SELF-DIAGNOSTIC PROCEDURE FOR COMMUNICATION PROTOCOL OF A SAFETY STAGE INSTRUMENT AND CONTROL SYSTEM FOR A NUCLEAR POWER PLANT

Description

Technical Field

[0001] The invention relates to a diagnosis method for a communication protocol of a safety instrumentation and control system of a nuclear plant, in particular to a diagnosis method for a point-to-point communication protocol.Background Art

[0002] A safety instrumentation and control system, the "neural center" of a nuclear plant, is the most important means to ensure the safe and reliable operation of a nuclear plant. In foreign countries, TXS, Meltac-N, Tricon and Common-Q are the main safety instrumentation and control systems for nuclear plants. For TXS, a SINEC L2 communication network based on Profibus is adopted for communication among redundant channels in the system; for Meltac-N, point-to-point communication based on RS-485 is adopted for communication between control stations in the system; for Tricon, a bus communication based on RS-232 / 485 is adopted in the system internal communication; for Common-Q, transmission of redundant inter-channel voting logic signals within the system employs RS-232 based HSL point-to-point communication. RS-232 / 485 is the main serial communication interface in an industrial control network. A typical structure of a safety instrumentation and control system of a nuclear plant is shown in Figure 1, logical coincidence operation needs to be carried out among processing units (RPC) in Figure 1, and direct data interaction is inevitable. This kind of communication only involves two processing units, with a small amount of data but high requirements on the reliability, real-time and security of data communication. The dotted lines in Figure 1 indicate the point-to-point communication network. Due to the occasional fault of the hardware components and bugs of the software itself, the following eight communication errors can occur, which are data crash, accidental retransmission, erroneous sequence, loss, delay timeout, invalid insertion, camouflage messages and erroneous addressing. If the eight network errors are not diagnosed, a misuse of the erroneous network data may happen, and the safety and stability of the safety instrumentation and control system of the whole nuclear plant are put in danger consequently, or even worse, an accidental shutdown of the nuclear plant can be caused, leading to inestimable property loss and personal safety accidents.

[0003] Self-diagnosis refers to the technology by which the system self-detects and processes the fault or failure event by setting a diagnosis function, and the core of self-diagnosis technology is the diagnosis measure and the fault processing after diagnosis. A typical self-diagnostic process is as follows: after a fault occurs in the operation process, the system should identify the abnormal condition of the system through hardware or software, quickly report the abnormal information, start a processing mechanism, enter a degraded operation or fault safety state, and the system can restore the normal operation state only until the fault is eliminated.

[0004] For example, CN103457791A discloses a self-diagnosis method for an intelligent substation network sampling and control link, which can timely discover and troubleshoot various network faults of network operation, and manage and record the network fault information, so as to further ensure the reliability and safety of network sampling and network control in substation applications, and improve the intelligent level of the substation.

[0005] CN102984097A discloses transceiver self-diagnostics for balancing electromagnetic interference reduction within a channel, which enables communication links supporting differential signaling to carry common mode signals, and any detected selective operation such as appropriate processing of signal energy corresponding to the differential signal energy to provide measurements corresponding to electromagnetic compatibility (EMC) of the communication link.

[0006] At present, the prior art about network self-diagnosis technology falls all within those aiming at an industrial standard control network, being not suitable for a point-to-point network communication protocol in an existing nuclear plant safety instrumentation and control system.

[0007] EP 2053774A1 and WO 2006 / 054836A2 provide respective technical solutions; however, the above mentioned problem still remains unsolved.Summary of the Invention

[0008] Aiming at the defects in the prior art, the invention provides a self-diagnosis method for a communication protocol of a safety instrumentation and control system of a nuclear plant, which can effectively determine network communication errors.

[0009] The invention provides a self-diagnosis method for a communication protocol of a safety instrumentation and control system of a nuclear plant, as defined by the appended independent claim 1.

[0010] Compared with the prior art, the self-diagnosis method for the communication protocol of the safety instrumentation and control system of a nuclear plant of the invention realizes full coverage of diagnosis of eight network errors; whether the upper layer data quality bit is valid or not is accurately determined, so that erroneous data cannot be misused; and a reasonable frequency tolerance threshold for the diagnosed network fault is set, so that the stability of the system is ensured (repeated state jump caused by occasional errors is avoided), and the network fault can be reported instantly when confirmed. The present method minimizes the possibility of mistakes in determination, and can effectively ensure the point-to-point communication quality of the safety instrumentation and control system of a nuclear plant.Brief Description of the Drawings

[0011] Figure 1 is a schematic diagram of a typical nuclear plant safety instrumentation and control system; Figure 2 is a block diagram of the sending process of the self-diagnosis method for the communication protocol of the safety instrumentation and control system of a nuclear plant according to the present invention; and Figure 3 is a block diagram of the process for receiving data diagnosis of the self-diagnosis method for the communication protocol of the safety instrumentation and control system of a nuclear plant according to the present invention. Detailed Description of the Invention

[0012] The self-diagnosis method for the communication protocol of the safety instrumentation and control system of a nuclear plant is further described with reference to the drawings.

[0013] The invention relates to a self-diagnosis implementation method based on a communication method related to the applicant's patent ZL200910238712.6 "Communication Method based on Inter-Column Safety Communication Network Protocol of Reactor Protection System". The patent ZL200910238712.6 relates to a safety network protocol for inter-column communication of a system, in particular to a communication method based on an inter-column safety communication network protocol of a reactor protection system. The communication protocol is suitable for a nuclear power control system, however, according to the self-diagnosis requirements of IEC6178-3, IEC60880 and IEC61508 on a safety network, a full diagnostic coverage of eight network errors including data collapse, accidental retransmission, wrong sequence, loss, delay timeout, invalid insertion, masquerading messages and error addressing is needed, and the requirement of a network residual rate has also to be met. Network residual rate is an important index to measure the safety level of a safety network. In IEC61784-3, there is a clear formula for calculating the network residual rate, so that the residual rate of the designed network protocol can be quantitatively evaluated, and the formula is as follows: ΔSLPe = RSL Pe × v × m SymbolsDefinitionsΔSLPeSafety layer residual error rate (h-1) at a certain bit transmission error ratePeBit error rate of the transmission medium, typically being 10-2 without better data supportRSLPeResidual error rate of a single safety messageVMaximum number of safety messages per hourmMaximum number of message recipients allowed in a single safety function

[0014] The residual error rate RSL of a single safety message (Pe) is determined by the selected CRC checking process, and the calculation formula of the residual error rate of the message subjected to CRC checking is as follows: RCRCPe = 2 − r + k = d minnCnk × Pek × 1 − Pe n − k SymbolsMeaningsrLength of an additional CRC check stringnLength of a transmission data messagedminMinimum Hamming Distance

[0015] Hamming Distance: the number of bits taking different values among corresponding bits of two codewords is called the Hamming distance of the two codewords. In an active code set, the minimum value of the Hamming distance of any two codewords is referred to as the Hamming distance of the code set. Examples are as follows: 10101 and 00110 have their first bit, fourth bit and fifth bit different in sequence from the first, so the Hamming distance is 3.Embodiment 1

[0016] The self-diagnosis method of the present invention relates to using asynchronous communication by the receiver and the sender, and the receiver cannot send a response frame to the sender. The network equipment can only read the network data frame in a regular inquiry mode when sending, receiving and reading the network data, and cannot read the network data by using an interruption mechanism. The data frame structure is shown in the following table, wherein the data frame structure includes a destination address, a source address, an application layer protocol number, an application layer data part and a CRC check code. Where the application layer protocol number is constantly "OXAABB" in this embodiment. Destination MAC AddressSource MAC AddressApplication Layer Protocol No.Application Layer DataCRC Checksum

[0017] The total length of an application layer data frame is defined as 1000 bytes, and the data frame of the application layer is shown in the following table: function codeapplication modeTICK valuemessage serial numberlength of datalength of valid data in this grouptotal number of groupsserial number of the groupretransmissi on bitreserved areaupper layer dataCRC check code Wherein the function code specifically identifies a data pattern; the application mode is specified according to the protocol, and has a fixed value of 3; the TICK value is increased by 1 every period, namely the number of periods; the message serial number is namely the serial number of the message sent in the period, and this field is strongly correlated with the retransmission bit, and when the serial number is 1, it indicates that the data frame is initially transmitted in the period, and the retransmission bit is 0; when the serial number is 2, it indicates that a data frame is retransmitted in the period, and the retransmission bit 1; the length of message name represents the length of the whole data frame, wherein the starting position is a destination MAC address, and the ending position is a CRC check code; the length of valid data in this group represents the valid data length of the upper layer data; the total number of groups represents the total packet number of the data in this group; the serial number of the group represents the packet No. of the data in the group; the retransmission bit: 0 represents that a data frame is initially transmitted in the period; 1 represents a data frame is retransmitted in the period. Except a message serial number, a retransmission bit and a CRC check code, other fields of the two packets of data frames are completely consistent; the reserved area has a value of 0 and is an extension field of the field; the upper layer data represents a command that the system collects or needs to send; the CRC check code: when the retransmission bit is 0, the used CRC check value is 0x04C11DB7; when the retransmission bit is 1, the used CRC check value is 0xBA0DC66B.

[0018] In the embodiment, the sender acquires an operation period of 10ms for itself, a local MAC {0x01, 0x05, 0x03, 0x07, 0x0a}, a destination MAC {0x02, 0x03, 0x05, 0x0a, 0x0b} in the initialization phase, the receiver acquires an operation period of 10ms for itself, a local MAC {0x02, 0x03, 0x05, 0x0a, 0x0b}, and a destination MAC {0x01, 0x05, 0x03, 0x07, 0x0a} in the initialization phase. The time window for receiving data frames set by the receiver is 20 milliseconds, and the tolerance threshold value for times of diagnostic abnormalities is 3. The specific diagnosis method comprises the steps of: step 1, after a sender enters a cycle period, as shown in figure 2, periodically acquiring upper layer data and packaging the upper layer data in the protocol format, wherein the TICK value is the number of cycle periods and starts from 0; for the initially transmitted data frame, the message serial number being 0, the retransmission bit being 0, and the CRC check value being 0x04C11DB7; for a retransmitted data frame, the message serial number being 1, the retransmission bit being 1, and the CRC check value being 0xBA0DC66B; step 2, after the receiver enters a cycle period, as shown in figure 3, starting to carry out a periodic diagnosis on the received data frame; if the receiver does not receive the data frame in the current period, proceeding to the step 6; if the receiving party receives the data frame sent by the sender, checking whether the destination MAC of the data frame is {0x02, 0x03, 0x05, 0x0a, 0x0b}, whether the source MAC is {0x01, 0x05, 0x03, 0x07, 0x0a}, diagnosing as erroneous addressing if the data frame is checked as abnormal, recording the reason when the diagnostic result is abnormal, proceeding to the step 7; and proceeding to the step 3 when the check result is normal; step 3, determining whether four network errors such as retransmission, erroneous sequence, loss and invalid insertion occur or not by diagnosing the TICK, the message serial number and the retransmission bit of data frames, wherein the specific method is as follows: in the case that the last data frame has a TICK value being OX5A, a message serial number being 1, and a retransmission bit being 0, and the received data frame this time has a TICK value being OX5B, a message serial number being 1, and a retransmission bit being 0, it can be diagnosed as data frame loss; in the case that the last data frame has a TICK value being OX5A, a message serial number being 1, and a retransmission bit being 0, and the received data frame this time has a TICK value being OX5A, a message serial number being 1, and a retransmission bit being 0, it can be diagnosed as retransmission; in the case that the last data frame has a TICK value being OX5A, a message serial number being 1, and a retransmission bit being 0, and the received data frame this time has a TICK value being OX50, a message serial number being 1, and a retransmission bit being 0, it can be diagnosed as erroneous sequence; in the case that the last data frame has a TICK value being OX5A, a message serial number being 1, and a retransmission bit being 0, and the received data frame this time has a TICK value being OX3C, a message serial number being 9, and a retransmission bit being 0, it can be diagnosed as invalid insertion; and in the case that the last data frame has a TICK value being OX5A, a message serial number being 0, and a retransmission bit being 0, and the received data frame this time has a TICK value being OX5A, a message serial number being 2, and a retransmission bit being 1, it can be diagnosed as normal; according to the above diagnostic information, recording the abnormal reason when the abnormality is diagnosed, proceeding to the step 7, and proceeding to the step 4 when the check result is normal; step 4, performing respective CRC checks on the initially transmitted data frame and the retransmitted date frame, and performing a binary comparison on upper-layer data of the two packets of data frames if the checks are successful; if the upper layer data of the two packet data frames are compared to be consistent, diagnosing it as normal, proceeding to the step 5, otherwise, diagnosing it as data collapse, and proceeding to the step 7; step 5, checking whether the application mode and the application layer protocol number of the data frame are preset values or not, namely checking whether the application mode is equal to 3 or not, whether the application layer protocol number is equal to 0XAABB or not, if not, diagnosing as a camouflage message, proceeding to the step 7, otherwise, diagnosing as a normal message, and proceeding to the step 8; step 6, if no data frame is received in the period, when the accumulated time during which no data frame is received exceeds 20ms, diagnosing as delay timeout, and proceeding to the step 7; otherwise, keeping the current state and recording the time during which no data frame is received, and proceeding to the next period for diagnosis; step 7, with the number of times of abnormities diagnosed increased by 1, if the number does not reach the tolerance threshold value, keeping the state unchanged, otherwise, carrying out fault processing of: 1) setting the quality bit of the upper layer data of the received data frame to be 0X2C, the 0X2C representing a quality bit set for the receiver, facilitating searching and positioning; 2) exterior reminder: turning off a "RUN" light representing normal communication, displaying a specific reason of a fault by using a dot matrix, displaying "WO01" to indicate that a data collapse is diagnosed, displaying "WO02" to indicate an accidental data retransmission is diagnosed, displaying "WO03" to indicate that an erroneous sequence is diagnosed, displaying "WO04" to indicate that a data loss is diagnosed, displaying "WO05" to indicate a delay overtime is diagnosed; and displaying "WO06" to indicate that an invalid insertion is diagnosed, displaying "WO07" to indicate a disguised message is diagnosed and displaying "WO08" to indicate an erroneous addressing is diagnosed; and after fault processing is finished, proceeding to the next period for diagnosis; step 8, resetting the number of times of abnormities diagnosed, and performing fault recovery processing of: 1) setting the quality bit of the upper layer data of the received data frame to be valid, i.e., setting the quality bit of the upper layer data to be 0; and 2) exterior reminder: turning on the "RUN" light representing normal communication, a dot matrix not displaying any information represents a good result of network diagnosis; and after the fault recovery processing is finished, proceeding to the next period for diagnosis. Embodiment 2

[0019] In this embodiment, the application layer protocol number is fixed to "0XAABB" and the application mode is fixed to a value of 3. The sender acquires an operation period of 8ms for itself, a local MAC {0x01, 0x05, 0x03, 0x07, 0x0a}, a destination MAC {0x02, 0x03, 0x05, 0x0a, 0x0b} in the initialization phase, the receiver acquires an operation period of 8ms for itself, a local MAC {0x02, 0x03, 0x05, 0x0a, 0x0b}, and a destination MAC {0x01, 0x05, 0x03, 0x07, 0x0a} in the initialization phase. The time window for receiving data frames set by the receiver is 32ms, and the tolerance threshold value for times of diagnostic abnormalities is 5. The specific diagnosis method comprises the steps of: step 1, after a sender enters a cycle period, as shown in figure 2, periodically acquiring upper layer data and packaging the upper layer data in the protocol format, wherein the TICK value is the number of cycle periods and starts from 0; for the initially transmitted data frame, the message serial number being 0, the retransmission bit being 0, and the CRC check value being 0x04C11DB7; for a retransmitted data frame, the message serial number being 1, the retransmission bit being 1, and the CRC check value being 0xBA0DC66B; step 2, after the receiver enters a cycle period, as shown in figure 3, starting to carry out a periodic diagnosis on the received data frame; if the receiver does not receive the data frame in the current period, proceeding to the step 6; if the receiving party receives the data frame sent by the sender, checking whether the destination MAC of the data frame is {0x02, 0x03, 0x05, 0x0a, 0x0b}, whether the source MAC is {0x01, 0x05, 0x03, 0x07, 0x0a}, diagnosing as erroneous addressing if the data frame is checked as abnormal, recording the reason when the diagnostic result is abnormal, proceeding to the step 7; and proceeding to the step 3 when the check result is normal; step 3, determining whether four network errors such as retransmission, erroneous sequence, loss and invalid insertion occur or not by diagnosing the TICK, the message serial number and the retransmission bit of data frames, wherein the specific method is as follows: in the case that the last data frame has a TICK value being OX5A, a message serial number being 1, and a retransmission bit being 0, and the received data frame this time has a TICK value being OX5B, a message serial number being 1, and a retransmission bit being 0, it can be diagnosed as data frame loss; in the case that the last data frame has a TICK value being OX5A, a message serial number being 1, and a retransmission bit being 0, and the received data frame this time has a TICK value being OX5A, a message serial number being 1, and a retransmission bit being 0, it can be diagnosed as retransmission; in the case that the last data frame has a TICK value being OX5A, a message serial number being 1, and a retransmission bit being 0, and the received data frame this time has a TICK value being OX50, a message serial number being 1, and a retransmission bit being 0, it can be diagnosed as erroneous sequence; in the case that the last data frame has a TICK value being OX5A, a message serial number being 1, and a retransmission bit being 0, and the received data frame this time has a TICK value being OX3C, a message serial number being 9, and a retransmission bit being 0, it can be diagnosed as invalid insertion; and in the case that the last data frame has a TICK value being OX5A, a message serial number being 0, and a retransmission bit being 0, and the received data frame this time has a TICK value being OX5A, a message serial number being 2, and a retransmission bit being 1, it can be diagnosed as normal; according to the above diagnostic information, recording the abnormal reason when the abnormality is diagnosed, proceeding to the step 7, and proceeding to the step 4 when the check result is normal; step 4, performing respective CRC checks on the initially transmitted data frame and the retransmitted date frame, and performing a binary comparison on upper-layer data of the two packets of data frames if the checks are successful; if the upper layer data of the two packet data frames are compared to be consistent, diagnosing it as normal, proceeding to the step 5, otherwise, diagnosing it as data collapse, and proceeding to the step 7; step 5, checking whether the application mode and the application layer protocol number of the data frame are preset values or not, namely checking whether the application mode is equal to 3 or not, whether the application layer protocol number is equal to 0XAABB or not, if not, diagnosing as a camouflage message, proceeding to the step 7, otherwise, diagnosing as a normal message, and proceeding to the step 8; step 6, if no data frame is received in the period, when the accumulated time during which no data frame is received exceeds 32ms, diagnosing as delay timeout, and proceeding to the step 7; otherwise, keeping the current state and recording the time during which no data frame is received, and proceeding to the next period for diagnosis; step 7, with the number of times of abnormities diagnosed increased by 1, if the number does not reach the tolerance threshold value 5, keeping the state unchanged, otherwise, carrying out fault processing of: 1) setting the quality bit of the upper layer data of the received data frame to be 0X2C, the 0X2C representing a quality bit set for the receiver, facilitating searching and positioning; 2) exterior reminder: turning off a "RUN" light representing normal communication, displaying a specific reason of a fault by using a dot matrix, displaying "WO0a" to indicate that a data collapse is diagnosed, displaying "WO0b" to indicate an accidental data retransmission is diagnosed, displaying "WO0c" to indicate that an erroneous sequence is diagnosed, displaying "WOOd" to indicate that a data loss is diagnosed, displaying "WO0e" to indicate a delay overtime is diagnosed; and displaying "WOOf" to indicate that an invalid insertion is diagnosed, displaying "WO0g" to indicate a disguised message is diagnosed and displaying "WO0h" to indicate an erroneous addressing is diagnosed; and after fault processing is finished, proceeding to the next period for diagnosis; step 8, resetting the number of times of abnormities diagnosed, and performing fault recovery processing of: 1) setting the quality bit of the upper layer data of the received data frame to be valid, i.e., setting the quality bit of the upper layer data to be 0; and 2) exterior reminder: turning on the "RUN" light representing normal communication, a dot matrix not displaying any information represents a good result of network diagnosis; and after the fault recovery processing is finished, proceeding to the next period for diagnosis. Embodiment 3

[0020] In this embodiment, the application layer protocol number is fixed to "0XAABB" and the application mode is fixed to a value of 3. The sender acquires an operation period of 20ms for itself, a local MAC {0x01, 0x05, 0x03, 0x07, 0x0a}, a destination MAC {0x02, 0x03, 0x05, 0x0a, 0x0b} in the initialization phase, the receiver acquires an operation period of 20ms for itself, a local MAC {0x02, 0x03, 0x05, 0x0a, 0x0b}, and a destination MAC {0x01, 0x05, 0x03, 0x07, 0x0a} in the initialization phase. The time window for receiving data frames set by the receiver is 60ms, and the tolerance threshold value for times of diagnostic abnormalities is 2. The specific diagnosis method comprises the steps of: step 1, after a sender enters a cycle period, as shown in figure 2, periodically acquiring upper layer data and packaging the upper layer data in the protocol format, wherein the TICK value is the number of cycle periods and starts from 0; for the initially transmitted data frame, the message serial number being 0, the retransmission bit being 0, and the CRC check value being 0x04C11DB7; for a retransmitted data frame, the message serial number being 1, the retransmission bit being 1, and the CRC check value being 0xBA0DC66B; step 2, after the receiver enters a cycle period, as shown in figure 3, starting to carry out a periodic diagnosis on the received data frame; if the receiver does not receive the data frame in the current period, proceeding to the step 6; if the receiving party receives the data frame sent by the sender, checking whether the destination MAC of the data frame is {0x02, 0x03, 0x05, 0x0a, 0x0b}, whether the source MAC is {0x01, 0x05, 0x03, 0x07, 0x0a}, diagnosing as erroneous addressing if the data frame is checked as abnormal, recording the reason when the diagnostic result is abnormal, proceeding to the step 7; and proceeding to the step 3 when the check result is normal; step 3, determining whether four network errors such as retransmission, erroneous sequence, loss and invalid insertion occur or not by diagnosing the TICK, the message serial number and the retransmission bit of data frames, wherein the specific method is as follows: in the case that the last data frame has a TICK value being OX5A, a message serial number being 1, and a retransmission bit being 0, and the received data frame this time has a TICK value being OX5B, a message serial number being 1, and a retransmission bit being 0, it can be diagnosed as data frame loss; in the case that the last data frame has a TICK value being OX5A, a message serial number being 1, and a retransmission bit being 0, and the received data frame this time has a TICK value being OX5A, a message serial number being 1, and a retransmission bit being 0, it can be diagnosed as retransmission; in the case that the last data frame has a TICK value being OX5A, a message serial number being 1, and a retransmission bit being 0, and the received data frame this time has a TICK value being OX50, a message serial number being 1, and a retransmission bit being 0, it can be diagnosed as erroneous sequence; in the case that the last data frame has a TICK value being OX5A, a message serial number being 1, and a retransmission bit being 0, and the received data frame this time has a TICK value being OX3C, a message serial number being 9, and a retransmission bit being 0, it can be diagnosed as invalid insertion; and in the case that the last data frame has a TICK value being OX5A, a message serial number being 0, and a retransmission bit being 0, and the received data frame this time has a TICK value being OX5A, a message serial number being 2, and a retransmission bit being 1, it can be diagnosed as normal; according to the above diagnostic information, recording the abnormal reason when the abnormality is diagnosed, proceeding to the step 7, and proceeding to the step 4 when the check result is normal; step 4, performing respective CRC checks on the initially transmitted data frame and the retransmitted date frame, and performing a binary comparison on upper-layer data of the two packets of data frames if the checks are successful; if the upper layer data of the two packet data frames are compared to be consistent, diagnosing it as normal, proceeding to the step 5, otherwise, diagnosing it as data collapse, and proceeding to the step 7; step 5, checking whether the application mode and the application layer protocol number of the data frame are preset values or not, namely checking whether the application mode is equal to 3 or not, whether the application layer protocol number is equal to 0XAABB or not, if not, diagnosing as a camouflage message, proceeding to the step 7, otherwise, diagnosing as a normal message, and proceeding to the step 8; step 6, if no data frame is received in the period, when the accumulated time during which no data frame is received exceeds 60ms, diagnosing as delay timeout, and proceeding to the step 7; otherwise, keeping the current state and recording the time during which no data frame is received, and proceeding to the next period for diagnosis; step 7, with the number of times of abnormities diagnosed increased by 1, if the number does not reach the tolerance threshold value 2, keeping the state unchanged, otherwise, carrying out fault processing of: 1) setting the quality bit of the upper layer data of the received data frame to be 0X2C, the 0X2C representing a quality bit set for the receiver, facilitating searching and positioning; 2) exterior reminder: turning off a "RUN" light representing normal communication, displaying a specific reason of a fault by using a dot matrix, displaying "WO0A" to indicate that a data collapse is diagnosed, displaying "WO0B" to indicate an accidental data retransmission is diagnosed, displaying "WO0C" to indicate that an erroneous sequence is diagnosed, displaying "WOOD" to indicate that a data loss is diagnosed, displaying "WO0E" to indicate a delay overtime is diagnosed; and displaying "WOOF" to indicate that an invalid insertion is diagnosed, displaying "WO0G" to indicate a disguised message is diagnosed and displaying "WO0H" to indicate an erroneous addressing is diagnosed; and after fault processing is finished, proceeding to the next period for diagnosis; step 8, resetting the number of times of abnormities diagnosed, and performing fault recovery processing of: 1) setting the quality bit of the upper layer data of the received data frame to be valid, i.e., setting the quality bit of the upper layer data to be 0; and 2) exterior reminder: turning on the "RUN" light representing normal communication, a dot matrix not displaying any information represents a good result of network diagnosis; and after the fault recovery processing is finished, proceeding to the next period for diagnosis.

[0021] According to IEC61508 SIL3 (Safety Integrity Level) standard, a safety network for a nuclear power plant has to ensure a residual error rate being less than 10-9. After actual testing and fault insertion, the self-diagnosis method of the present invention can correctly diagnose eight transmission errors of the network, and the network residual error rate meets the SIL3 requirement of the level standard.

Claims

1. A self-diagnosis method for a communication protocol of a security-level instrumentation and control system of a nuclear power plant, wherein the method based on a point-to-point network protocol composed of an application layer, a data link layer and a physical layer, a sender and a receiver periodically operating, a data frame structurally comprising a destination MAC address, a source MAC address, an application layer protocol number, an application layer data which is a data frame of the application layer, and a CRC checksum, the application layer data further comprising an application mode specified according to the protocol, a TlCK value for counting a number of periods, a message serial number representing a serial number of a message sent in the period, a message frame number, a retransmission position, upper-layer data representing a command that the system collects of needs to send, and a CRC check code, and the upper layer data further comprises a data value and a quality bit, wherein the CRC checksum in the data frame is used to check the data frame, and the CRC check code in the application layer data is used to check the data frame of the application layer, the method comprising the following steps: step 1, acquiring the destination MAC address, the source MAC address and the upper-layer data, and packaging and sending the acquired upper-layer data in a frame format by the sender, wherein a retransmission position of a first transmission data frame is 0, and a retransmission position of a retransmission data frame is 1, the retransmission position represents a data frame is initially transmitted or retransmitted in the period, wherein setting the retransmission position 1, if the data frame is retransmitted, and setting the retransmission position 0, if the data frame is initially transmitted; step 2, if the receiver does not receive the data frame, entering a step 6; if the receiver receives the data frame sent by the sender, detecting the destination MAC address and the source MAC address of the data frame to diagnose an error address, recording an abnormal cause and entering a step 7 during diagnosis abnormality, and entering a step 3 during diagnosis normality, wherein diagnosing an error address when the destination MAC address of the data frame is first preset MAC address, the source MAC address is second preset MAC address, wherein determining the diagnosis is abnormal if a local MAC address of the receiver is different from the destination MAC address of the data frame, or a local MAC address of the sender is different from the source MAC address of the data frame, step 3, determining the TICK and the message serial number of the data frame, judging whether four network errors including retransmission, disorder, loss and invalid insertion happen or not by detecting a value of the TICK and a value of the message serial number, recording an abnormal cause and entering the step 7 during diagnosis abnormality, and entering a step 4 during diagnosis normality; wherein determining the retransmission happens, if the TICK value, the message serial and the retransmission bit of the last data frame is the same as the TICK value, the message serial and the retransmission bit of the received data frame this time; determining the disorder happens, if the sequential order of the TICK value of the last data frame does not arrive in the sequential order of the TICK value of the received data frame this time, but the message serial and the retransmission bit of the last data frame is the same as the message serial and the retransmission bit of the received data frame this time; determining the loss happens, if the TICK value of the received data frame this time is different from the TICK value of the last data frame, and the message serial and the retransmission bit of the last data frame is the same as the message serial and the retransmission bit of the received data frame this time; determining the invalid insertion happens, if the TICK value of the received data frame this time is different from the TICK value of the last data frame, and the message serial of the received data frame this time is different from the message serial of the last data frame, and the retransmission bit of the last data frame is the same as the retransmission bit of the received data frame this time; step 4, performing respective CRC checks on the initially transmitted data frame and the retransmitted date frame, and performing a binary comparison on upper-layer data of the initially transmitted data frame and the retransmitted date frame if the checks are successful; if the upper layer data of the the initially transmitted data frame and the retransmitted date frame are compared to be consistent, diagnosing it as normal, proceeding to the step 5, otherwise, diagnosing it as data collapse, and proceeding to the step 7; wherein the initially transmitted data frame is a data frame initially transmitted, the retransmitted date frame is a data frame retransmitted; step 5, detecting the application mode and the application layer protocol number of the data frame, if the application mode and the application layer protocol number are not preset values, diagnosing the message to be a camouflage message, recording an abnormal cause and entering the step 7, and entering a step 8 during diagnosis normality; step 6, if the receiver does not receive the data frame within the time exceeding a set data frame receiving time window, diagnosing the error to be time-out delay, recording an abnormal cause and entering the step 7; if the receiver receives the data frame within the set data frame receiving time window, keeping a current state and recording the time when the data frame is received; step 7, a number of diagnosis abnormality times increased by 1 when the data frame diagnoses an abnormality, if the number of diagnosis abnormality times does not reach the tolerance threshold value, keeping the state unchanged, or else, performing fault handling, namely making the quality position for receiving the upper-layer data of the data frame invalid, and displaying a specific cause of a fault by means of a dot matrix; step 8, clearing the number of diagnosis abnormality times to be zero, and performing fault recovery handling, namely making the quality position for receiving the upper-layer data of the data frame valid, and displaying network diagnosis to be normal by means of the dot matrix; wherein the number of periods is the number of times the data frame is diagnosed; wherein the quality position's value is used to determine whether the upper layer data of the data frame is abnormal.

2. The self-diagnosis method for the communication protocol of the security-level instrumentation and control system of the nuclear power plant of claim 1, characterized in that a network data volume of the communication protocol is constant, an interface mode is a full-duplex asynchronous transmission mode, and a transmission medium is a multimode fiber.

3. The self-diagnosis method for the communication protocol of the security-level instrumentation and control system of the nuclear power plant of claim 1, characterized in that the destination MAC address, the source MAC address and the upper-layer data are acquired by a configuration tool.

4. The self-diagnosis method for the communication protocol of the security-level instrumentation and control system of the nuclear power plant of claim 1, characterized in that the data frame format of the application layer further comprises total length of a message, valid data length of a frame and a reserved area.

5. The self-diagnosis method for the communication protocol of the security-level instrumentation and control system of the nuclear power plant of claim 4, characterized in that the valid data length of the frame is acquired by the configuration tool.

6. The self-diagnosis method for the communication protocol of the security-level instrumentation and control system of the nuclear power plant of claim 1, characterized in that the length of the data frame of the application layer ranges from 256 bytes to 1500 bytes.

7. The self-diagnosis method for the communication protocol of the security-level instrumentation and control system of the nuclear power plant of claim 1, characterized in that the length of the data frame of the application layer ranges from 512 bytes to 1200 bytes.

8. The self-diagnosis method for the communication protocol of the security-level instrumentation and control system of the nuclear power plant of claim 1, characterized in that the operation periods of the receiver and the sender are the same.

9. The self-diagnosis method for the communication protocol of the security-level instrumentation and control system of the nuclear power plant of claim 1, characterized in that the operation periods of the receiver and the sender range from 8 milliseconds to 20 milliseconds.

10. The self-diagnosis method for the communication protocol of the security-level instrumentation and control system of the nuclear power plant of claim 1, characterized in that the data frame receiving time window set by the receiver is 2-4 times as much as the maximum value of the operation periods of the sender and the receiver.

11. The self-diagnosis method for the communication protocol of the security-level instrumentation and control system of the nuclear power plant of claim 1, characterized in that the tolerance threshold value of the numerical range of diagnosis abnormality times is 2-5 times.