I / O control processor selects the input module and sends the input data to the main processor. The main processor then tabulates the input data and stores it in memory for use in the selection process. The triple bus is used to transfer the input data tabulation from each main processor to the adjacent main processor, where each main processor selects from multiple copies of the data. The triple bus utilizes programmable devices with direct access to memory to synchronize, transmit, and compare data between the three main processors.

[0028] However, the existing safety instrument system mainly focuses on the redundancy design of the main control module, without considering the data security of other stages. Therefore, the reliability of the existing safety instrument system needs to be improved.

[0029] To this end, the present invention provides a safety instrument system to overcome the aforementioned technical problems. Detailed information about the safety instrument system can be found below.

[0030] Exemplary Systems

[0031] The present application embodiment provides a safety instrument system, such as Figure 1 As shown, the system includes: an input module, a main control module and an output module, and the main control module is connected to the input module and the output module respectively.

[0032] The input module receives sensor data and sends it to the main control module. The sensors described here are used to monitor key parameters in industrial processes, such as temperature, pressure, liquid level, and flow. Therefore, these sensors can include, but are not limited to, temperature sensors, pressure sensors, liquid level switches, and flow meters. The specific sensor type is determined by the application scenario of the safety instrumented system.

[0033] The main control module processes sensor data based on pre-set logical operations and outputs control data (such as control signals) to the output module. For example, if a temperature sensor detects that the temperature exceeds a set safety limit, the main control module can determine whether safety measures need to be taken based on pre-set logical operations and output a control signal.

[0034] The output module transmits control data from the main control module to the actuator, causing it to perform the corresponding safety protection action. For example, if the actuator is a solenoid valve, the solenoid valve can close according to the control signal from the main control module.

[0035] In the embodiment of the present application, the input module, main control module, and output module all adopt a multiple-choice architecture to improve the security of data at each stage, as described below:

[0036] The input module, main control module and output module all include multiple processors in parallel, such as Figure 1 As shown, the three modules each include two parallel processors, namely processor 0 and processor 1.

[0037] The multiple processors in the input module are connected to the input terminals of the input module, and each processor can obtain sensor data received by the input module from the input terminal. The multiple processors can also exchange data with each other, that is, one processor can send sensor data obtained from the input terminal of the input module to other processors.

[0038] The multiple processors in the main control module are connected to the module's input terminals. Each processor can access data received by the main control module from these input terminals. This data is typically sent by the input module, including sensor data. The multiple processors can also exchange data with each other. For example, one processor can send data it receives from the main control module's input terminals to other processors, or exchange control data it generates based on sensor data with control data generated by other processors.

[0039] The multiple processors in the output module are connected to the input of the output module. Each processor can receive control data from the main control module through the input. The multiple processors can also exchange data with each other, that is, one processor can send control data it receives from the input of the output module to other processors.

[0040] Among them, the multiple processors in the input module and the main control module adopt a redundant architecture, that is, each processor includes a multiple-choice structure, such as Figure 2 As shown, processors 0 and 1 of the input module and main control module include a two-choice self-diagnosis structure, also known as a 1oo2D structure. This multiple-choice structure is used to vote on the processor's own data and data exchanged from other processors, and output the voting results. For the input module, the processor's own data mentioned here can be data obtained by the processor from the input end of the input module. For the main control module, the processor's own data mentioned here can be data obtained by the processor from the input end of the main control module, or it can be control data generated by the processor after processing sensors. This ensures data redundancy, reduces random data failure or loss in the system, and improves data security.

[0041] The redundant architecture of the output module means that the output module also includes a multiple-choice structure connected to multiple processors in the output module, such as Figure 1 As shown, a one-out-of-many structure (i.e., a 1oo2D structure) at the channel position in the output module is connected to processor 0 and processor 1 in the output module. This one-out-of-many structure is used to vote on the output data of multiple processors to eliminate unsafe factors during data transmission from the main control module to the output module, thereby improving data security.

[0042] The multiple-choice structure in each of the three modules consists of multiple parallel channels, each of which can independently perform safety functions. The voting strategy of this multiple-choice structure can be described as follows:

[0043] If faults are detected in N input channels in the multiple-choice-one structure, that is, problems are detected in N processors, and no faults are detected in other input channels, then one piece of data from the other input channels is randomly selected for output; where N is an integer greater than or equal to 1 and less than the number of processors in the module.

[0044] If all input channels in the multi-select configuration detect a fault, meaning that all processors are faulty, or if data is found to be different between all input channels, the multi-select configuration outputs a safety value. The safety value here refers to a pre-set value that ensures the system is in a safe state. This safety value can be set based on specific application scenarios and system requirements. For example, in a chemical production process, the safety value can be a value that will not cause a runaway chemical reaction or damage equipment. In a power system, the safety value can be a value that will not cause a grid failure or equipment overload.

[0045] In the embodiments of the present application, the input modules, main control modules, and output modules in the safety instrument system all utilize a redundant architecture. This ensures a redundant mode and voting strategy throughout the entire data flow, from acquisition to calculation to output. This reduces data anomalies and data loss caused by issues with individual modules, components within modules, or communications. For a safety instrument system, improving data security ensures the security of the entire system, thereby improving the reliability of the safety instrument system and enabling it to meet the requirements of high safety integrity levels (e.g., SIL3).

[0046] In some optional embodiments, such as Figure 1 As shown, the input module, the main control module and the output module all include two parallel processors, thereby ensuring data redundancy.

[0047] Accordingly, the multiple-choice-one architecture within each processor of the input and main control modules, as well as the multiple-choice-one architecture within the output modules, utilizes a two-choice-one self-diagnostic structure, also known as a 1oo2D architecture. This architecture comprises two independent channels, operating in parallel. Each channel can independently perform safety functions, and each channel has its own diagnostic (D) unit for self-diagnosis and monitoring. This architecture leverages redundancy and self-diagnosis capabilities, enabling data voting between two redundant copies to output secure data. This improves system reliability and safety, while also meeting higher SIL requirements and ensuring continuous and stable system operation in critical applications.

[0048] The voting strategy of the 1oo2D structure includes: if one of the input channels of the 1oo2D structure detects a fault, the output result is determined by the output result given by the other channel; if both input channels detect a fault at the same time, or if a difference is detected between the data of the two input channels, a safe value is output.

[0049] Optionally, since the input and output modules have relatively small data processing tasks and require relatively low computing power, the processors in these two modules can use relatively low-cost microcontrollers (MCUs). However, since the main control module has a relatively large data processing task and requires higher computing power, the processor in this module can use a central processing unit (CPU) with stronger computing power.

[0050] In some optional embodiments, multiple processors in the main control module exchange control data (such as control instructions) based on sensor data output, and each processor votes on multiple copies of data through its own multiple-choice structure.

[0051] like Figure 2 As shown, each processor in the main control module can perform logical operations on sensor data through its internal IEC logic operation unit and output control instructions. For example, if the sensor data is a temperature value, after performing the IEC logic operation on this temperature value, the processor can output a control instruction to close the solenoid valve. Processor 0 and processor 1 then exchange the output results of their respective IEC logic operations and perform data voting on multiple IEC logic operation outputs through their respective 1oo2D structures to prevent data security from being affected by IEC logic operation unit failures.

[0052] IEC logic operations primarily refer to the logical processing and operation of sensor signals (i.e., sensor data) in accordance with relevant IEC standards, such as IEC 61131-3, to achieve specific safety functions. Optionally, the IEC logic operation unit may be a program organization unit (POU).

[0053] Optionally, in order to improve the security of data involved in IEC logic operations, before performing IEC logic operations, multiple processors in the main control module can also communicate with each other through Figure 2 The exchange selection unit shown exchanges data with each other and selects one piece of data from multiple redundant data as the input of the IEC logic operation unit, that is, voting on multiple pieces of data to obtain the input of the IEC logic operation unit. The voting strategy described here can be set according to actual needs.

[0054] In the embodiment of the present application, multiple data voting can be performed in the main control module, which can improve the security of the input data of the main control module and the security of the output data of the main control module.

[0055] In some optional embodiments, such as Figure 1As shown, the safety instrumented system may include an input module, a main control module and an output module.

[0056] by Figure 1 and Figure 2 For example, in this case, the data security processing process is as follows:

[0057] The two processors in the input module collect data from the input channels of the input module respectively, exchange the channel collection values, perform data voting through the 1oo2D structure, and then report the voting results to the main control module.

[0058] The two processors in the main control module respectively obtain input values ​​of the input module, perform data selection after exchanging the input values, and use the selected results as inputs of the IEC logic operation unit.

[0059] The two processors in the main control module perform IEC logic operations respectively, exchange and vote on the output results after the logic operations to generate output data, and send the output data to the output module.

[0060] The two processors in the output module respectively obtain the output data of the main control module and transmit them to the channel respectively, and the 1oo2D structure on the channel performs data voting.

[0061] Finally, the final output result is obtained based on the voting results of the input modules.

[0062] In this embodiment, although the input module, the main control module and the output module are all single modules, data is transmitted in a redundant mode throughout the process and multiple exchanges and votes are performed, thereby ensuring data security.

[0063] In some optional embodiments, the safety instrumented system may include multiple input modules, multiple master control modules, and / or multiple output modules.

[0064] like Figure 3 As shown in Figure 1, the safety instrument system can include 1 input module, 3 main control modules and 1 output module. Figure 4 As shown, the safety instrument system may also include 3 input modules, 3 main control modules and 3 output modules. It is understandable that Figure 2 and Figure 4 These are all exemplary diagrams. The number of input modules, main control modules and output modules in the safety instrument system can be set according to actual needs.

[0065] Accordingly, the safety instrumented system may further include a plurality of first gateways and a plurality of second gateways, wherein the number of the plurality of first gateways and the number of the plurality of second gateways are the same as the number of processors in the main control module.

[0066] The input ends of the multiple first gateways are connected to each input module respectively, and the output ends of the multiple first gateways are connected to different processors in the main control module respectively.

[0067] The input ends of the plurality of second gateways are respectively connected to different processors in the main control module, and the output ends of the plurality of second gateways are respectively connected to each output module.

[0068] In the existing triple redundant system, three main processors correspond to three main control modules respectively. Since they receive data from different lines and there are problems such as data delay and data loss, it is difficult to maintain data synchronization between the main processors.

[0069] In the embodiment of the present application, however, direct data exchange between master control modules is not required. Instead, the processors within the master control modules exchange data and perform data voting to ensure that the data being transmitted is fault-free, thus resolving the issue of data synchronization. Furthermore, performing redundant group data voting before performing IEC logic operations ensures that the module's collected values ​​are fault-free. Performing voting again after the IEC logic operations are complete overcomes the issue of faulty IEC logic operation units. Afterwards, after the processors send their output results to the output modules, the output modules themselves perform data voting to ensure that there are no faults in the output communication process. This demonstrates that the embodiment of the present application can improve data security from a process perspective.

[0070] Among them, when the input module and output module are single modules, and the main control module uses a redundant module, Figure 3 Taking the triple redundancy shown in the figure as an example, the data security processing process in this case is as follows:

[0071] The two processors of the input module collect data from the input channels of the input module respectively, exchange the collected values ​​and then vote on the data, and then report the voting results to the three main control modules respectively;

[0072] Processor 0 in each master control module obtains the output data of the input module through gateway A, and processor 1 in each master control module obtains the output data of the input module through gateway B. Afterwards, the two processors in each master control module exchange data and select one piece of data as the input data of the IEC logic operation unit based on the voting strategy.

[0073] In each master control module, after each processor completes the IEC logic operation, it exchanges the IEC logic operation results with other processors, performs data voting through the 1oo2D structure, obtains output data, and outputs the data to the output module through the corresponding gateway.

[0074] Each processor of the output module can receive the output data of the three main control modules through the corresponding gateway, and select one piece of data from the three pieces of data according to the selection strategy, input it into the 1oo2D structure in the channel, and perform the final data voting.

[0075] When the processor in the output module selects one piece of data from multiple pieces of data, its selection strategy may include:

[0076] If multiple copies of data are consistent, select one of them; if there are at least two identical copies of data among the multiple copies of data, select one from the at least two identical copies of data; if multiple copies of data are inconsistent, use a safe value.

[0077] Among them, when the input module, main control module and output module are all redundant modules, Figure 4 Taking the triple redundancy shown in the figure as an example, the data security processing process in this case is as follows:

[0078] Multiple input modules collect data separately. In each input module, two processors collect data from the input channels of the input modules respectively, exchange the collected values, and then perform data voting. The voting results are then reported to the three main control modules respectively.

[0079] Processor 0 in each master control module obtains the output data of the three input modules through gateway A, and processor 1 in each master control module obtains the output data of the three input modules through gateway B. The two processors in each master control module then exchange data and, based on a voting strategy, select one of the two data copies from input module A, one from the two data copies from input module B, and one from the two data copies from input module C as input to the IEC logic operation unit. A voting algorithm in the IEC logic operation unit then votes on the three data copies and selects one as the final input. The voting strategy may include: selecting one of the data copies if they are consistent; selecting one of the data copies if at least two of the data copies are identical; and using a safe value if none of the data copies are consistent.

[0080] In each master control module, after each processor completes the IEC logic operation, it exchanges the IEC logic operation results with other processors, performs data voting through the 1oo2D structure, obtains output data, and sends the data to the three output modules through the corresponding gateway.

[0081] Each processor of each output module can receive the output data of the three main control modules through the corresponding gateway, and select one of the three data as the output data according to the selection strategy. The output data undergoes the final data voting in the channel through the 1oo2D structure.

[0082] The output data of the three output modules is then sent to the terminal board, which randomly selects one valid data piece from the three data pieces as output. The terminal board's selection strategy can be: if multiple data pieces are consistent, select one; if at least two of the multiple data pieces are identical, select one piece from the at least two identical data pieces; if all the data pieces are inconsistent, use a safe value.

[0083] Optionally, each processor in the main control module can perform data voting based on module status and channel quality. The module status here refers to the status of the input module, which may include, but is not limited to, offline and online, faulty and normal states. The channel quality here refers to the quality of the data transmission channel between the input module and the sensor, which can indicate whether the channel is faulty. This information can be included in the data sent from the input module to the main control module.

[0084] The input data of each processor of the main control module may include: channel acquisition value, status information of the input module, and quality of the data transmission channel between the sensor and the input module.

[0085] The strategy for each processor in the master control module to vote on multiple copies of data can be described as follows:

[0086] If all input modules are detected to be abnormal, or if the data transmission channels between the input modules and sensors are all abnormal, a safe value is output. If a target input module that meets the target conditions is detected, a result is output based on the collected value obtained from the target input module.

[0087] The term "input module is normal" here means that the input module is online and not faulty; the term "input module is abnormal" here means that the input module is offline or online but faulty. The term "data transmission channel is normal" here means that the data transmission channel is not faulty; the term "data transmission channel is abnormal" here means that the data transmission channel is faulty.

[0088] The safety value referred to here refers to a pre-set value that ensures the system is in a safe state. This safety value can be set based on the specific application scenario and system requirements. For example, in a chemical production process, the safety value can be a value that will not cause a runaway chemical reaction or equipment damage; in a power system, the safety value can be a value that will not cause a grid failure or equipment overload. The collected value here refers to the value collected by the processor from the input channel of the main control module.

[0089] For example, in the case where the input module is a single module, the data voting strategy of each processor in the main control module before performing IEC logic operations includes:

[0090] If the input module is detected to be offline, the safe value is used;

[0091] If the input module is detected to be online but faulty, the safe value is used;

[0092] If it is detected that the input module is online and not faulty, and the data transmission channel between the input module and the sensor is normal, the collected value is used;

[0093] If the input module is online and normal, but the data transmission channel between the input module and the sensor fails, the safe value is used.

[0094] For another example, when there are two input modules (i.e., the input modules are dual-redundant), and they are input module A and input module B, the data voting strategy of each processor in the main control module during IEC logic operations includes:

[0095] If it is detected that both input modules A and B are offline, the safe value is used;

[0096] If both input modules A and B are detected to be faulty, the safe value is used;

[0097] If both channels of input modules A and B are detected to be faulty, the safe value is used; the channel here refers to the data transmission channel between the input module and the sensor;

[0098] If any module among input modules A and B is detected to be offline, the single-module voting strategy is used to obtain the final value for the other module;

[0099] If it is detected that both input modules A and B are online, but one of them fails, the single-module voting strategy is used to obtain the final value for the other module;

[0100] If it is detected that both input modules A and B are online and not faulty, but a channel of one module is faulty, the collected value of the other module is used;

[0101] If it is detected that input modules A and B are both online and not faulty, and the channels of input modules A and B are also normal, the channel with the smaller module address is used to collect the value; it is understandable that the channel with the larger module address can also be used to collect the value, and the specific setting can be made according to needs.

[0102] For another example, when there are three input modules (i.e., the input modules are triple-redundant), namely input module A, input module B, and input module C, the data voting strategy of each processor in the main control module during IEC logic operations includes:

[0103] If it is detected that input modules A, B, and C are all offline, the safe value is used.

[0104] If all input modules A, B, and C are detected to be faulty, the safe value is used;

[0105] If all channels of input modules A, B, and C are detected to be faulty, the safe value is used; the channel here refers to the data transmission channel between the sensor and the input module;

[0106] If one of the input modules A, B, or C is detected to be offline, the remaining modules adopt a dual-redundancy selection strategy;

[0107] If a failure is detected in one of the input modules A, B, or C, the remaining modules adopt a dual-redundancy selection strategy;

[0108] If a channel failure is detected in one of the input modules A, B, or C, the remaining modules adopt a dual-redundancy selection strategy;

[0109] If it is detected that input modules A, B, and C are all online and not faulty, and the channels of all modules are normal, the channel with the smaller module address is used to collect the value; it is understandable that the channel with the larger module address can also be used to collect the value, which can be set according to needs;

[0110] If it is detected that input modules A, B, and C are all online and not faulty, but channel BC of input module A is faulty and the others are normal, channel AC of module B is faulty and the others are normal, and channel AB of module C is faulty and the others are normal, then channel A uses the value collected by module A, channel B uses the value collected by module B, and channel C uses the value collected by module C.

[0111] To summarize, in the embodiments of the present application, the input module, main control module, and output module in the safety instrument system all adopt a redundant architecture. The redundant mode and voting strategy are guaranteed in the overall process of data acquisition, calculation, and output. This can reduce data anomalies and data loss caused by problems with a certain module, components within the module, and communication, and eliminate unsafe factors at each stage. For the safety instrument system, improving data security means improving the security of the entire system, thereby improving the reliability of the safety instrument system.

[0112] Exemplary Methods

[0113] An embodiment of the present application provides a data voting method, which is applied to the safety instrument system described in the above embodiment. For details about the safety instrument system, please refer to the description in the above embodiment and will not be repeated in this embodiment.

[0114] The following embodiments describe the method in detail. The following embodiments may be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments.

[0115] like Figure 5 As shown, the method may include steps 501 to 503, as follows:

[0116] Step 501: Through the multiple-choice structure in each processor in the input module, vote on the sensor data directly obtained by the processor and the sensor data exchanged from other processors.

[0117] The sensor data directly obtained by the processor mentioned here refers to the data obtained by the processor from the input end of the input module, and the data at the input end of the input module is sent by the sensor to the input module.

[0118] Multiple processors of the input module receive the same data, which can ensure data redundancy.

[0119] The multiple-choice structure in each processor of the input module votes on the sensor data obtained by the processor from the input end of the input module and the sensor data exchanged from other processors to obtain secure data. This can reduce the problem of random data failure or loss caused by data transmission or module problems, eliminate unsafe factors, and improve data security.

[0120] Step 502: Through the multiple-choice structure in each processor of the main control module, voting is performed on the control data obtained by the processor based on the sensor data and the control data exchanged from other processors.

[0121] The control data of other processors are also obtained by other processors based on sensor data.

[0122] Multiple processors of the main control module receive the same data, which can ensure data redundancy.

[0123] Each processor in the main control module can output control data (such as control instructions such as closing a valve and disconnecting the power supply) based on sensor data, and the multiple-choice structure in each processor can vote on the control data output by the processor and the control data exchanged from other processors to obtain safe data. This can prevent the data from failing due to a single processor failure after entering the main control module, eliminate unsafe factors, and improve data security.

[0124] Step 503: Voting on the output data of the multiple processors through the multiple-choice-one structure in the output module, and outputting the voting result.

[0125] Each processor in the output module can receive the control data sent by the main control module. Multiple processors in the output module receive the same data, which can ensure data redundancy.

[0126] The multiple-choice structure in the output module can vote on the control data output by different processors to obtain safe data, which can eliminate unsafe factors in the data transmission process and improve data security.

[0127] Optionally, the voting strategy of the multiple-choice-one structure in each module can be as follows:

[0128] If N input channels in the select-one-from-many structure detect a fault, that is, if N processors are detected to have a problem, and no fault is detected in the other input channels, then one data point from the other input channels is selected for output; where N is an integer greater than or equal to 1, and N is less than the number of processors in the module.

[0129] If all input channels in the multiple-choice-one structure detect faults, that is, if all processors are detected to have problems, or if it is detected that the data between all input channels are different, the multiple-choice-one structure outputs a safe value.

[0130] In some optional embodiments, after the main control module receives the data sent by the input module, the data voting method may further include:

[0131] Each processor in the main control module votes on multiple data, processes the voting results, and outputs control data.

[0132] The multiple copies of data mentioned here may include data obtained by the processor from the input end of the main control module and data exchanged from other processors. The data here at least includes sensor data.

[0133] In the embodiment of the present application, voting is performed on the data received by different processors, which can eliminate unsafe factors in the transmission process of data from the input module to the main control module and improve the security of the data.

[0134] Optionally, in an embodiment of the present application, each processor in the main control module can perform data voting based on module status and channel quality. The module status here refers to the status of the input module, which may include, but is not limited to, offline and online status, faulty and non-faulty status, etc. The channel quality here refers to the quality of the data transmission channel between the sensor and the input module, which can indicate whether the channel is faulty. This information can be included in the data sent from the input module to the main control module.

[0135] The input data of each processor of the main control module may include: channel acquisition value, status information of the input module, and quality of the data transmission channel between the sensor and the input module.

[0136] The aforementioned step of "voting on multiple copies of data by each processor in the main control module" may include:

[0137] If all input modules are detected to be abnormal, or the data transmission channels between the input modules and sensors are all abnormal, a safe value will be output.

[0138] If a target input module that meets the target conditions is detected, a result is output based on the collected value obtained from the target input module.

[0139] The term "input module is normal" here means that the input module is online and not faulty; the term "input module is abnormal" here means that the input module is offline or online but faulty. The term "data transmission channel is normal" here means that the data transmission channel is not faulty; the term "data transmission channel is abnormal" here means that the data transmission channel is faulty.

[0140] The safety value referred to here refers to a pre-set value that ensures the system is in a safe state. This safety value can be set based on the specific application scenario and system requirements. For example, in a chemical production process, the safety value can be a value that will not cause a runaway chemical reaction or equipment damage; in a power system, the safety value can be a value that will not cause a grid failure or equipment overload. The collected value here refers to the value sent by the input module and collected by the processor from the input terminal of the main control module.

[0141] The target conditions here are that the input module is functioning properly and that the data transmission channel between the input module and the sensor is functioning properly. If the input module meets these target conditions, one of the collected values ​​from these input modules can be selected as the voting result output. Any one of these values ​​can be selected as the voting result output.

[0142] For example, when the input module is a single module, the voting strategy can be as follows:

[0143] If the input module is detected to be offline, the safe value is used;

[0144] If the input module is detected to be online but faulty, the safe value is used;

[0145] If it is detected that the input module is online and not faulty, and the data transmission channel between the input module and the sensor is normal, the collected value is used;

[0146] If the input module is online and normal, but the data transmission channel between the input module and the sensor fails, the safe value is used.

[0147] For another example, when there are two input modules (i.e., the input modules are dual-redundant), and they are input module A and input module B, the voting strategy can be as follows:

[0148] If it is detected that both input modules A and B are offline, the safe value is used;

[0149] If both input modules A and B are detected to be faulty, the safe value is used;

[0150] If both channels of input modules A and B are detected to be faulty, the safe value is used; the channel here refers to the data transmission channel between the input module and the sensor;

[0151] If any module among input modules A and B is detected to be offline, the single-module voting strategy is used to obtain the final value for the other module;

[0152] If it is detected that both input modules A and B are online, but one of them fails, the single-module voting strategy is used to obtain the final value for the other module;

[0153] If it is detected that both input modules A and B are online and not faulty, but a channel of one module is faulty, the collected value of the other module is used;

[0154] If it is detected that input modules A and B are both online and not faulty, and the channels of input modules A and B are also normal, the channel with the smaller module address is used to collect the value; it is understandable that the channel with the larger module address can also be used to collect the value, and the specific setting can be made according to needs.

[0155] For another example, when there are three input modules (i.e., the input modules are triple-redundant), namely input module A, input module B, and input module C, the data voting strategy of each processor in the main control module during IEC logic operations includes:

[0156] If it is detected that input modules A, B, and C are all offline, the safe value is used.

[0157] If all input modules A, B, and C are detected to be faulty, the safe value is used;

[0158] If all channels of input modules A, B, and C are detected to be faulty, the safe value is used; the channel here refers to the data transmission channel between the sensor and the input module;

[0159] If one of the input modules A, B, or C is detected to be offline, the remaining modules adopt a dual-redundancy selection strategy;

[0160] If a failure is detected in one of the input modules A, B, or C, the remaining modules adopt a dual-redundancy selection strategy;

[0161] If a channel failure is detected in one of the input modules A, B, or C, the remaining modules adopt a dual-redundancy selection strategy;

[0162] If it is detected that input modules A, B, and C are all online and not faulty, and the channels of all modules are normal, the channel with the smaller module address is used to collect the value; it is understandable that the channel with the larger module address can also be used to collect the value, which can be set according to needs;

[0163] If it is detected that input modules A, B, and C are all online and not faulty, but channel BC of input module A is faulty and the others are normal, channel AC of module B is faulty and the others are normal, and channel AB of module C is faulty and the others are normal, then channel A uses the value collected by module A, channel B uses the value collected by module B, and channel C uses the value collected by module C.

[0164] Optionally, when there are multiple master control modules in the safety instrumented system, after the master control module sends the output data to the output module, the method may further include:

[0165] Through the processor in the output module, one piece of data is selected from multiple pieces of data and sent to the multiple-select-one structure in the output module.

[0166] The processor selection strategy is as follows:

[0167] If multiple copies of data are consistent, select one of them; if there are at least two identical copies of data among the multiple copies of data, select one from the at least two identical copies of data; if multiple copies of data are inconsistent, use a safe value.

[0168] To summarize, in the embodiments of the present application, the input module, main control module, and output module in the safety instrument system all adopt a redundant architecture. The redundant mode and voting strategy are guaranteed in the overall process of data acquisition, calculation, and output. This can reduce data anomalies and data loss caused by problems with a certain module, components within the module, and communication, and eliminate unsafe factors at each stage. For the safety instrument system, improving data security means improving the security of the entire system, thereby improving the reliability of the safety instrument system.

[0169] Exemplary electronic devices

[0170] The present application also provides an electronic device, such as Figure 5 As shown, the electronic device includes: a memory 600 and a processor 610.

[0171] The memory 600 is connected to the processor 610 and is used to store programs.

[0172] The processor 610 is configured to implement the data voting method in the above embodiment by running the program stored in the memory 600 .

[0173] Specifically, the electronic device may further include: a communication interface 620 , an input device 630 , an output device 640 and a bus 650 .

[0174] The processor 610, the memory 600, the communication interface 620, the input device 630 and the output device 640 are interconnected via a bus.

[0175] Bus 650 may include a pathway for transferring information between the various components of the computer system.

[0176] Processor 610 can be a general-purpose processor, such as a general-purpose central processing unit (CPU), a microprocessor, or the like, or an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present invention. Alternatively, it can be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic device, discrete gate or transistor logic device, or discrete hardware components.

[0177] The processor 610 may include a main processor, and may also include a baseband chip, a modem, and the like.

[0178] The memory 600 stores a program for executing the technical solution of the present invention, and may also store an operating system and other key services. Specifically, the program may include program code, which includes computer operating instructions. More specifically, the memory 600 may include read-only memory (ROM), other types of static storage devices that can store static information and instructions, random access memory (RAM), other types of dynamic storage devices that can store information and instructions, disk storage, flash, etc.

[0179] The input device 630 may include a device for receiving data and information input by a user, such as a keyboard, a mouse, a camera, a scanner, a light pen, a voice input device, a touch screen, a pedometer, or a gravity sensor.

[0180] Output device 640 may include devices that allow information to be output to a user, such as a display screen, printer, speakers, etc.

[0181] The communication interface 620 may include any device such as a transceiver to communicate with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), Wireless Local Area Network (WLAN), etc.

[0182] The processor 610 executes the program stored in the memory 600 and calls other devices, which can be used to implement the various steps of the data voting method provided in the above embodiments of the present application.

[0183] Exemplary computer program products and storage media

[0184] In addition to the above-mentioned methods and devices, an embodiment of the present application may also be a computer program product, which includes computer program instructions, which, when executed by a processor, enable the processor to execute the steps in the data voting method described in the embodiments of the present application.

[0185] The computer program product may be implemented in hardware, software, or a combination thereof. In one embodiment, the computer program product is implemented as a computer storage medium. In another embodiment, the computer program product is implemented as a software product, such as a software development kit (SDK).

[0186] The computer program product may be written in any combination of one or more programming languages ​​to implement the program code for performing the operations of the embodiments of the present application, including object-oriented programming languages ​​such as Java, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server.

[0187] In addition, an embodiment of the present application may also be a storage medium on which a computer program is stored, and the computer program is used by a processor to execute the steps of the data voting method described in the embodiment of the present application.

[0188] In addition, an embodiment of the present application may also be a chip, which includes a processor and a data interface. The processor reads instructions stored in the memory through the data interface to execute the steps in the data voting method described in the embodiment of the present application.

[0189] For the sake of simplicity, the aforementioned method embodiments are described as a series of action combinations. However, those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in this specification are all preferred embodiments, and the actions and modules involved are not necessarily required by this application.

[0190] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similarities between the various embodiments can be referred to in conjunction with each other. For device embodiments, since they are generally similar to method embodiments, their description is relatively simple, and for relevant details, reference can be made to the description of the method embodiments.

[0191] The steps in the methods of each embodiment of the present application can be adjusted in sequence, merged, and deleted according to actual needs, and the technical features recorded in each embodiment can be replaced or combined.

[0192] The modules and sub-modules in the devices and terminals in the various embodiments of the present application can be merged, divided, and deleted according to actual needs.

[0193] In the several embodiments provided in this application, it should be understood that the disclosed terminals, devices, and methods can be implemented in other ways. For example, the terminal embodiments described above are merely illustrative. For example, the division of modules or submodules is merely a logical function division. In actual implementation, there may be other division methods, such as multiple submodules or modules can be combined or integrated into another module, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interface, device or module, which can be electrical, mechanical or other forms.

[0194] The modules or submodules described as separate components may or may not be physically separate, and the components of the modules or submodules may or may not be physical modules or submodules, that is, they may be located in one place or distributed across multiple network modules or submodules. Some or all of the modules or submodules may be selected to achieve the purpose of this embodiment according to actual needs.

[0195] In addition, each functional module or submodule in each embodiment of the present application may be integrated into a processing module, or each module or submodule may exist physically separately, or two or more modules or submodules may be integrated into a single module. The above-mentioned integrated modules or submodules may be implemented in the form of hardware or software functional modules or submodules.

[0196] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0197] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, software units executed by a processor, or a combination of the two. The software units may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0198] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

Claims

1. A safety instrumented system, characterized in that: The system includes: an input module for receiving sensor data, a main control module for processing the sensor data and outputting control data, and an output module for sending the control data output by the main control module to the actuator; the main control module is connected to the input module and the output module respectively; The input module and the main control module both include multiple parallel processors, each processor includes a multiple-choice structure, and the multiple-choice structure is used to vote on the processor's own data and data exchanged from other processors; The output module includes: a plurality of parallel processors and a multiple-choice structure, wherein the multiple-choice structure is connected to the plurality of processors and is used to vote on output data of the plurality of processors.

2. The safety instrumented system according to claim 1, wherein: The input module, the main control module and the output module all include two parallel processors. Accordingly, the multiple-choice-one structure in the processors of the input module and the main control module and the multiple-choice-one structure in the output module are both two-choice-one self-diagnosis structures.

3. The safety instrument system according to claim 1 or 2, characterized in that: The safety instrumented system includes a plurality of input modules, a plurality of main control modules and / or a plurality of output modules.

4. The safety instrumented system according to claim 3, wherein: The safety instrumented system further includes a plurality of first gateways and a plurality of second gateways, wherein the number of the plurality of first gateways and the number of the plurality of second gateways are both the same as the number of processors in the main control module; The input ends of the plurality of first gateways are respectively connected to each of the input modules, and the output ends of the plurality of first gateways are respectively connected to different processors in the main control module; The input ends of the plurality of second gateways are respectively connected to different processors in the main control module, and the output ends of the plurality of second gateways are respectively connected to each of the output modules.

5. The safety instrumented system according to claim 3, wherein: In the case where there are multiple output modules, the safety instrumented system further includes a terminal board connected to each of the output modules and configured to select one of the output data of the multiple output modules as a final output result.

6. A data voting method, characterized in that: Applied to the safety instrumented system according to any one of claims 1 to 5, the method comprises: Voting on sensor data directly obtained by the processor and sensor data exchanged from other processors through a multiple-choice structure in each processor of the input module; Voting on the control data obtained by the processor based on sensor data and the control data exchanged from other processors through a multiple-choice structure in each processor of the main control module; The output data of the multiple processors are voted through the multiple-choice structure in the output module, and the voting result is output.

7. The data voting method according to claim 6, characterized in that: After the main control module receives the data sent by the input module, the method further includes: Each processor in the main control module votes on multiple copies of data, processes the voting results, and outputs control data; wherein the multiple copies of data include data obtained by the processor from the input end of the main control module and data exchanged from other processors.

8. The data voting method according to claim 7, characterized in that: The voting on the multiple copies of data by each processor in the main control module includes: If all the input modules are detected to be abnormal, or the data transmission channels between the input modules and the sensors are all abnormal, a safety value is output; wherein the input module abnormality refers to the input module being offline or the input module being online but failing; the data transmission channel abnormality refers to the data transmission channel failing; If a target input module that meets the target conditions is detected, a voting result is output based on the sensor data obtained from the target input module; wherein the target conditions are that the input module is normal and the data transmission channel between the input module and the sensor is normal.

9. An electronic device, characterized in that: include: memory and processor; The memory is connected to the processor and is used to store programs; The processor is configured to implement the data voting method according to any one of claims 6 to 8 by running the program in the memory.

10. A computer program product, characterized in that The computer program product stores a computer program, and when the computer program is executed by a processor, the data voting method according to any one of claims 6 to 8 is implemented.

Images