Safety function block active defense method and system for safety instrument system

Abstract

The invention provides a safety function block active defense method and system for a safety instrument system. The method comprises the following steps: before executing a core algorithm, performing pointer security check and numerical field check on input data of a security function block; if the check is passed, entering a pre-operation stage, and monitoring an operation risk in real time through a preset check point by utilizing a reverse analysis pre-operation algorithm or a soft floating point pre-operation algorithm on the premise of not executing an actual instruction which possibly causes hardware exception; and executing a deterministic output strategy according to a pre-operation result, and outputting a unified hierarchical state code (ERR) through a special state pin. The method has the advantages of endogenous safety, fault behavior determination, high diagnosis precision, high configuration efficiency and the like, controller shutdown caused by data exception can be effectively avoided, and the robustness of an industrial control system is improved.

Description

Technical Field

[0001] This invention relates to the field of functional safety in industrial automation control systems, specifically to a safety function block design technology applicable to safety instrumented systems (SIS), programmable logic controllers (PLCs), and distributed control systems (DCS), and particularly to an active defense method and system for safety function blocks in safety instrumented systems. Background Technology

[0002] In the field of industrial control, Safety Instrumented Systems (SIS) are the last line of defense for ensuring the safe operation of a factory. Controllers typically follow a cyclical scanning mechanism of "input refresh - user program execution - output refresh". During the user program execution phase, function blocks are the basic units for implementing control algorithms, such as PID control, addition, subtraction, multiplication, division, and logical voting.

[0003] Existing SIS function block designs have the following significant drawbacks: 1. Lack of proactive defense mechanisms: Traditional function blocks typically view themselves as pure "computation tools," assuming that the input data is reliable. Once illegal data, such as NaN or Inf, is input, or division by zero or overflow occurs during the calculation process, the CPU often directly calls hardware instructions to execute, causing abnormal data to spread "virally" in the system, and even triggering hardware interrupts that cause the controller to stop.

[0004] 2. Exception handling relies on external "patching": To ensure security, application engineers must manually write a large amount of checking logic, such as comparison instructions and range judgment instructions, outside of functional blocks. This not only increases the configuration workload but also easily leads to security vulnerabilities due to human negligence.

[0005] 3. Uncertain Fault Behavior: When an exception occurs, such as a floating-point overflow, the output state of many functional blocks is undefined, or only a simple BOOL error bit ErrorBi is provided, which cannot inform downstream modules of the specific cause of the error, making it impossible for the system to make accurate degradation decisions.

[0006] Therefore, there is an urgent need for a new type of security function block design that can incorporate data security governance, provide real-time monitoring throughout the entire process, and determine fault behavior. Summary of the Invention

[0007] The purpose of this invention is to provide a proactive defense method and system for security function blocks in safety instrumented systems, which achieves proactive defense across the entire chain from the data source to the calculation result by internalizing security governance responsibilities into the function blocks.

[0008] To address the aforementioned technical problems, this invention proposes a technical solution for an active defense method for safety function blocks in safety instrument systems.

[0009] The first aspect of this invention discloses an active defense method for safety function blocks in a safety instrumented system; the method includes: Step S1: Multi-dimensional input verification; Before executing the core algorithm, a mandatory check is performed on all input data of the security function block, including pointer security check and numerical domain check; if the check fails, proceed directly to step S3; Step S2: Real-time monitoring and pre-computation; If the check in step S1 passes, proceed to the pre-computation stage; Depending on the type of input data, select to execute the reverse analysis pre-computation algorithm or the soft floating-point pre-computation algorithm; Set real-time monitoring points in each step of the pre-computation; Once an abnormal risk of operation is detected, immediately terminate the operation and generate the corresponding abnormal status flag, and jump to step S3; If the pre-computation is completed normally, generate the normal operation result. Step S3: Decision Output and Status Encoding; Based on the execution result of step S1 or step S2, a deterministic output strategy is executed, and the calculation result or preset safety value is output through the output pin. Simultaneously, a unified status code ERR is output through a dedicated status pin. The unified status code is used to indicate the current operating status and anomaly type of the safety function block.

[0010] Preferably, in step S2, when the input data is integer data, the reverse analysis pre-operation algorithm is executed, specifically including: By utilizing the overflow and underflow limits of data types, an arithmetic operation is transformed into a comparison operation based on the limit values ​​through a swap inequality operation strategy. Before performing the actual arithmetic operation, it is predicted whether the result will overflow. The swap inequality operation strategy transforms A+B>MAX into A>MAX-B. If the predicted result does not overflow, then perform the actual arithmetic operation and output the result; If the predicted result overflows, the actual arithmetic operation that might cause the overflow will not be performed. Instead, the saturation value of the data type will be returned directly, and the corresponding overflow exception status will be marked.

[0011] Preferably, in step S2, when the input data is floating-point data, the soft floating-point pre-computation algorithm is executed, specifically including: Instead of directly calling the instructions of the hardware floating-point unit (FPU) for blind calculation, it follows the IEEE 754 standard and parses floating-point numbers through bit pattern analysis. Multiple error checkpoints are injected into the input parsing stage, the operation execution stage, and the result processing stage of floating-point operations, respectively. At each error checkpoint, check whether the intermediate data contains invalid operands NaN, infinite Inf, denormalized numbers, risk of division by zero, or risk of precision loss. If any checkpoint detects an anomaly, subsequent operations are immediately halted, and the corresponding abnormal data and anomaly status identifier are returned.

[0012] Preferably, the error checkpoint includes at least: Input parsing checkpoints: used to detect signals NaN or SNaN, silent NaN or QNaN, and denormalized numbers; Operation execution checkpoints: During mantissa alignment, mantissa operation and exponent operation, detect excessive exponent difference, loss of alignment precision, abnormal subtraction to zero and exponent overflow prediction. Results processing checkpoints: During normalization and rounding, detect normalization failures, overflows caused by rounding, and overflows or underflows in the final result.

[0013] Preferably, in step S3, the unified state code (ERR) is a byte-type numerical value, and its encoding structure adopts a layered architecture, including: Kernel security layer encoding (0x00-0x1F): Rooted in the system's underlying layer, used to identify system survival level errors, including invalid input, division by zero, memory errors, and pointer out of bounds. Process safety layer coding (0x20-0x4F): used to identify control logic and process safety level errors, including PID output saturation, actuator failure and safety interlock triggering; Project application layer coding (0x50-0xFE): Open to user customization, used to identify specific process logic or equipment interlock status.

[0014] Preferably, the deterministic output strategy in step S3 is as follows: When an invalid input, floating-point error or division by zero error is detected, the output pin retains the valid value of the previous cycle or outputs the preset safety guide value, and the status pin outputs the corresponding alarm code. When an integer overflow is detected, the output pin outputs the boundary value of the data type, and the status pin outputs the corresponding warning code; When a system-level fatal error is detected, the output pin outputs a fault-safe value, the status pin outputs a fault code, and triggers system-level interlocking.

[0015] Preferably, the pointer safety check in step S1 specifically includes: calling the runtime environment API to obtain the allocated safe memory region range, determining whether the input pointer is not null and points to the safe memory region, and checking whether the length of the data pointed to by the pointer is out of bounds.

[0016] A second aspect of the present invention discloses an active defense system for safety function blocks in a safety instrumented system; the system includes: The input validation module is used to perform mandatory checks on the pointer validity and numerical legality of the input data before the algorithm is executed; The pre-computation processing module is used to perform reverse analysis pre-computation and soft floating-point pre-computation. It monitors the risks of overflow, division by zero and illegal values ​​in real time during the operation by embedding checkpoints in the operation steps; soft floating-point refers to floating-point simulation by software. The decision output module is used to control the function block to output a determined safe value or normal calculated value based on the verification and pre-calculation results, and to generate a unified status code of byte type. The interface unit includes a data input pin, a data output pin, and an ERR pin for outputting the unified status code.

[0017] A third aspect of this invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of an active defense method for a safety functional block in a safety instrumented system, as described in any of the first aspects of this disclosure.

[0018] A fourth aspect of this invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of an active defense method for a safety functional block in a safety instrumented system, as described in any of the first aspects of this disclosure.

[0019] The beneficial effects of this invention are: 1. Intrinsic security and proactive defense: Intercepting anomalies within functional blocks prevents the spread of erroneous data, avoids controller shutdown due to hardware anomalies, and significantly improves system robustness.

[0020] 2. Deterministic Fault Behavior: Regardless of the type of exception, the function block can output a definite value (safe value) and a definite status code, eliminating the risks caused by undefined behavior.

[0021] 3. High-precision diagnosis: Through unified Byte type ERR encoding, it provides much richer diagnostic information than the traditional BOOL bit, supporting downstream systems to implement intelligent fault handling strategies.

[0022] 4. Improved configuration efficiency: Engineers no longer need to write cumbersome verification logic outside of function blocks, which simplifies engineering configuration and reduces labor costs and error rates. Attached Figure Description

[0023] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0024] Figure 1 A flowchart illustrating an active defense method for a safety function block in a safety instrumented system according to an embodiment of the present invention; Figure 2 The flowchart for the preprocessing of generic security function blocks provided by this invention; Figure 3 This is a logical diagram of the addition reverse analysis pre-operation algorithm in this invention; Figure 4 A comparison of soft and hard floating-point strategies and a diagram illustrating the implementation path of the soft floating-point method in this invention; Figure 5 This is a flowchart of injecting ERR checkpoints in the soft floating-point algorithm for four arithmetic operations; Figure 6 This is a schematic diagram of the external pin interface of the security function block of the present invention, including the ERR byte pin.

[0025] Figure 7 This is a structural diagram of a safety function block active defense system for a safety instrument system according to an embodiment of the present invention; Figure 8 This is a structural diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0026] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0027] The first aspect of this invention discloses an active defense method for safety function blocks in a safety instrument system.

[0028] Figure 1 This is a flowchart of an active defense method for a safety function block in a safety instrumented system according to an embodiment of the present invention, such as... Figure 1 As shown, the method is applied to the controller of an industrial control system. The security function block incorporates a data security governance process during execution, which includes the following steps: Step S1: Multi-dimensional input verification; Before executing the core algorithm, a mandatory check is performed on all input data of the security function block, including pointer security check and numerical domain check; if the check fails, proceed directly to step S3; The pointer safety check in step S1 specifically includes: calling the runtime environment API to obtain the allocated safe memory region range, determining whether the input pointer is not null and points to the safe memory region, and checking whether the length of the data pointed to by the pointer is out of bounds.

[0029] In some specific embodiments, at this stage, all input parameters will undergo sequential, automatic, mandatory checks: Pointer safety check: The input structure pointer is validated for validity and safety to ensure it is not null and points to a preset safe memory region. This safe memory region is allocated and managed by the controller's operating system or runtime environment when the user program is loaded. The function block obtains the starting address and offset length of the safe memory region by calling the API provided by the runtime, and then checks whether the input pointer is within this range and whether the data length pointed to by the pointer is out of bounds, thereby effectively preventing unauthorized access to the system protected area or other task memory.

[0030] Numerical domain check: Real-time verification to check whether the data is illegal (such as NAN, INF) or exceeds the preset engineering range. If this verification fails, the subsequent processing will end directly and jump to the safe output stage.

[0031] Step S2: Real-time monitoring and pre-computation; If the check in step S1 passes, proceed to the pre-computation stage; Depending on the type of input data, select to execute the reverse analysis pre-computation algorithm or the soft floating-point pre-computation algorithm; Set real-time monitoring points in each step of the pre-computation; Once an abnormal risk of operation is detected, immediately terminate the operation and generate the corresponding abnormal status flag, and jump to step S3; If the pre-computation is completed normally, generate the normal operation result. Among them, the soft floating-point pre-computation algorithm is a floating-point pre-computation algorithm simulated by software; In step S2, when the input data is integer data, the reverse analysis pre-operation algorithm is executed, specifically including: By utilizing the overflow and underflow limits of data types and by exchanging inequality operation strategies, we can predict whether the calculation result will overflow before performing the actual arithmetic operation. If the predicted result does not overflow, then perform the actual arithmetic operation and output the result; If the predicted result overflows, the actual arithmetic operation that might cause the overflow will not be performed. Instead, the saturation value of the data type will be returned directly, and the corresponding overflow exception status will be marked.

[0032] In step S2, when the input data is floating-point data, the soft floating-point pre-computation algorithm is executed, specifically including: Instead of directly calling the instructions of the hardware floating-point unit (FPU) for blind calculation, it follows the IEEE 754 standard and parses floating-point numbers through bit pattern analysis. Multiple error checkpoints are injected into the input parsing stage, the operation execution stage, and the result processing stage of floating-point operations, respectively. At each error checkpoint, check whether the intermediate data contains invalid operands NaN, infinite Inf, denormalized numbers, risk of division by zero, or risk of precision loss. If any checkpoint detects an anomaly, subsequent operations are immediately halted, and the corresponding abnormal data and anomaly status identifier are returned.

[0033] The error checkpoints include at least: Input parsing checkpoints: used to detect signals NaN or SNaN, silent NaN or QNaN, and denormalized numbers; Operation execution checkpoints: During mantissa alignment, mantissa operation and exponent operation, detect excessive exponent difference, loss of alignment precision, abnormal subtraction to zero and exponent overflow prediction. Results processing checkpoints: During normalization and rounding, detect normalization failures, overflows caused by rounding, and overflows or underflows in the final result.

[0034] In some specific embodiments: This step is the core of data governance, involving sequential evaluation of the verification results of step S1 and real-time monitoring of each pre-computation step: Real-time monitoring and evaluation: Real-time monitoring evaluates the results of each check according to strict sequential logic. This process follows the "short-circuit" principle, meaning that if any preceding check step discovers a fatal anomaly, such as an illegal pointer or invalid data, subsequent operation and checks will be immediately terminated, and the process will jump directly to the safe output stage.

[0035] Pre-processing core logic execution: Data will only be allowed to the core algorithm logic after all mandatory checks have passed. Here, the following steps will be selectively executed: I. Execute the reverse analysis pre-computation algorithm: This algorithm utilizes the overflow and underflow limits of data types and employs a strategy based on commutative inequality operations to perform predictive overflow detection on input variables; for example... Figure 3 As shown: (1) A brief description of the pre-computation algorithm for inverse addition analysis, such as Figure 3 As shown: a. Symbolic analysis stage: If A > 0 and B > 0, proceed with overflow detection; If A < 0 and B < 0, proceed with underflow detection; In other cases (one positive and one negative or including zero), safety is calculated directly.

[0036] b, Detection logic: Overflow detection: Check if A ≤ (MAX - B); Underflow detection: Check if A ≥ (MIN - B); c. Result processing: Test passed: A + B was executed normally, and the result was output. Detection failed: Enable security policy and output data type saturation values.

[0037] (2) Brief description of the reverse analysis pre-operation algorithm for subtraction (AB): a. Symbolic analysis stage: If A ≥ 0 and B < 0: subtracting a negative number from a positive number equals adding a positive number to a positive number, which may result in overflow; If A < 0 and B ≥ 0: negative number minus positive number = negative number plus negative number, which may result in underflow; Other cases (same sign or containing zero): Directly calculate safety; b. Detection logic: Overflow detection: Check if A ≤ MAX + B (B is negative, MAX + B is actually a subtraction); Underflow detection: Check if A ≥ MIN + B (B is positive, MIN + B is actually addition); c. Result processing: Test passed: A - B was executed normally, and the result was output. Detection failed: Enable security policy and output saturation value.

[0038] (3) Brief description of the reverse analysis pre-computation algorithm for multiplication operation (AxB): a. Symbolic analysis stage: If A > 0 and B > 0: Multiplying positive numbers may result in overflow; If A < 0 and B < 0: Multiplying a negative number by another negative number may result in overflow (negative times negative equals positive). If A > 0 and B < 0: multiplying a positive number by a negative number may result in underflow; If A < 0 and B > 0: multiplying a negative number by a positive number may result in underflow; If A = 0 or B = 0: the result is zero, and there is no risk of overflow; b. Detection logic: Overflow detection (same number case): Positive: Check if A ≤ MAX / B; Negative: Check if A ≥ MAX / B (note the sign handling); Underflow detection (for cases with different signs): Positive / Negative: Check if A ≥ MIN / B; Positive / negative: Check if A ≤ MIN / B (note the sign handling); c. Result processing: Test passed: A × B was executed normally, and the result was output. Detection failed: Enable security policy and output saturation value.

[0039] (4) Reverse analysis of the core logic and extensions of the pre-computation algorithm: Addition: Predict the range of the result by performing reverse operations MAX - B and MIN - B; Subtraction: Convert to an equivalent addition form, and then process using addition logic; Multiplication: Predict the range of the result by performing reverse operations MAX / B and MIN / B; Division: Safety is ensured through boundary value checks and special case handling; Time calibration: Time wrap-around is handled by comparing the temporary value to be calibrated with the limit boundary value.

[0040] II. Soft floating-point pre-computation algorithm for four arithmetic operations: i. Design concept: This invention provides a specialized soft-floating-point implementation method for proactive security defense, featuring built-in, multi-checkpoint functionality. The design philosophy of this invention is based on a comparison of soft and hard floating-point arithmetic schemes, such as... Figure 4 As shown, to avoid uncertainties during computation, the core algorithm of the function block software simulation (soft floating-point strategy) is executed. The computation process follows relevant standards, such as IEEE 754-2019, performs bit mode analysis, and parses according to the floating-point standard format. Under real-time monitoring, mantissa alignment, arithmetic operations, normalization, and rounding are performed; otherwise, the execution of the core algorithm is immediately blocked, and a safe output is activated. This invention does not aim to implement floating-point operations on hardware without an FPU, but rather, on hardware with an FPU, actively chooses to use soft floating-point to obtain complete process control, achieving step-level real-time monitoring that hard floating-point cannot provide. Figure 5 As shown. This sequential decision-making mechanism ensures the efficiency of the inspection process and the immediacy of fault response. Any primary security threat can be detected as quickly as possible and trigger deterministic security actions, strictly adhering to the "fail-safe" design principle.

[0041] ii. Core mechanism of soft floating-point pre-computation: a. Checkpoint injection strategy: Phased detection: Each operation phase only focuses on the abnormal patterns unique to that phase; Input parsing: Pay attention to data validity, such as NaN, infinity, and denormalized numbers; Operation execution: Pay attention to abnormalities in the calculation process, such as abnormal exponentiation or mantissa overflow; Results processing: Focus on the validity of the results, such as normalization failures and rounding issues; b. Minimize overhead: Focus the inspection logic near critical points where exceptions may occur. iii. Brief description of soft floating-point pre-computation algorithm: By injecting ERR checkpoints into the key steps of soft floating-point operations, each step is monitored in real time to detect BYTE type FLAG data, thus achieving the effects of pre-computation proactive defense and real-time performance.

[0042] Phase 1: Input Parsing - ERR Checkpoint 1.1, IEEE 754 parsing checkpoints Check location: After extracting the sign bit, exponent bit, and mantissa bit: FLAG 0x01 - Invalid operand: Operand SNaN (signal NaN) was detected; FLAG 0x02 - Silent NaN: Operand QNaN (silent NaN) was detected; FLAG 0x03 - Denormalized number: The exponent is all 0 but the mantissa is not 0, which may compromise accuracy.

[0043] 1.2 Operand Verification Checkpoints Check position: Input parsing complete, before proceeding to calculation: FLAG 0x04 - Infinity Operation: Any operand is infinite and requires special handling; FLAG 0x05 - Zero Operand: ±0 was detected; some operations require special rules. Phase Two: Operation Execution - ERR Checkpoint 2.1, Checkpoints for order-based steps (addition and subtraction) Check location: During the mantissa alignment process: FLAG 0x10 - Exponent difference too large: The exponent difference exceeds the number of mantissas + 3, and the mantissas of the smaller operands are all shifted to the right and lost; FLAG 0x11 - Alignment precision loss: Right shifting results in the loss of more than 50% of valid bits, setting a precision warning.

[0044] 2.2 Mantissa Operation Checkpoints Check location: during addition / subtraction / multiplication / division operations of the last digit: FLAG 0x20 - Subtraction Zeroing Anomaly: The result of subtracting the mantissas is 0, but the sign bit is abnormal, which may produce -0; FLAG 0x21 - Multiplication overflow: The result of multiplying the mantissas exceeds twice the width of the mantissas; FLAG 0x22 - Division error: Divisor is 0 and dividend is non-zero, resulting in infinity.

[0045] 2.3 Checkpoints for Exponential Operations Check location: when adding / subtracting exponents: FLAG 0x30 - Prediction of exponential overflow: The sum of the exponents is greater than or equal to the maximum exponential value - 1; FLAG 0x31 - Predicting underflow of exponents: The difference between the exponents is less than or equal to the minimum exponent value + 1; FLAG 0x32 - Invalid exponent: The result of the exponent operation is out of the valid range [MIN_EXP, MAX_EXP].

[0046] Phase 3: Results Processing - ERR Checkpoint 3.1 Standardized Checkpoints Inspection location: The standardization process is as follows: FLAG 0x40 - Left Overshoot: The number of left shifts required exceeds the adjustable range of the exponent; FLAG 0x41 - Right-rule anomaly: The exponent reaches its maximum value after right-rule, which may cause overflow; FLAG 0x42 - Unnormalizable: The result is neither zero nor can it be normalized to a standard form.

[0047] 3.2 Rounding checkpoints Check location: The rounding process is as follows: FLAG 0x50 - Rounding precision loss: Rounding causes changes in the significant bits, resulting in a loss of precision; FLAG 0x51 - Rounding caused overflow: Rounding caused mantissa overflow, requiring renormalization; FLAG 0x52 - Rounding to zero exception: Inconsistent results are produced under a specific rounding mode.

[0048] 3.3 Final Overflow Checkpoint Check location: The overflow check steps are as follows: FLAG 0x60 - Actual overflow: Exponent ≥ Maximum Exponent value, returns ±Inf; FLAG 0x61 - Actual underflow: Exponent ≤ minimum exponent value, returns ±0 or a denormalized number; FLAG 0x62 - Complete loss of precision: The result is 0 but the original operand is not 0, resulting in complete loss of precision.

[0049] Here, FLAG is the internal soft floating-point real-time monitoring fault identifier for four arithmetic operations. It has the same concept as the unified status coding ERR of the FB function block, but the scope is different.

[0050] During soft floating-point pre-computation with injected ERR checkpoints, all floating-point data is passed and processed using floating-point storage and integer retrieval. Near different checkpoints, special attention is paid to checking for exceptions related to the relevant steps to avoid redundancy in logic and code. If an exception occurs, the relevant exception data is returned promptly, terminating subsequent operations and transferring control to the subsequent decision output. The decision output determines whether the pre-computation terminates or executes normally, and performs a safe, deterministic output.

[0051] Step S3: Decision Output and Status Encoding; Based on the execution result of step S1 or step S2, a deterministic output strategy is executed, and the calculation result or preset safety value is output through the output pin. Simultaneously, a unified status code ERR is output through a dedicated status pin. The unified status code is used to indicate the current operating status and anomaly type of the safety function block.

[0052] In step S3, the unified state code (ERR) is a one-byte value of type Byte, and its encoding structure adopts a layered architecture, including: Kernel security layer encoding (0x00-0x1F): Rooted in the system's underlying layer, used to identify system survival level errors, including invalid input, division by zero, memory errors, and pointer out of bounds. Process safety layer coding (0x20-0x4F): used to identify control logic and process safety level errors, including PID output saturation, actuator failure and safety interlock triggering; Project application layer coding (0x50-0xFE): Open to user customization, used to identify specific process logic or equipment interlock status.

[0053] The deterministic output strategy in step S3 is specifically as follows: When an invalid input, floating-point error or division by zero error is detected, the output pin retains the valid value of the previous cycle or outputs the preset safety guide value, and the status pin outputs the corresponding alarm code. When an integer overflow is detected, the output pin outputs the boundary value of the data type, and the status pin outputs the corresponding warning code; When a system-level fatal error is detected, the output pin outputs a fault-safe value, the status pin outputs a fault code, and triggers system-level interlocking.

[0054] In some specific embodiments, the final output is directly controlled by real-time monitoring, either outputting the normal calculation result or, under abnormal conditions, outputting a preset safety value. The assigned data for the output pins must be the numerical value calculated in the pre-calculation process or the standard value preset by the macro definition; unprocessed or unjudged temporary variables must never be used.

[0055] This invention, for functional blocks with different functions, comprehensively references various security and data processing standards, mainstream manufacturers' processing methods, and actual feedback from on-site technical personnel, and formulates a security-oriented internal deterministic processing cross-strategy and external pin representation.

[0056] a. Internal deterministic cross-processing strategy: Elementary mathematical operations: Output strategy is formulated in accordance with IEC 61508 certification requirements and the default exception handling principles of IEEE 754 standard; Time synchronization function calculation: When time data is abnormal, a strategy of not performing the time synchronization function is adopted; Conversion comparison operation: When the input is invalid, the strategy of maintaining the value of the previous cycle is adopted; when the range is exceeded, the overflow boundary value strategy is adopted. System safe operation: retain the value of the previous cycle when there is an abnormal input, and output the default value when there is an error in the operation.

[0057] b. External manifestations: A BYTE type ERR pin is added to the output variable side as the last output pin of the function block. For example... Figure 6 As shown.

[0058] When performing deterministic processing output internally, the ERR pin will also output a specific unified status code to accurately indicate the normal or abnormal root cause.

[0059] 3. Unified State Encoding ERR Pin and its Qualitative Effect: 1. Design Concept: This invention employs a layered and hierarchical strategy, with the core components fixed while the peripheral components allow for configuration and expansion. It ensures core security while also considering flexibility in engineering applications. Error handling follows deterministic principles; while performing deterministic processing internally, the ERR pin synchronously outputs precise status codes, providing a unified interface for system monitoring and fault diagnosis. The internal deterministic processing combined with the synchronous status code output from the ERR pin is shown in Table 1.

[0060] Table 1. ERR Pin Encoding Layered Architecture Design

[0061] a. Kernel-level error codes - a guarantee of system survival, can be completely fixed: Range: 0x00 - 0x1F (general and resource errors) and all FAULT level security-related errors; Fixed location: The runtime kernel or operating system low-level hard-coded implementation of the function block library; Design philosophy: As the "immune system" of the system, ensure the most basic integrity and usability; Protection scope: Prevents systemic risks such as memory leaks, pointer errors, and resource exhaustion, ensuring that the system will not crash or enter an uncertain state due to fundamental errors.

[0062] Access control: Completely prohibit users from modifying, deleting, or blocking; error handling strategies, such as watchdog timers and system resets, can be fully fixed. b. Process safety error codes, such as fixed code values ​​and configurable behavior: Range: 0x20 - 0x3F (control loop, system status error), 0x40 - 0x4F (system maintenance error), etc. Fixed location: Predefined in the firmware of over-control safety function blocks (PID, AO, AI, ADD, etc.); Scope of protection: Ensuring the correct execution of specific control algorithms and process safety. Permission configuration: Error codes themselves are immutable; processing behavior is configurable.

[0063] Specific application examples are as follows: Engineer A, in a continuous process, sets the PID output saturation (0x20) to ALARM and requests operator intervention. Engineer B, during the batch process: downgraded the same error to WARNING, only making a record to avoid further issues; c. Project-level / user-defined error codes, fully extensible: Range: 0x50 - 0xFE; Implementation location: User-defined function block, script, graphical logic, or reserved; Scope of protection: Resolves project-specific process logic, equipment interlocks, and business rules; Permission configuration: Fully customizable error codes; custom severity levels and handling actions.

[0064] Specific application examples are as follows: 0xC1 = "Current of stirrer in reactor A exceeds limit"; The message can be set to WARNING or ALARM depending on the importance of the process. You can define processing actions such as triggering sequential shutdown or starting standby equipment.

[0065] 2. Error level definition and management strategies are shown in Tables 2-8: Table 2

[0066] 3. Status code structure: 0x[Category][Specific Error]: The high-order byte indicates the error category; the low-order byte indicates the specific error type.

[0067] 4. The detailed classification of the unified state coding is shown in Table 3. Table 3 Normal Status (0x00):

[0068] Table 4 Common operational errors (0x00-0x0F)

[0069]

[0070]

[0071] 2. Qualitative change effect: This invention creatively proposes replacing the scattered and information-poor flag bits with a unified, encoded "data validity status word," namely the BYTE value of the ERR pin. This is not merely a reduction in the number of pins, but a fundamental change in the nature of abnormal information, transforming it from "Boolean logic" to "diagnostic data."

[0072] Through precise coding design (e.g., 0x01 for NaN input, 0x02 for NAN / INF input, 0x03 for underflow, etc.), the ERR pin provides rich diagnostic information, enabling downstream functional blocks or systems to perform intelligent and differentiated fault handling. For example, for an input NAN, the value of the previous cycle can be used; for a fatal overflow, a safe shutdown state must be entered. This design achieves "safe fault propagation," allowing the system to take the most appropriate response strategy according to different fault types. This is a technological advancement that existing simple ERR mechanisms cannot achieve. It realizes "safe fault propagation."

[0073] 4. Deterministic behavior resulting from proactive prevention, real-time process monitoring, and decision output. Most existing technologies only address anomalies after they occur, by which time invalid data such as NANs may have already been generated and begun to spread virally, leading to unpredictable system behavior. This invention ensures that the core algorithm never executes under unsafe conditions and guarantees proactive and real-time anomaly handling through "multi-dimensional input verification" (prevention), "real-time monitoring and pre-computation" (process monitoring), and "decision output" (real-time processing).

[0074] This design transforms a potential "runtime exception" that could cause system crashes into a predictable and deterministic "local logic branch," achieving a significant technological breakthrough in converting "uncertainty risk" into "deterministic behavior." This ability to transform "uncertainty risk" into "deterministic behavior" is key to addressing the core pain point of "deterministic failure behavior" in SIS systems, demonstrating outstanding substantive characteristics and significant technological advancements.

[0075] Based on the above-described active defense method for safety function blocks in a safety instrumented system, some specific embodiments are given as follows: Example 1: Overall Architecture of Security Function Blocks like Figure 2 As shown, the security functional block proposed in this invention differs from the traditional "input-computation-output" model, and instead adopts an "input-governance-decision-output" model.

[0076] 1. Input phase: The function block receives data from the I area or the upstream function block.

[0077] 2. First-level governance (input validation): Pointer checking: For reference type inputs (such as structure pointers), system APIs, such as CheckMemoryRange, are called to determine whether the pointer is null or out of bounds. For example, if the input pointer points to the system kernel area, an error is immediately reported (ERR=0x10) to prevent memory corruption.

[0078] Numerical check: Checks whether the floating-point number is NaN or Inf as defined by IEEE 754.

[0079] 3. Second-level governance (pre-processing): For integer data, perform reverse analysis (see Example 2 for details).

[0080] For floating-point data, perform soft floating-point simulation (see Example 3 for details).

[0081] 4. Third-level governance (decision output): If there are no abnormalities in the first two layers, output the calculation results, and the ERR pin will output 0x00 (normal).

[0082] If an error occurs, the output will be determined by looking up the table based on the error type. For example, for a division-by-zero error (ERR=0x0B), the output will retain the value from the previous cycle; for an overflow error (ERR=0x02), the maximum value will be output (saturation handling).

[0083] Example 2: Reverse analysis pre-computation of integer operations Traditional addition directly executes `result = A + B`, but if an overflow occurs, it relies on a CPU flag, which can easily be ignored or trigger an interrupt. This invention uses... Figure 3 The logic shown: Assume A and B are positive integers, and the maximum value is MAX_INT.

[0084] Before performing the addition, check the following condition: if(A>MAX_INT-B).

[0085] If the condition is true, it means that A + B must exceed MAX_INT. In this case, the addition is not performed, and MAX_INT is returned directly. And set ERR=0x03 (overflow).

[0086] If the conditions are not met, then A+B can be executed safely.

[0087] Similarly, for multiplication, check if (A>MAX_INT / B). This method intercepts overflows in advance from a mathematical logic perspective, ensuring that core computation instructions are always executed within a safe range.

[0088] Example 3: Soft Floating-Point Monitoring in Floating-Point Operations like Figure 4 and Figure 5 As shown, this invention actively uses software to simulate floating-point operations on a processor with an FPU, with the aim of gaining "microscopic control" over the process.

[0089] Taking floating-point addition as an example, the steps of the soft floating-point algorithm are as follows: 1. Analysis: Extract the sign bit, exponent, and mantissa of A and B. At this point, a checkpoint is performed: if A is SNaN, return QNaN directly, ERR=0x01.

[0090] 2. Alignment: Calculate the exponent difference. At this point, checkpoint detection: if the exponent difference is greater than the mantissa width + 3, mark the risk of precision loss due to "large number eating small number" (ERR=0x50, warning level).

[0091] 3. Mantissa operations: Perform addition and subtraction.

[0092] 4. Normalization: Shift the last digit to the left or right.

[0093] 5. Rounding and Output: Before assembling the final float, check again whether the exponent exceeds 127 (single precision). If it does, return Inf, ERR=0x05 (overflow).

[0094] Example 4: Application of Unified State Coding (ERR) This invention defines the ERR pin as a BYTE type to achieve tiered alarms: 0x00: Normal.

[0095] 0x0B (divide by zero): If the downstream module detects this code, it can automatically switch to "manual mode" or use the default security value.

[0096] 0x20 (PID Saturation): When the downstream HMI receives this code, it only displays a yellow warning icon and does not trigger a shutdown.

[0097] 0x31 (Voting Failure): When the downstream interlocking module receives this code, it immediately triggers an emergency stop (ESD).

[0098] This coding mechanism enables "transparent transmission of faults," allowing the system to both survive (kernel-level protection) and be flexibly controlled (application-level strategy).

[0099] Through the above implementation methods, the present invention transforms unpredictable runtime anomalies into manageable deterministic logic, greatly improving the inherent security of industrial control systems.

[0100] This invention brings multi-dimensional technical advantages to industrial control systems through a fundamental shift in security paradigms, specifically in four core areas: system architecture, resource utilization, behavioral logic, and adaptability. Ultimately, this translates into significant efficiency improvements in engineering applications. 1. A fundamental shift in the security paradigm The shift from add-on protection to intrinsic security integrates data security governance into the core components of functional blocks, preventing the generation and spread of abnormal data at the source. This significantly reduces reliance on additional, passive protection layers and lays a foundation for a highly reliable architecture.

[0101] 2. Accurate fault diagnosis and efficient resource utilization A qualitative leap in diagnostic capabilities: Through a unified BYTE-type ERR status code, rich diagnostic information is provided, achieving a fundamental improvement in abnormal status from a single "Boolean identifier" to readable "diagnostic data", enabling downstream systems to perform intelligent and differentiated fault handling.

[0102] Significant resource optimization: Compared to the "multi-pin" solution, this invention combines multiple discrete abnormal signals into a single BYTE pin, effectively avoiding storage space waste caused by memory alignment rules, saving several bytes per instance. In large-scale configurations, the total savings are considerable. Furthermore, compared to the BOOL-type ERR solution which also occupies one byte, this solution achieves an exponential increase in diagnostic information without additional resource costs.

[0103] 3. Deterministic system behavior By employing "multi-dimensional input verification" (pre-emptive prevention), "real-time monitoring and pre-computation" (process monitoring), and a unique "decision output" mechanism, this solution constructs a complete closed-loop processing logic. This mechanism ensures that the core algorithm is never exposed to "unsafe" computational conditions and transforms unpredictable "runtime exceptions" into predictable and deterministic "local logic branches." This design brings three key benefits: Real-time performance guarantee: The "decision output" mechanism completes the judgment and output directly on the local machine, avoiding lengthy exception bubbling or context switching, and meeting the strict requirements of high real-time systems.

[0104] Lightweight processing: Anomalies are intercepted and handled at the source in real time, preventing the cascading propagation of abnormal signals and complex subsequent recovery processes, which greatly reduces the overall processing burden of the system.

[0105] Clear boundaries of responsibility: Each functional block is independently responsible for its input safety and output decisions, forming a clear chain of responsibility, which makes system debugging, problem tracing and the definition of authority and responsibility extremely clear.

[0106] 4. Flexible system adaptability It can formulate differentiated security output strategies for different functional block types. This strategy takes into account international standards, industry practices and field feedback, so as to accurately balance the needs of security and functionality in various application scenarios.

[0107] Based on the aforementioned core technological advantages, this solution has demonstrated the following outstanding effects in specific engineering practices: 5. Significantly improved configuration efficiency In the configuration phase, this solution requires only four pins and one BOX block operation per functional block instance, while the traditional solution requires an average of seven pins. Experiments show that in large-scale configuration scenarios, this solution can reduce the overall configuration workload by approximately 37.5%, effectively alleviating the repetitive configuration burden on engineers.

[0108] 6. The speed of anomaly localization has been greatly improved. Thanks to its integrated anomaly identification and alerting mechanism, this solution enables rapid and accurate fault location. In a typical division-by-zero anomaly test, the traditional step-by-step backtracking method may take several minutes, while this solution can achieve instantaneous response, improving location efficiency by up to 100 times under extreme conditions.

[0109] 7. Engineer-friendly, effectively reducing labor costs. For novice engineers: The solution has a clear and intuitive structure, which greatly reduces the learning and usage threshold, enabling them to quickly participate in projects and independently troubleshoot problems, shortening the training cycle and reducing the risk of staff turnover.

[0110] For senior engineers: The fast response mechanism of the ERR pin frees them from tedious manual verification, allowing them to focus more on system architecture and complex logic design, improving efficiency and implementation quality in large and complex projects.

[0111] In summary, this invention is particularly suitable for industrial control systems (such as Safety Instrumented Systems (SIS), Programmable Logic Controllers (PLCs)) that are resource-constrained and have extremely high reliability requirements. Through its inherent security, accurate diagnostics, resource efficiency, and behavioral determinism, it provides an advanced and practical security technology foundation for critical infrastructure.

[0112] The second aspect of the present invention discloses an active defense system for safety function blocks in a safety instrumented system. Figure 7 This is a structural diagram of a safety function block active defense system for a safety instrumented system according to an embodiment of the present invention; as follows: Figure 7 As shown, the system employs the method described in any of the first aspects, and the system 100 includes: The input validation module 101 is used to perform mandatory checks on the pointer validity and numerical legality of the input data before the algorithm is executed; The pre-computation processing module 102 is used to perform reverse analysis pre-computation and soft floating-point pre-computation. It monitors the risks of overflow, division by zero and illegal values ​​in real time during the operation process by embedding checkpoints in the operation steps. The decision output module 103 is used to control the function block to output a determined safety value or normal calculation value based on the verification and pre-calculation results, and to generate a unified status code of byte type. Interface unit 104 includes a data input pin, a data output pin, and an ERR pin for outputting the unified status code.

[0113] A third aspect of this invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the active defense method for a safety functional block in a safety instrumented system according to any one of the first aspects of this invention.

[0114] Figure 8 This is a structural diagram of an electronic device according to an embodiment of the present invention, such as... Figure 8As shown, the electronic device includes a processor, memory, communication interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, Near Field Communication (NFC), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.

[0115] Those skilled in the art will understand that Figure 8 The structure shown is merely a structural diagram of the part related to the technical solution of this disclosure and does not constitute a limitation on the electronic device to which the solution of this application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0116] A fourth aspect of this invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a proactive defense method for a safety instrumented system's security function blocks according to any one of the first aspects of this invention.

[0117] Please note that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for active defense of safety function blocks in a safety instrumented system, characterized in that, The method is applied to the controller of an industrial control system. The security function block incorporates a data security governance process during execution, which includes the following steps: Step S1: Multi-dimensional input verification; Before executing the core algorithm, a mandatory check is performed on all input data of the security function block, including pointer security check and numerical domain check; if the check fails, proceed directly to step S3; Step S2: Real-time monitoring and pre-computation; If the check in step S1 passes, proceed to the pre-computation stage; Depending on the type of input data, select to execute the reverse analysis pre-computation algorithm or the soft floating-point pre-computation algorithm; Set real-time monitoring points in each step of the pre-computation; Once an abnormal risk of operation is detected, immediately terminate the operation and generate the corresponding abnormal status flag, and jump to step S3; If the pre-computation is completed normally, generate the normal operation result. Step S3: Decision Output and Status Encoding; Based on the execution result of step S1 or step S2, a deterministic output strategy is executed, and the calculation result or preset safety value is output through the output pin. Simultaneously, a unified status code ERR is output through a dedicated status pin. The unified status code is used to indicate the current operating status and anomaly type of the safety function block.

2. The method according to claim 1, characterized in that, In step S2, when the input data is integer data, the reverse analysis pre-operation algorithm is executed, specifically including: By utilizing the overflow and underflow limits of data types, arithmetic operations are transformed into comparison operations based on these limits, allowing for a prediction of whether the operation result will overflow before the actual arithmetic operation is performed. If the predicted result does not overflow, then perform the actual arithmetic operation and output the result; If the predicted result overflows, the actual arithmetic operation that might cause the overflow will not be performed. Instead, the saturation value of the data type will be returned directly, and the corresponding overflow exception status will be marked.

3. The method according to claim 1, characterized in that, In step S2, when the input data is floating-point data, the soft floating-point pre-computation algorithm is executed, specifically including: Instead of directly calling the instructions of the hardware floating-point unit (FPU) for blind calculation, it follows the IEEE 754 standard and parses floating-point numbers through bit pattern analysis. Multiple error checkpoints are injected into the input parsing stage, the operation execution stage, and the result processing stage of floating-point operations, respectively. At each error checkpoint, check whether the intermediate data contains invalid operands NaN, infinite Inf, denormalized numbers, risk of division by zero, or risk of precision loss. If any checkpoint detects an anomaly, subsequent operations are immediately halted, and the corresponding abnormal data and anomaly status identifier are returned.

4. The method according to claim 3, characterized in that, The error checkpoints include at least: Input parsing checkpoints: used to detect signals NaN or SNaN, silent NaN or QNaN, and denormalized numbers; Operation execution checkpoints: During mantissa alignment, mantissa operation and exponent operation, detect excessive exponent difference, loss of alignment precision, abnormal subtraction to zero and exponent overflow prediction. Results processing checkpoints: During normalization and rounding, detect normalization failures, overflows caused by rounding, and overflows or underflows in the final result.

5. The method according to claim 1, characterized in that, In step S3, the unified state code (ERR) is a one-byte value of type Byte, and its encoding structure adopts a layered architecture, including: Kernel security layer coding: embedded in the system's underlying layer, used to identify system survival-level errors, including invalid input, division by zero, memory errors, and pointer out-of-bounds errors; Process safety layer coding: used to identify control logic and process safety level errors, including PID output saturation, actuator failure, and safety interlock triggering; Project application layer coding: Open to user customization, used to identify specific process logic or equipment interlock status.

6. The method according to claim 1, characterized in that, The deterministic output strategy in step S3 is specifically as follows: When an invalid input, floating-point error or division by zero error is detected, the output pin retains the valid value of the previous cycle or outputs the preset safety guide value, and the status pin outputs the corresponding alarm code. When an integer overflow is detected, the output pin outputs the boundary value of the data type, and the status pin outputs the corresponding warning code; When a system-level fatal error is detected, the output pin outputs a fault-safe value, the status pin outputs a fault code, and triggers system-level interlocking.

7. The method according to claim 1, characterized in that, The pointer safety check in step S1 specifically includes: calling the runtime environment API to obtain the allocated safe memory region range, determining whether the input pointer is not null and points to the safe memory region, and checking whether the length of the data pointed to by the pointer is out of bounds.

8. A safety functional block active defense system for a safety instrumented system, said system employing the method described in any one of claims 1-7, characterized in that, The system includes: The input validation module is used to perform mandatory checks on the pointer validity and numerical legality of the input data before the algorithm is executed; The pre-computation processing module is used to perform reverse analysis pre-computation and soft floating-point pre-computation. It monitors the risks of overflow, division by zero and illegal values ​​in real time during the operation process by embedding checkpoints in the operation steps. The decision output module is used to control the function block to output a determined safe value or normal calculated value based on the verification and pre-calculation results, and to generate a unified status code of byte type. The interface unit includes a data input pin, a data output pin, and an ERR pin for outputting the unified status code.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the active defense method for a safety functional block of a safety instrumented system according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the active defense method for a safety functional block of a safety instrumented system according to any one of claims 1 to 7.

Images