Layered communication method and system for large stamping production line based on virtual local area network

Abstract

The application relates to the technical field of industrial communication networks, and particularly provides a large-scale stamping production line layered communication method and system based on a virtual local area network, which comprises the following steps: dividing a production line network into a device layer, a control layer and an information layer, and allocating an independent virtual local area network to each layer to realize logical isolation; the device layer adopts a time-sensitive network to provide nanosecond-level synchronization and deterministic scheduling; the control layer guarantees the priority transmission of cooperative instructions by combining a publish / subscribe mode with a quality of service strategy; and the information layer deploys a firewall and an edge computing gateway to realize safe data reporting and zero-trust remote maintenance. The application can limit single-point network faults within a unit, avoid the paralysis of the whole line, guarantee the hard real-time performance of control instructions, effectively prevent unauthorized access, and significantly improve the reliability, safety and operation efficiency of a large-scale stamping production line.

Description

Technical Field

[0001] This invention belongs to the field of industrial communication network technology, specifically relating to a hierarchical communication method and system for a large-scale stamping production line based on a virtual local area network. Background Technology

[0002] In the traditional network architecture of large-scale stamping production lines, all control units are usually interconnected through a flat industrial Ethernet. This unified network model has exposed several key technical problems in actual operation.

[0003] The reliability of the network faces severe challenges. Failure of any node device (such as the PLC or HMI of a press) or network loop may trigger a broadcast storm, causing communication interruption and emergency equipment shutdown of the entire production line, resulting in huge economic losses.

[0004] Therefore, there is an urgent need for an innovative network architecture and control method to solve the aforementioned reliability, real-time performance and maintainability challenges, and to meet the high stability and high efficiency requirements of modern large-scale automated stamping production lines. Summary of the Invention

[0005] In view of the above-mentioned shortcomings of the prior art, the present invention provides a hierarchical communication method and system for a large-scale stamping production line based on virtual local area network to solve the above-mentioned technical problems.

[0006] In a first aspect, the present invention provides a hierarchical communication method for a large-scale stamping production line based on a virtual local area network, comprising: The industrial network of a large stamping production line is divided into an equipment layer network, a control layer network, and an information layer network. Independent virtual local area networks are allocated to the equipment layer network, the control layer network, and the information layer network respectively to achieve logical isolation between the three layers. The real-time control devices within a single press unit are distributed to the device layer network to achieve closed-loop real-time control within the unit; The overall control equipment and the collaborative control equipment of each press unit are allocated to the control layer network to realize the collaborative control and status interaction of the entire line; Data acquisition servers, maintenance terminals, and factory management network equipment are allocated to the information layer network to achieve non-real-time data acquisition and remote maintenance; Configure routing control policies to control cross-layer communication between the device layer network, the control layer network, and the information layer network.

[0007] In an optional implementation, the device layer network uses a time-sensitive networking protocol for data transmission, and the method further includes: Time synchronization is performed within the device layer network. Configure planned traffic scheduling based on IEEE 802.1Qbv for periodic critical control commands, and configure frame preemption mechanism based on IEEE 802.1Qbu for the highest priority security signals triggered by events.

[0008] In an optional implementation, time synchronization within the device layer network includes: Among the time-sensitive network-enabled switches and terminal devices included in the device layer network, one device is automatically elected as the best master clock for the device layer network based on the IEEE 802.1AS-Rev protocol or the gPTP protocol. The optimal master clock periodically sends synchronization and follow messages to all other slave clock devices in the device layer network, wherein the synchronization message carries the precise transmission timestamp of the optimal master clock; After receiving the synchronization message and follow message from the clock device, the precise reception timestamp of the message is recorded, and the clock offset between the message and the optimal master clock is calculated based on the transmission timestamp and reception timestamp. The slave clock device and the optimal master clock measure and calculate the path delay between them by exchanging peer delay request messages and peer delay response messages. The slave clock device corrects and adjusts its local slave clock based on the clock offset and the path delay, so that the clocks of all devices in the device layer network can achieve high-precision synchronization with the optimal master clock at the nanosecond or submicrosecond level.

[0009] In an optional implementation, the control layer network employs a publish / subscribe communication model for collaborative data transmission across virtual local area networks, and the method further includes: Configure the central control device as the publisher and configure the collaborative control devices of each press unit as subscribers; The publisher publishes the entire line of collaborative instructions to a predetermined topic, and the subscriber receives the collaborative instructions by subscribing to the topic. The publish / subscribe communication is mapped to a time-sensitive network multicast stream, and a bandwidth reservation or time scheduling policy is configured for the multicast stream on the core switch.

[0010] In an optional implementation, the information layer network uses edge computing and message queue telemetry transmission protocol for data aggregation and reporting, and the method further includes: An edge computing gateway is deployed between the control layer network and the information layer network; The edge computing gateway collects raw production data from the control layer network through an open platform communication unified architecture protocol. The edge computing gateway cleans, aggregates, compresses, or converts the format of the collected raw data to generate processed data. The edge computing gateway, acting as the publisher of the message queue telemetry transmission protocol, pushes the processed data to the message broker server deployed in the information layer network through the encrypted port that is the only one open in the firewall.

[0011] In an optional implementation, the information layer network also provides a remote secure maintenance channel, and the method further includes: Configure a remote access proxy service on the edge computing gateway; The remote access proxy service proactively establishes a reverse encrypted tunnel with the maintenance terminal located in the information layer network; When the maintenance terminal needs to access the target device in the control layer network, its maintenance request is sent directly to the edge computing gateway through the established reverse tunnel. After receiving the maintenance request, the edge computing gateway parses, authenticates, and performs authorization checks on the request. After successful authentication, the edge computing gateway acts as a proxy client to initiate a new connection to the target device in the control layer network and forwards the maintenance request to the target device. The response data returned by the target device is transmitted back to the maintenance terminal via the edge computing gateway through the established reverse encryption tunnel; Specifically, no inbound rules are configured in the firewall's access control list to allow direct access from the information layer network to the target device in the control layer network.

[0012] In an optional implementation, the remote access proxy service proactively establishes a reverse encrypted tunnel with the maintenance terminal located in the information layer network, including: The remote access proxy service on the edge computing gateway runs continuously as a daemon process and actively initiates an outbound, encrypted long connection to the heartbeat port located on the maintenance terminal itself, thereby establishing the reverse encrypted tunnel.

[0013] In one optional implementation, a routing control policy is configured, including: Deploy a firewall between the information layer network and the control layer network; Configure a rule on the firewall that by default blocks all access from the information layer network to the control layer network; Configure fine-grained allow rules on the firewall, which specify one or more source Internet Protocol addresses, one or more destination communication ports, and one or more communication protocols that are allowed to pass through. The request is only allowed to enter the control layer network from the information layer network if the access request matches the specified source address, destination port, and protocol.

[0014] In an optional implementation, the method further includes: Within the device layer network, a time-aware shaper and frame preemption mechanism are configured based on the Time-Sensitive Networking Protocol (TSCP) to allocate dedicated transmission time windows within a period for different types of real-time data streams, and to allow high-priority control frames to interrupt the transmission of low-priority long frames. On the core switch of the control layer network, critical collaborative instruction messages across VLANs are marked as the highest priority and mapped to the strict priority queue, while communication messages between operator stations and PLCs within the same VLAN are marked as lower priority and mapped to the guaranteed bandwidth queue. On the firewall between the information layer network and the control layer network, a bandwidth limit is set for traffic from the information layer to the control layer, and data traffic reported by the edge gateway from the control layer to the information layer is marked with high priority.

[0015] Secondly, the present invention provides a hierarchical communication system for a large-scale stamping production line based on a virtual local area network, comprising: The device layer network is configured to contain real-time control devices within a single press unit and has an independent first virtual local area network for implementing closed-loop real-time control within the unit. The control layer network is configured to include the overall line control equipment and the collaborative control equipment of each press unit, and has an independent second virtual local area network for realizing the collaborative control and status interaction of the entire line. The information layer network is configured to include data acquisition servers, maintenance terminals, and factory management network equipment, and has an independent third virtual local area network for non-real-time data acquisition and remote maintenance. The routing control module is configured to allow or disable cross-layer communication between the device layer network, the control layer network, and the information layer network.

[0016] The beneficial effects of this invention are that the layered communication method and system for large-scale stamping production lines based on virtual local area networks (VLANs) provided by this invention offer a three-layer network architecture for stamping production lines based on VLANs. Through strict logical isolation between the equipment layer, control layer, and information layer, reliable fault isolation is achieved. When any press unit experiences a network broadcast storm or other fault, its impact is strictly limited to its respective VLAN and cannot spread to the entire line, thereby avoiding a single point of failure leading to a complete line shutdown and greatly improving the availability of the communication network and production continuity. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a schematic flowchart of a method according to an embodiment of the present invention.

[0019] Figure 2 This is a topology diagram of a layered communication architecture according to an embodiment of the present invention.

[0020] Figure 3 This is a schematic diagram illustrating network traffic priority protection according to an embodiment of the present invention.

[0021] Figure 4 This is a schematic diagram of VLAN fault isolation according to an embodiment of the present invention.

[0022] Figure 5 This is a schematic flowchart illustrating an application scenario of one embodiment of the present invention.

[0023] Figure 6 This is a schematic block diagram of a system according to an embodiment of the present invention. Detailed Implementation

[0024] To enable those skilled in the art to better understand the technical solutions of this invention, the technical solutions of the embodiments of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this invention.

[0025] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention.

[0026] The hierarchical communication method for a large-scale stamping production line based on virtual local area networks provided in this embodiment of the invention is executed by a computer device, and correspondingly, the hierarchical communication system for a large-scale stamping production line based on virtual local area networks runs on the computer device.

[0027] Figure 1 This is a schematic flowchart illustrating a method according to an embodiment of the present invention. Wherein, Figure 1 The executing entity can be a hierarchical communication system for a large-scale stamping production line based on a virtual local area network. Depending on different requirements, the order of steps in this flowchart can be changed, and some can be omitted.

[0028] like Figure 1 As shown, the method includes: S1. Divide the industrial network of the large stamping production line into an equipment layer network, a control layer network, and an information layer network, and allocate independent virtual local area networks to the equipment layer network, the control layer network, and the information layer network respectively to achieve logical isolation between the three layers of networks; S2. Distribute the real-time control devices within a single press unit to the device layer network to achieve closed-loop real-time control within the unit; S3. Assign the overall control equipment of the production line and the collaborative control equipment of each press unit to the control layer network to realize the collaborative control and status interaction of the entire production line; S4. Assign the data acquisition server, maintenance terminal and factory management network equipment to the information layer network to realize non-real-time data acquisition and remote maintenance; S5. Configure routing control policies to control cross-layer communication between the device layer network, the control layer network, and the information layer network.

[0029] The following, with reference to the accompanying drawings, uses a large-scale automated stamping production line consisting of 5 presses (P1, P2, P3, P4, P5), 1 central control PLC (hereinafter referred to as LM), HMIs of each operator console, and a remote IoT server as an example to provide a detailed description of the hierarchical communication method for a large-scale stamping production line based on a virtual local area network provided by the present invention. Figure 2 The system architecture and network topology diagram of this embodiment are shown.

[0030] I. System Hardware Configuration and Network Division First, hardware deployment and VLAN segmentation are carried out according to the three-layer architecture of "device layer - control layer - information layer".

[0031] 1. Device-level network configuration Build an independent device-level network for each press unit. Taking unit P1 as an example: connect the P1 PLC's X1 interface, the P1 workbench frequency converter, distributed I / O stations, and field sensors such as high-precision encoders to an industrial switch (such as the SCALANCE XC-200 series) that supports Time-Sensitive Networking (TSN) via a star topology. This switch forms the core of the P1 device-level network. The same applies to other press units (P2-P5).

[0032] Plan an independent IP subnet for this device layer network (e.g., 192.168.10.0 / 24 for P1 device layer), and assign an independent VLAN (e.g., VLAN 1010) on the management switch. This VLAN is strictly confined within this unit and does not engage in Layer 2 switching with any other network, achieving both physical and logical isolation.

[0033] 2. Control Layer Network Configuration Deploy one or more high-performance core switches (such as the SCALANCE XR-500 series) that support TSN and Layer 3 routing. On this core switch, create independent VLANs and IP subnets for each control unit: VLAN 10, IP network segment 10.10.10.0 / 24, is used for the P1 control layer (connecting the X2 interface of the P1 PLC and the P1 operator console HMI). VLAN 20, IP network segment 10.10.20.0 / 24, is used for P2 control layer; VLANs 30, 40, and 50 are used for the P3, P4, and P5 control layers, respectively. VLAN 100, IP network segment 10.10.100.0 / 24, is used for the master control unit LM (connecting the X2 interface of the LM PLC and the central monitoring HMI).

[0034] Enable Layer 3 routing on the core switch and configure a virtual interface (SVI) as the default gateway for each VLAN to achieve controlled IP routing communication between different VLANs.

[0035] 3. Information Layer Network Configuration Create a separate information layer VLAN (e.g., VLAN 200, IP network segment 172.16.200.0 / 24). Connect the remote IoT server, maintenance engineer station, and factory management network to this VLAN.

[0036] Deploy an industrial firewall (such as the SCALANCE SC-600 series) between the information layer and the control layer. The firewall's WAN port connects to information layer VLAN 200, and its LAN port connects to the uplink port of the control layer core switch. The firewall's default policy is configured to "block all access from the information layer to the control layer".

[0037] Deploy an industrial edge computing gateway (such as a PC-based SIMATIC IPC) inside the control layer network (inside the firewall). This gateway subscribes to the production data of PLCs (including LM and P1-P5) in each VLAN through an OPC UA client.

[0038] II. Software Configuration and Key Mechanism Configuration 1. Device-level TSN time synchronization and deterministic scheduling Within the device layer network of each press unit, perform the following configuration: Time Synchronization: The IEEE 802.1AS-Rev (gPTP) protocol is enabled on TSN switches and terminal devices. After system power-on, each device automatically elects the best master clock (Grandmaster) for its unit. The best master clock periodically sends synchronization and follow messages. Slave clock devices measure path delay by exchanging peer delay request / response messages and correct according to clock offset, ultimately achieving nanosecond-level high-precision time synchronization for all devices within the unit.

[0039] Flow Scheduling: Configure flow identification rules on the ingress port of the TSN switch. Identify servo loop control commands (1ms period) as Stream A, safety I / O signals (2ms period) as Stream B, and process data (4ms period) as Stream C. Configure an IEEE 802.1Qbv-based Time Aware Shaper (TAS) on the switch's output port, setting a 1ms scheduling period and assigning the following gating list: 0-200μs: Open only the gates of Stream A queue; 200-300μs: Close Stream A and open the door to Stream B queue; 300-1000μs: Opens the queue gate for Stream C and best-effort traffic.

[0040] At the same time, the IEEE 802.1Qbu frame preemption mechanism is enabled, allowing high-priority servo control frames to interrupt low-priority long frames that are being transmitted.

[0041] 2. Control layer publish / subscribe communication and QoS guarantee Integrate OPC UA Pub / Sub functionality into the master control PLC (LM) and each press PLC. Configure the LM as the publisher of global commands (such as "Cycle Start" and "Line Speed"), and configure PLCs P1-P5 as subscribers. The publisher publishes line-wide coordination commands to predefined topics (such as "Line / Command"), and subscribers receive commands by subscribing to these topics. Map this publish / subscribe communication as a TSN multicast stream and configure bandwidth reservations for it on the core switch.

[0042] Configure the DSCP / CoS mapping to queues on the core switch: Mark OPC UA Pub / Sub cooperative command messages as DSCP 46 (EF, accelerated forwarding) or VLAN priority 7 and map them to a strict priority queue (PQ) that sends them with absolute priority.

[0043] Mark the S7 communication message between the HMI and PLC as priority 4, map it to the guaranteed bandwidth queue (CBWFQ), and allocate 30% of the guaranteed bandwidth to it.

[0044] Other administrative traffic is mapped to the default queue.

[0045] 3. Information Layer Firewall Policies and Edge Gateways Configure fine-grained allow rules on the firewall to permit only access requests that meet the following criteria: Access requests whose source IP belongs to the preset whitelist (such as the IP of a specific maintenance engineer station) and whose destination port is TCP 102 (S7 protocol) or TCP 80 / 443 (HTTP / HTTPS) can enter the control layer from the information layer. The edge gateway's IP (fixed address) is allowed to initiate outbound connections to the MQTT Broker in the information layer via TCP port 8883 (MQTTS encrypted connection), but reverse inbound connections are not allowed.

[0046] Configure on the edge gateway: Data from each PLC is subscribed to via the OPC UA client, and then cleaned, aggregated, and compressed locally (e.g., calculating millisecond-level vibration data into effective values ​​per second), and organized in Sparkplug B format.

[0047] As an MQTT publisher, the processed data is pushed to the MQTT Broker (IP: 172.16.200.100) in the information layer VLAN via an established encrypted outbound connection. The IoT server, as a subscriber, retrieves data from the Broker.

[0048] The following is a specific embodiment of a large-scale automated stamping production line, which provides a detailed description of the hierarchical communication method for large-scale stamping production lines based on virtual local area networks provided by the present invention. This embodiment takes a stamping production line containing 5 presses (P1, P2, P3, P4, P5), 1 central control PLC (hereinafter referred to as LM), HMIs for each operator console, a remote IoT server, and a maintenance engineer station as an example.

[0049] I. Overall Architecture and Network Partitioning First, the industrial network of the entire stamping production line is divided into three logical layers: the equipment layer network, the control layer network, and the information layer network. On the managed switches, an independent Virtual Local Area Network (VLAN) is assigned to each layer, thereby achieving logical isolation between the three layers. Specifically: Device layer network: An independent VLAN is built within each press unit (e.g., P1 device layer VLAN 1010, P2 device layer VLAN 1020, and so on) to connect the PLC's X1 port, servo drives, distributed I / O, encoders, and other real-time control devices within the unit. This network only enables closed-loop real-time control within the unit and does not directly communicate with other units at Layer 2.

[0050] Control Layer Network: Create VLANs 10-50 corresponding to control layer communication of P1-P5 respectively, and VLAN 100 for the central control LM. Connect the X2 ports of each press PLC, the X2 port of the central control PLC, and each operator console HMI to the corresponding VLAN. This network is responsible for overall line coordinated control, status interaction, and safety signal transmission.

[0051] Information layer network: Create a separate VLAN 200 to connect the remote IoT server, maintenance engineer station, and factory management network devices to this VLAN. This network is used for non-real-time data acquisition, remote monitoring, and program maintenance.

[0052] Enable Layer 3 routing on the core switch, configure a virtual interface (SVI) as the default gateway for each VLAN, and configure routing control policies to control cross-layer communication between Layer 3 networks. By default, all unauthorized access is prohibited; only necessary cross-layer traffic is allowed to pass through, such as maintenance stations in the information layer accessing the PLC in the control layer through a specific port, or IoT servers reading control layer data via the OPC UA protocol.

[0053] II. Device-level Network: Hard Real-Time Guarantee Based on TSN The device layer network is the core of real-time control within the press unit. To meet the requirements of nanosecond-level synchronization and deterministic delay for servo drives and encoder feedback, this embodiment employs the Time-Sensitive Networking (TSN) protocol in the device layer network and specifically implements high-precision time synchronization, planned flow scheduling, and frame preemption mechanisms.

[0054] (a) High-precision time synchronization Within the device layer network of each press unit, nanosecond-level time synchronization is achieved based on the IEEE 802.1AS-Rev (gPTP) protocol. Taking unit P2 as an example: after the TSN-enabled switches and terminal devices (PLCs, drives, encoders) are powered on, they automatically elect the best master clock (Grandmaster) for this unit, for example, setting the P2 PLC as the priority master clock. The best master clock periodically (e.g., every 125μs) sends synchronization messages (Sync) and follow messages (Follow_Up) to all slave clock devices, where the synchronization message carries the precise transmission timestamp t1 of the master clock. The slave clock devices record the precise reception timestamp t2 of the synchronization message and parse t1 in the follow message to initially calculate the clock offset. Subsequently, the slave clock devices and the best master clock exchange peer delay request messages (Pdelay_Req) ​​and peer delay response messages (Pdelay_Resp), measure the link round-trip delay and divide by two to obtain the one-way path delay. Finally, the clock device adjusts its local clock frequency and phase using hardware timestamps based on clock skew and path delay, ensuring that the clocks of all devices within the unit are synchronized with the optimal master clock at nanosecond or sub-microsecond precision. This synchronization benchmark lays the foundation for subsequent deterministic scheduling.

[0055] (II) Planned Traffic Scheduling and Frame Preemption On the TSN switch in the device layer network, configure a Time Aware Shaper (TAS) based on IEEE 802.1Qbv and a frame preemption mechanism based on IEEE 802.1Qbu. First, at the switch's ingress port, different types of data streams are identified using MAC address, VLAN ID, Ethernet type, etc.: for example, servo loop control commands (1ms period) are identified as Stream A (ultra-high priority), safety gate status and emergency stop signals (event-triggered) are identified as Stream B (highest priority), and process data (temperature, pressure, etc., 4ms period) are identified as Stream C. Then, a 1ms scheduling period is set at the output port, and a gating list is defined: within a 0-200μs window, only the transmit gate for Stream A queue is opened, and all other queues are closed, ensuring that servo control commands are transmitted within a dedicated, undisturbed time window; within a 200-300μs window, Stream A is closed, and the gate for Stream B queue is opened for transmitting safety signals; within a 300-1000μs window, the gates for Stream C and best-effort traffic are opened. Simultaneously, 802.1Qbu frame preemption is enabled, setting Stream B as a "fast frame" among preemptible frames, while other long frames are "preemptible frames." When Stream B (such as an emergency stop signal) arrives, if the port is sending a long log frame, the switch immediately interrupts the transmission of that long frame, prioritizing the transmission of Stream B. After transmission is complete, long frame transmission resumes from the point of interruption. Through this configuration, critical control flows obtain exclusive, deterministic transmission resources within a cycle, and the latency limit of the highest priority security signal is compressed to the microsecond level, completely resolving the unpredictable latency problem caused by the traditional QoS "best-effort" approach.

[0056] III. Control Layer Network: Collaborative Communication and QoS Guarantee under VLAN Isolation The control layer network is responsible for the coordinated control and status interaction between the overall control unit and each press unit, as well as the communication between the operator station and the PLC. This embodiment employs a publish / subscribe communication model at the control layer, combined with VLAN isolation and DiffServ QoS policies, to achieve efficient, reliable, and bandwidth-guaranteed coordinated data transmission.

[0057] (a) Publish / subscribe communication based on OPC UA Pub / Sub To overcome the low efficiency and high bandwidth consumption of traditional client / server models when the central control unit broadcasts commands to multiple standalone machines, this embodiment integrates OPC UA Pub / Sub functionality into the central control PLC (LM) and each pressure machine PLC. The LM is configured as a publisher, defining the topic "Line / Command"; PLCs P1 to P5 are configured as subscribers, subscribing to the same topic. When the operator clicks "Start" on the central HMI, the LM encapsulates the start command (including tick, program number, etc.) into an OPC UA message and publishes it to the topic. To ensure deterministic transmission of this cross-VLAN multicast stream, the publish / subscribe communication is mapped to a TSN multicast stream on the core switch, and the IEEE 802.1Qat stream reservation protocol is configured for it, reserving bandwidth on the relevant ports; simultaneously, IEEE 802.1Qbv is configured to allocate a dedicated time window (e.g., reserving a 100μs window every 2ms period) for this multicast stream on the cross-VLAN forwarding path. Each subscriber (P1~P5 PLC) receives the instruction simultaneously within the predetermined time window, and after parsing, starts its own pressing program synchronously, achieving high-precision coordination of the entire line.

[0058] (ii) QoS guarantee based on DiffServ Besides critical coordination commands, the control layer network also includes process data refresh and diagnostic traffic between the HMI and PLC. To prevent these traffic streams from preempting bandwidth for coordination commands, a differential service (DiffServ) policy is configured on the core switch: critical coordination command messages across VLANs (such as OPC UA Pub / Sub multicast streams) are marked with a DSCP value of 46 (corresponding to VLAN priority 7) and mapped to a strict priority queue (PQ). This queue is sent with absolute priority, and other queues are only served when the queue is empty. S7 communication messages between operator stations and PLCs within the same VLAN are marked with a DSCP value of 34 (priority 4) and mapped to a guaranteed bandwidth queue (CBWFQ), allocating 30% of the port bandwidth to it. Other diagnostic and log traffic is sent to the default best-effort queue. In this way, even during network congestion, critical coordination commands can receive the highest priority forwarding guarantee.

[0059] IV. Information Layer Networks: Security Isolation and Edge Data Convergence The information layer network connects the IoT server, maintenance engineer workstation, and factory management network, primarily undertaking non-real-time data acquisition, remote maintenance, and upper-layer system integration. To prevent unauthorized access or attacks from the information layer from affecting the control layer, this embodiment deploys a firewall between the information layer and the control layer, and deploys an edge computing gateway within the control layer, achieving the dual goals of "secure isolation" and "intelligent data aggregation."

[0060] (a) Fine-grained firewall access control Deploy an industrial firewall between VLAN 200 at the information layer and the core switch at the control layer. The first rule configured on the firewall is to deny all access from the information layer to the control layer by default. Based on this, create more refined allow rules that only allow access if the access request matches a preset source IP address, destination port, and protocol. For example: Allow traffic with the source IP address of the maintenance engineer station (172.16.200.50) and the destination port of TCP 102 (S7 protocol) to access the PLC on the specified network segment; Allow traffic with the source IP address of the IoT server (172.16.200.51) and the destination port of TCP 4840 (OPC UA) to access all control layer devices; Allow traffic with a source IP address of the jump server (172.16.200.52) and a destination port of TCP 22 (SSH) to access the edge gateway.

[0061] All other traffic is rejected and logged. This "default rejection + whitelist" strategy implements the principle of least privilege, effectively blocking unauthorized access and lateral movement attacks.

[0062] (ii) Edge computing and MQTT data reporting In traditional methods, direct polling of PLCs by the IoT server consumes significant PLC resources, and the massive amount of raw data can easily cause network congestion. Therefore, this embodiment deploys an industrial edge computing gateway within the control layer network (inside the firewall). This gateway, acting as an OPC UA client, subscribes to production data (such as equipment status, output counts, vibration waveforms, etc.) from PLCs (LM and P1~P5) in each VLAN via the routing function of the control layer core switch, with a collection period of 100ms. The gateway processes the raw data locally: cleaning outliers, aggregating (calculating the effective and peak values ​​of the vibration waveforms per second), compressing (using the LZ4 algorithm), and encapsulating it into JSON format according to the Sparkplug B specification, giving the data semantic meaning (e.g., "pressure": {"value": 12.5, "unit": "MPa"}). The processed data volume is typically only 1% to 5% of the original data.

[0063] Deploy an MQTT Broker (such as EMQX) in VLAN 200 of the information layer. Configure an outbound allow rule on the firewall: allow the edge gateway's IP (172.16.10.100) to actively connect to the Broker's IP (172.16.200.100) via TCP port 8883 (MQTTS encrypted). The edge gateway, acting as an MQTT publisher, pushes processed data to the corresponding topic on the Broker (e.g., " / factory / line1 / press / p2 / status"). IoT servers, MES systems, and other systems, acting as MQTT subscribers, retrieve data from the Broker. This architecture offloads the data acquisition and processing load from the PLC to the edge gateway, significantly reducing network bandwidth consumption, and facilitates direct parsing and use by IT systems through the standardized MQTT+Sparkplug B protocol.

[0064] V. Remote Security Maintenance Channel To enable remote maintenance without exposing control layer devices, this embodiment configures a remote access proxy service on the edge computing gateway and provides secure access through a reverse encrypted tunnel. The specific process is as follows: The remote access agent service on the edge gateway runs continuously as a daemon, proactively initiating an outbound, encrypted, long-lived connection (using TLS 1.3) to a preset heartbeat port (such as TCP 8443) of the jump server located in VLAN 200 of the information layer (or directly to the maintenance engineer's terminal), thereby establishing a reverse encrypted tunnel. This tunnel maintains a persistent connection and is periodically maintained by sending heartbeat packets.

[0065] When a remote expert needs to access VLAN 200 in the information layer via VPN to diagnose a stress test machine (e.g., a P3 PLC), the expert first logs into the jump server and then uses maintenance software (such as TIA Portal) on the jump server to attempt to connect to the P3 PLC (IP: 10.10.30.10). However, this connection request is not sent directly to the P3 PLC, but is configured to be sent to the proxy service address of the edge gateway. After receiving the request, the edge gateway first performs authentication (checking the certificate or API key) and authorization (confirming that the expert has permission to access the P3 PLC). After successful authentication, the edge gateway, acting as a proxy client, proactively initiates a new TCP connection (using the S7 protocol, port 102) to the P3 PLC in the control layer network and forwards the expert's maintenance request (such as uploading a program) to the P3 PLC. The response data returned by the P3 PLC is sent back to the jump server by the edge gateway through the established reverse encrypted tunnel and finally presented to the expert.

[0066] Throughout the process, no inbound rules were configured in the firewall's access control list to allow direct access to the P3PLC from the information layer. All legitimate remote maintenance traffic relied on outbound tunnels actively established by the edge gateway, while any unauthorized direct scans or attacks were dropped at the firewall. This "zero-trust" model significantly improved the security of the production network.

[0067] VI. Three-layer collaborative bandwidth guarantee mechanism Please refer to Figure 3 By utilizing VLAN technology and QoS (Quality of Service) policies, critical traffic can be prioritized.

[0068] 1. Device Layer: Deterministic Scheduling Based on TSN In the device layer network of each press unit, an industrial switch (such as the Siemens SCALANCE XC-200 series) that supports Time-Sensitive Networking (TSN) is used. By configuring the IEEE 802.1Qbv time-aware shaper and the IEEE 802.1Qbu frame preemption mechanism, exclusive transmission resources are provided for critical control flows.

[0069] (1) Configuration of the time-aware shaper First, the clocks of all TSN switches and terminal devices (PLCs, drives, encoders) within the device layer network are synchronized to nanosecond precision using the IEEE 802.1AS-Rev protocol, providing a unified time base for scheduling. Then, on each output port of the TSN switch, a periodic gated scheduling table is created based on the data stream type of the connected device.

[0070] Taking the port connected to the servo driver as an example, the scheduling period is set to 1 millisecond, consistent with the period of the servo control loop. Within this period, time is divided into three consecutive windows: The first window, lasting 200 microseconds, opens only the send queue used to carry servo loop control commands (such as position and speed commands); all other queues are closed. Within this window, only servo control frames can be sent, ensuring that this critical data stream receives exclusive, uninterrupted bandwidth.

[0071] The second window, lasting 100 microseconds, closes the servo control queue and opens the send queue used to carry safety I / O signals (such as safety gate status and emergency stop signals). This window is specifically for high-priority, event-triggered safety signals.

[0072] The third window, lasting 700 microseconds, simultaneously opens the sending queues for process data (such as temperature and pressure) and best-effort traffic (such as diagnostic logs and parameter uploads). These non-critical traffic streams share bandwidth for the remainder of the time.

[0073] With the above configuration, the servo control command has a fixed, non-preemptible 200-microsecond exclusive transmission period within each 1-millisecond cycle, and its maximum latency is precisely controlled within 200 microseconds, unaffected by any other traffic.

[0074] (2) Configuration of frame preemption mechanism To further reduce the latency of the highest priority safety signals, IEEE 802.1Qbu frame preemption is enabled. Specifically, the queue carrying the safety signal is marked as "Express," while all other queues (including servo control frame queues, process data queues, and best-effort queues) are marked as "Preemptable." A fragmentation threshold (e.g., 124 bytes) is set, and only frames exceeding this length are allowed to be interrupted.

[0075] When a switch's output port is sending a long log frame (e.g., 1500 bytes), if a security semaphore frame arrives at this time, the switch immediately performs the following actions: First, it completes the currently transmitted "fragmentation" boundary (not exceeding a threshold), then sends a control header indicating an interruption, and immediately sends the entire security semaphore frame. After the security semaphore frame is sent, it resumes sending the remaining long frame from the point of interruption. Because security semaphore frames are typically small (tens to over a hundred bytes), the entire interruption and recovery process can be completed within microseconds. This compresses the end-to-end latency of the security semaphore to the transmission time of the longest fragmentable frame (approximately 120 microseconds @ 100 Mbps), achieving bounded, extremely low latency.

[0076] 2. Control Layer: Priority mapping and queue scheduling based on DiffServ The core control layer switch (such as the SCALANCE XR-500 series) is responsible for cross-VLAN data forwarding and QoS policy enforcement. In this embodiment, the DiffServ model is used on this switch to achieve bandwidth guarantee through three steps: packet marking, classification, and queue scheduling.

[0077] (1) Message marking strategy On the source devices (central control PLC and individual press PLCs), set Differential Service Code Point (DSCP) values ​​for data streams of different importance levels. The specific rules are as follows: For critical cross-VLAN collaborative commands (such as full-line start and emergency stop commands issued by the master control LM via OPC UA Pub / Sub), the DSCP field of its IP header is marked as 46 in the PLC's communication protocol stack, corresponding to EF (accelerated forwarding) behavior.

[0078] For process data refresh (such as S7 communication) between operator station HMI and PLC within the same VLAN, it is marked as DSCP value 34, corresponding to AF41 (ensure forwarding) behavior.

[0079] For non-real-time traffic such as device diagnostics and log uploads, the default value of 0 is set, which corresponds to the best-effort behavior.

[0080] (2) Classification and mapping configuration On each input port of the core switch, configure classification rules to allocate packets to different internal Class of Service (CoS) queues based on the DSCP value in the received IP header. Configure corresponding queue scheduling parameters for the switch's output ports: Map DSCP 46 (Critical Coordination Command) to the highest priority Strict Priority Queue. This queue uses absolute priority scheduling: messages are sent immediately as long as there are messages in the queue, and other queues are not served until the queue is empty.

[0081] Map DSCP 34 (HMI process data) to a separate Class-Based Weighted Fair Queuing, allocate 30% of the total output port bandwidth to this queue (e.g., 300 Mbps on a gigabit port), and set a maximum burst size. This queue will receive at least 30% of the bandwidth even if other queues are congested.

[0082] Map the default traffic (DSCP 0) to the best-effort queue shared by the remaining bandwidth.

[0083] When network congestion occurs, critical coordination command messages are always forwarded with priority, and their delay will not exceed the transmission time of the strict priority queue (usually in the microsecond range). At the same time, the HMI process data stream, due to its independent guaranteed bandwidth, will not experience significant lag due to a surge in background traffic.

[0084] 3. Information Layer: Firewall-based traffic shaping and priority inversion An information layer firewall (such as the SCALANCE SC-600 series) is deployed between the information layer VLAN and the control layer core switch, serving as the sole pathway between the two networks. This embodiment implements two bandwidth control policies on the firewall: outbound traffic shaping and inbound priority marking.

[0085] (1) Perform outbound shaping on traffic sent from the information layer to the control layer. To prevent high-volume operations from the information layer (such as remote desktop screen transmission and batch PLC program downloads) from momentarily congesting the control layer network, outbound traffic shaping is configured on the firewall's control layer-facing interface. Specific parameter settings are as follows: Traffic to remote maintenance services (such as SSH and RDP) and application download services (such as S7 upload and download) is limited to an average rate of 10 Mbps, with burst traffic not exceeding 20 Mbps and burst duration not exceeding 100 milliseconds.

[0086] When the actual traffic exceeds the limit, the firewall buffers the excess packets in a queue and sends them at a shaped rate; if the buffer overflows, the excess packets are dropped.

[0087] In this way, even if maintenance engineers perform large-scale program uploads or downloads, the resulting traffic is limited to within 10Mbps, which will not consume a large amount of bandwidth of the core control layer switch, thus protecting the transmission quality of critical control layer traffic.

[0088] (2) Prioritize traffic sent from the control layer to the information layer. For traffic originating from the control layer to the information layer, the main component is production monitoring data reported by the edge gateway (via the MQTT protocol). In this embodiment, a higher priority is assigned to these data streams on the firewall's information layer-facing interface. Specifically, the firewall identifies data packets originating from the edge gateway and destined for the MQTT Broker's TCP port 8883, and rewrites their DSCP value to 46 (EF). This allows the information layer switches to prioritize forwarding this monitoring data when it enters the information layer network, ensuring that production status information reaches the monitoring system promptly without being blocked by reverse management traffic (such as video streams or file downloads from the factory office network).

[0089] 4. Overall effect of three-layer collaboration Through the separate configurations of the device layer, control layer, and information layer described above, this embodiment achieves end-to-end bandwidth assurance from the sensor to the control layer and then to the information layer: The TSN mechanism at the device layer provides nanosecond-level synchronization and microsecond-level bounded delay for the most critical servo control and safety signals, which is a deterministic guarantee at the physical level.

[0090] The DiffServ policy at the control layer, based on VLAN isolation, further distinguishes between cross-VLAN and intra-VLAN traffic of different importance, ensuring that cooperative commands always receive the highest forwarding priority.

[0091] Traffic shaping and priority marking at the information layer control the impact of non-real-time traffic on the core network from both the ingress and egress directions, while ensuring the timely uploading of monitoring data.

[0092] The three-tiered approach works in tandem to ensure the real-time and deterministic nature of control commands even under complex flow loads.

[0093] VII. Verification of Fault Isolation Effectiveness Please refer to Figure 4 To verify the effectiveness of VLAN logical isolation, we assume that during operation, an encoder in the device layer network of the P3 pressure machine unit malfunctions, generating a large number of broadcast messages. Since the P3 device layer network is strictly confined to VLAN 1010, the broadcast storm cannot propagate to the device layer networks of P1, P2, P4, and P5. Simultaneously, although the P3 control layer VLAN 30 may receive a device layer fault alarm (via unicast), this alarm will not trigger a broadcast storm. Therefore, the coordinated control of other units (VLANs 10, 20, 40, 50, and 100) remains completely unaffected. Operators can clearly determine on the central HMI that the fault is limited to the P3 unit and decide whether to allow other units to continue operating, thus avoiding the huge economic losses of a "full-line emergency shutdown" caused by a single fault in a traditional flat network.

[0094] Please refer to Figure 5 This paper provides an example of a specific production operation scenario to illustrate the workflow of the layered communication method described in this invention in an actual large-scale stamping production line.

[0095] Scenario: A large automated stamping production line in an automobile manufacturing plant, comprising five presses (P1 to P5) and a central control PLC (LM), is used to produce car door inner panels. The production cycle is 12 pieces per minute. One day, the production line is operating fully automatically, and operators in the central control room are monitoring the entire line's status via an HMI. Two typical events occur: first, the vibration sensor of press P3 detects a slight anomaly, requiring remote expert diagnosis; second, a brief broadcast storm occurs in the equipment layer network of unit P2, but the entire line does not stop.

[0096] I. Normal Operation Phase: Command Issuance and Coordinated Control At 10:00 AM, the operator selects the "Door Inner Panel" production program on the HMI console in the central control room and clicks the "Start" button. This HMI is located in VLAN 100 of the control layer, belonging to the same VLAN as the master control PLC (LM). The HMI sends the start command to the LM via the S7 protocol.

[0097] Upon receiving the instruction, the LM's integrated OPC UA Pub / Sub module encapsulates the start instruction (containing the tick parameter 60 pieces / minute and program number D001) into a message and publishes it to the predefined "Line / Command" topic. This message is marked as a TSN multicast stream, and the DSCP value in the IP header is set to 46 (highest priority). The message is sent from VLAN 100, where the LM resides, and enters the control layer core switch.

[0098] The core switch identifies the DSCP tag of the multicast stream and places it in a strict priority queue. Due to the absolute priority of this queue, the start command is forwarded immediately even if other HMI screen refresh data is queued on the switch port at the same time. The core switch, according to its routing table, simultaneously replicates and forwards the multicast stream to the respective control layer VLANs (VLAN 10 to VLAN 50) of P1 through P5. Upon receiving the message, each pressure machine PLC (as a subscriber) starts its respective pressure application program almost simultaneously (with a delay of less than 1 millisecond).

[0099] Meanwhile, the P2 press is executing a typical servo press cycle. Within the P2's device layer network, the PLC sends a position command to the servo driver every 1 millisecond. These commands are identified as Stream A on the TSN switch and transmitted within a dedicated time window of 0-200 microseconds. The encoder feedback signal from the driver returns to the PLC within the corresponding window of the same cycle, forming a closed-loop control. During this process, the temperature sensor within the P2 unit also uploads process data every 4 milliseconds, but this data is restricted to transmission within a 300-1000 microsecond window and never interferes with the servo control commands. Due to the time-aware shaping of the TSN, the accuracy of the P2's slider movement trajectory is controlled within ±0.01 mm, ensuring the forming quality of the stamped parts.

[0100] II. Data Acquisition Phase: Edge Computing and Security Reporting During production line operation, all PLCs (LM and P1 to P5) continuously generate production data. An edge computing gateway, deployed within the control layer network (inside the firewall), acts as an OPC UA client, subscribing to the data from each PLC every 100 milliseconds.

[0101] Taking the vibration sensor of the P3 press as an example, the sensor uploads the raw vibration waveform to the P3 PLC at a frequency of 10,000 sampling points per second. The P3 PLC publishes the raw data to its status topic. After the edge gateway subscribes to this data, it does not forward it directly, but performs a real-time Fourier transform (FFT) locally to extract characteristic spectral amplitudes such as first harmonic and second harmonic, and calculates the effective vibration value. The raw data volume is approximately 80KB per second, which is compressed to approximately 1KB per second after processing. The gateway also aggregates the status data of all PLCs (running / stopped / faulty), production count, and key process parameters (pressure, temperature), and encapsulates them into JSON format according to the Sparkplug B specification.

[0102] The edge gateway, acting as an MQTT publisher, pushes processed data to the MQTT Broker located in VLAN 200 of the information layer via a pre-established TLS encrypted connection (MQTTS) using TCP port 8883. The factory's IoT server subscribes to this Broker, receives data in real time, and displays it on the monitoring dashboard. Because the data has been compressed and aggregated, the bandwidth usage from the information layer to the control layer is extremely low (total bandwidth not exceeding 2Mbps for the entire line), and all reported traffic is an outbound connection initiated by the control layer, so the firewall does not need to open any inbound ports.

[0103] III. Anomaly Detection and Remote Diagnosis At 10:15 AM, the edge gateway detected during real-time FFT processing that the second harmonic amplitude in the vibration characteristic spectrum of the P3 press had increased by 15% compared to the normal value, exceeding the preset warning threshold. The gateway pushed this warning information as a separate message to the MQTT Broker. Upon receiving the message, the IoT server displayed a yellow warning on the monitoring dashboard and automatically generated a diagnostic work order.

[0104] The factory's remote expert, using a company-issued laptop at home, first accesses the factory's information layer network (VLAN 200) via VPN, then remotely logs into a jump server on the information layer. On the jump server, the expert opens the maintenance software (TIA Portal) and attempts to connect to the PLC of the P3 pressure machine (IP address 10.10.30.10). At this point, the connection request is not sent directly to the P3 PLC, but is configured to be sent to the proxy service address of the edge gateway (172.16.10.100:8443).

[0105] The remote access proxy service running on the edge gateway had previously established a reverse encrypted tunnel with the jump server. This tunnel is an outbound long-lived connection initiated by the edge gateway to the jump server's heartbeat port. When an expert's connection request reaches the edge gateway, the gateway first verifies the client certificate carried in the request, confirming that the expert has the "diagnostic engineer" role and that the authorized target includes the P3 PLC. After successful authentication, the edge gateway, acting as a proxy client, initiates a new TCP connection (target port 102, S7 protocol) from within the control layer network to the P3 PLC and forwards the expert's program upload request to the P3 PLC.

[0106] The program data blocks responded by the P3 PLC are returned to the edge gateway via this TCP connection. The gateway then transmits the data back to the jump server via a reverse encrypted tunnel, ultimately displaying it on the expert's maintenance software interface. After analyzing the program, the expert discovered that a certain lubrication parameter setting on the P3 was too low, causing increased bearing vibration. He remotely modified the parameter and downloaded it to the P3 PLC. Throughout this process, the firewall's access control list contained no inbound rules allowing direct access to the P3 PLC from the information layer; all traffic was proxied and inspected by the edge gateway. Any port scans or unauthorized access attempts targeting the P3 PLC were dropped at the firewall and never reached the control layer device.

[0107] IV. Fault Isolation: The Impact of Broadcast Storms While the experts were conducting remote diagnostics, an encoder in the P2 press device layer network malfunctioned due to hardware aging and began continuously sending a large number of broadcast messages (ARP requests). Because the P2 device layer network was strictly configured in its independent VLAN 1020, and the broadcast domain of this VLAN was limited to a single TSN switch within the P2 unit and its connected devices, these broadcast messages could not cross over to the P2 control layer VLAN 20, let alone propagate to the device or control layer networks of P1, P3, P4, and P5.

[0108] The CPU load of the device layer switch on P2 spiked momentarily, but the fault was completely isolated. Although the P2 PLC in VLAN 20 of the P2 control layer could still communicate normally with the central control LM via its X2 interface (because device layer fault alarms are reported unicast, not broadcast), no communication interruption occurred along the entire line. Upon receiving the encoder fault report from the P2 PLC, the central control LM, according to the preset safety policy, only switched the P2 unit to a safe stop state, while instructing P1, P3, P4, and P5 to continue completing the current stamping cycle before a normal shutdown. Production management personnel could clearly see on the central HMI that the fault was limited to the P2 unit.

[0109] If a traditional flat network architecture is used, the broadcast storm generated by the encoder will spread to all switch ports on the entire production line, causing communication interruptions for all PLCs, HMIs, and servers, resulting in an emergency shutdown of the entire line and at least 30 minutes of production loss. However, in this embodiment, due to the logical isolation of VLANs, the loss is limited to unit P2, and the entire line resumes production within 10 minutes (only unit P2 requires maintenance), avoiding economic losses.

[0110] The above application scenarios fully demonstrate the effectiveness of the layered communication method described in this invention in actual production: Startup phase: The master control LM sends the startup command to all pressure machines synchronously within 1 millisecond through a publish / subscribe mode, achieving high-precision collaboration.

[0111] During operation: The device layer TSN ensures the hard real-time performance of servo control, ensuring stamping quality; edge computing compresses vibration data to 1% of the original amount, significantly saving bandwidth.

[0112] Diagnostic phase: The reverse encrypted tunnel enables zero-trust remote maintenance, allowing experts to troubleshoot without exposing any PLC ports.

[0113] During the fault phase: VLAN isolation limits broadcast storms to a single press unit, preventing a complete line shutdown and reducing downtime losses.

[0114] This embodiment fully demonstrates the significant advantages of the present invention in improving the reliability, security, real-time performance, and maintainability of stamping production line networks.

[0115] In some embodiments, the hierarchical communication system for large-scale stamping production lines based on virtual local area networks (VLANs) may include multiple functional modules composed of computer program segments. The computer programs for each program segment in the hierarchical communication system for large-scale stamping production lines based on VLANs may be stored in the memory of a computer device and executed by at least one processor to perform (see details). Figure 1 (Description) Functionality of hierarchical communication in a large-scale stamping production line based on virtual local area network.

[0116] In this embodiment, the hierarchical communication system for a large-scale stamping production line based on a virtual local area network can be divided into multiple functional modules according to the functions it performs, such as... Figure 6 As shown. The module referred to in this invention is a series of computer program segments that can be executed by at least one processor and perform a fixed function, and is stored in memory. In this embodiment, the functions of each module will be described in detail in subsequent embodiments.

[0117] The device layer network is configured to contain real-time control devices within a single press unit and has an independent first virtual local area network for implementing closed-loop real-time control within the unit. The control layer network is configured to include the overall line control equipment and the collaborative control equipment of each press unit, and has an independent second virtual local area network for realizing the collaborative control and status interaction of the entire line. The information layer network is configured to include data acquisition servers, maintenance terminals, and factory management network equipment, and has an independent third virtual local area network for non-real-time data acquisition and remote maintenance. The routing control module is configured to allow or disable cross-layer communication between the device layer network, the control layer network, and the information layer network.

[0118] In the embodiments provided by this invention, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the system embodiments described above are merely illustrative. For instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between systems or modules may be electrical, mechanical, or other forms.

[0119] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0120] In addition, the functional modules in the various embodiments of the present invention can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0121] Although the present invention has been described in detail with reference to the accompanying drawings and preferred embodiments, the present invention is not limited thereto. Various equivalent modifications or substitutions can be made to the embodiments of the present invention by those skilled in the art without departing from the spirit and essence of the invention, and such modifications or substitutions should all be within the scope of the present invention. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should also be covered within the protection scope of the present invention.

Claims

1. A hierarchical communication method for a large-scale stamping production line based on a virtual local area network, characterized in that, include: The industrial network of a large stamping production line is divided into an equipment layer network, a control layer network, and an information layer network. Independent virtual local area networks are allocated to the equipment layer network, the control layer network, and the information layer network respectively to achieve logical isolation between the three layers. The real-time control devices within a single press unit are distributed to the device layer network to achieve closed-loop real-time control within the unit; The overall control equipment and the collaborative control equipment of each press unit are allocated to the control layer network to realize the collaborative control and status interaction of the entire line; Data acquisition servers, maintenance terminals, and factory management network equipment are allocated to the information layer network to achieve non-real-time data acquisition and remote maintenance; Configure routing control policies to control cross-layer communication between the device layer network, the control layer network, and the information layer network.

2. The method according to claim 1, characterized in that, The device layer network uses a time-sensitive networking protocol for data transmission, and the method further includes: Time synchronization is performed within the device layer network. Configure planned traffic scheduling based on IEEE 802.1Qbv for periodic critical control commands, and configure frame preemption mechanism based on IEEE 802.1Qbu for the highest priority security signals triggered by events.

3. The method according to claim 2, characterized in that, Time synchronization within the device layer network includes: Among the time-sensitive network-enabled switches and terminal devices included in the device layer network, one device is automatically elected as the best master clock for the device layer network based on the IEEE 802.1AS-Rev protocol or the gPTP protocol. The optimal master clock periodically sends synchronization and follow messages to all other slave clock devices in the device layer network, wherein the synchronization message carries the precise transmission timestamp of the optimal master clock; After receiving the synchronization message and follow message from the clock device, the precise reception timestamp of the message is recorded, and the clock offset between the message and the optimal master clock is calculated based on the transmission timestamp and reception timestamp. The slave clock device and the optimal master clock measure and calculate the path delay between them by exchanging peer delay request messages and peer delay response messages. The slave clock device corrects and adjusts its local slave clock based on the clock offset and the path delay, so that the clocks of all devices in the device layer network can achieve high-precision synchronization with the optimal master clock at the nanosecond or submicrosecond level.

4. The method according to claim 1, characterized in that, The control layer network uses a publish / subscribe communication model for collaborative data transmission across virtual local area networks, and the method further includes: Configure the central control device as the publisher and configure the collaborative control devices of each press unit as subscribers; The publisher publishes the entire line of collaborative instructions to a predetermined topic, and the subscriber receives the collaborative instructions by subscribing to the topic. The publish / subscribe communication is mapped to a time-sensitive network multicast stream, and a bandwidth reservation or time scheduling policy is configured for the multicast stream on the core switch.

5. The method according to claim 1, characterized in that, The information layer network employs edge computing and message queue telemetry transmission protocols for data aggregation and reporting. The method further includes: An edge computing gateway is deployed between the control layer network and the information layer network; The edge computing gateway collects raw production data from the control layer network through an open platform communication unified architecture protocol. The edge computing gateway cleans, aggregates, compresses, or converts the format of the collected raw data to generate processed data. The edge computing gateway, acting as the publisher of the message queue telemetry transmission protocol, pushes the processed data to the message broker server deployed in the information layer network through the encrypted port that is uniquely opened by the firewall.

6. The method according to claim 5, characterized in that, The information layer network also provides a remote security maintenance channel, and the method further includes: Configure a remote access proxy service on the edge computing gateway; The remote access proxy service proactively establishes a reverse encrypted tunnel with the maintenance terminal located in the information layer network; When the maintenance terminal needs to access the target device in the control layer network, its maintenance request is sent directly to the edge computing gateway through the established reverse tunnel. After receiving the maintenance request, the edge computing gateway parses, authenticates, and performs authorization checks on the request. After successful authentication, the edge computing gateway acts as a proxy client to initiate a new connection to the target device in the control layer network and forwards the maintenance request to the target device. The response data returned by the target device is transmitted back to the maintenance terminal via the edge computing gateway through the established reverse encryption tunnel; Specifically, no inbound rules are configured in the firewall's access control list to allow direct access from the information layer network to the target device in the control layer network.

7. The method according to claim 6, characterized in that, The remote access proxy service proactively establishes a reverse encrypted tunnel with the maintenance terminal located in the information layer network, including: The remote access proxy service on the edge computing gateway runs continuously as a daemon process and actively initiates an outbound, encrypted long connection to the heartbeat port located on the maintenance terminal itself, thereby establishing the reverse encrypted tunnel.

8. The method according to claim 1, characterized in that, Configure routing control policies, including: Deploy a firewall between the information layer network and the control layer network; Configure a rule on the firewall that by default blocks all access from the information layer network to the control layer network; Configure fine-grained allow rules on the firewall, which specify one or more source Internet Protocol addresses, one or more destination communication ports, and one or more communication protocols that are allowed to pass through. The request is only allowed to enter the control layer network from the information layer network if the access request matches the specified source address, destination port, and protocol.

9. The method according to claim 1, characterized in that, The method further includes: Within the device layer network, a time-aware shaper and frame preemption mechanism are configured based on the Time-Sensitive Networking Protocol (TSCP) to allocate dedicated transmission time windows within a period for different types of real-time data streams, and to allow high-priority control frames to interrupt the transmission of low-priority long frames. On the core switch of the control layer network, critical collaborative instruction messages across VLANs are marked as the highest priority and mapped to the strict priority queue, while communication messages between operator stations and PLCs within the same VLAN are marked as lower priority and mapped to the guaranteed bandwidth queue. On the firewall between the information layer network and the control layer network, a bandwidth limit is set for traffic from the information layer to the control layer, and data traffic reported by the edge gateway from the control layer to the information layer is marked with high priority.

10. A hierarchical communication system for a large-scale stamping production line based on a virtual local area network, characterized in that, For performing the method according to any one of claims 1-9, comprising: The device layer network is configured to contain real-time control devices within a single press unit and has an independent first virtual local area network for implementing closed-loop real-time control within the unit. The control layer network is configured to include the overall line control equipment and the collaborative control equipment of each press unit, and has an independent second virtual local area network for realizing the collaborative control and status interaction of the entire line. The information layer network is configured to include data acquisition servers, maintenance terminals, and factory management network equipment, and has an independent third virtual local area network for non-real-time data acquisition and remote maintenance. The routing control module is configured to allow or disable cross-layer communication between the device layer network, the control layer network, and the information layer network.

Images