Control system

Abstract

This invention provides a control system comprising: multiple area control layers, a data acquisition layer, and a security isolation layer. The area control layers include a data exchange module and multiple real-time Ethernet devices. The data exchange module acquires raw data from the real-time Ethernet devices, classifies the raw data to obtain real-time control flow data and standard acquisition flow data, and labels the real-time control flow data and standard acquisition flow data according to a first virtual LAN identifier and a first network address corresponding to the data exchange module, thereby obtaining real-time Ethernet device data, and sends the real-time Ethernet device data to the data acquisition layer. The data acquisition layer encapsulates the real-time Ethernet device data sent by the multiple data exchange modules and sends the core encapsulated data to the security isolation layer. The security isolation layer sends the encapsulated data to the data receiving end. This solution enables the data receiving end to directly obtain the operating data of the real-time Ethernet devices.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of industrial control, and more particularly to a control system. Background Technology

[0002] In the traditional industrial network architecture of the industrial control industry, real-time Ethernet (such as PROFINET) is used as the core network of industrial control. It generally needs to be physically isolated to ensure its independence, stability and reliability. It is mainly connected to the controllers (PLCs) in each area to achieve communication while ensuring physical isolation between areas.

[0003] However, the controller cannot directly obtain the real-time Ethernet device's operating data, which means that the data receiving end (such as SCADA, MES, etc.) cannot directly obtain the real-time Ethernet device's operating data, thus making the analysis of the controller's status more complex. Summary of the Invention

[0004] To address the aforementioned technical problems, embodiments of the present invention provide a control system that at least solves or mitigates these problems.

[0005] According to a first aspect of the present invention, a control system is provided, comprising: multiple area control layers, a data acquisition layer, and a security isolation layer. The area control layers include a data exchange module and multiple real-time Ethernet devices. The data exchange module is configured to acquire raw data from the real-time Ethernet devices, classify the raw data to obtain real-time control flow data and standard acquisition flow data, and label the real-time control flow data and the standard acquisition flow data according to a first virtual local area network identifier and a first network address corresponding to the data exchange module to obtain real-time Ethernet device data, and send the real-time Ethernet device data to the data acquisition layer. The data acquisition layer is configured to encapsulate the real-time Ethernet device data sent by the multiple data exchange modules to obtain encapsulated data, and send the encapsulated data to the security isolation layer. The security isolation layer is configured to send the encapsulated data to a data receiving end.

[0006] Optionally, the data acquisition layer includes multiple regional aggregation modules and a core aggregation module, with each regional aggregation module connected to a different data exchange module; the regional aggregation module is used to send the regional-level device operation and maintenance data corresponding to the regional aggregation module and the received real-time Ethernet device data to the core aggregation module; the core aggregation module is used to encapsulate the received multiple real-time Ethernet device data according to the regional-level device operation and maintenance data to obtain the encapsulated data.

[0007] Optionally, the data exchange module includes multiple switches connected in a tree topology or in a ring network coupling topology based on a media redundancy protocol.

[0008] Optionally, the data exchange module is connected to the regional aggregation module through at least two bidirectional communication links or a star-shaped communication link.

[0009] Optionally, the area control layer further includes: a controller; the controller is configured to send a first control command to the data exchange module; the data exchange module is configured to parse the first control command, obtain a second virtual local area network identifier included in the first control command, and send the first control command to the corresponding real-time Ethernet device according to the second virtual local area network identifier.

[0010] Optionally, the system further includes: a local server; the data acquisition layer, used to send the encapsulated data to the local server; the local server, used to parse the encapsulated data, and when the encapsulated data indicates that the target real-time Ethernet device meets the warning conditions, to generate warning information including the virtual local area network identifier of the target real-time Ethernet device.

[0011] Optionally, the security isolation layer includes at least two boundary firewalls; the boundary firewalls are used to verify the encapsulated data and send the verified encapsulated data to the data receiving end.

[0012] Optionally, the border firewall is further configured to determine the target upload bandwidth based on the service type corresponding to the encapsulated data, and send the verified encapsulated data to the data receiving end based on the target upload bandwidth.

[0013] Optionally, both the core aggregation module and the regional aggregation module include at least two industrial Layer 3 switches.

[0014] Optionally, the security isolation layer is used to receive the second control command, verify the second control command, and send the verified second control command to the data acquisition layer; the data acquisition layer is used to parse the second control command, obtain the third virtual LAN identifier and the second network address included in the second control command, and send the second control command to the corresponding data exchange module according to the third virtual LAN identifier and the second network address; the data exchange module is used to send the second control command to the corresponding real-time Ethernet device according to the third virtual LAN identifier.

[0015] As can be seen from the above technical solution, by labeling the real-time control flow data and standard acquisition flow data according to the first virtual local area network identifier and the first network address corresponding to the data exchange module, the real-time Ethernet device data is obtained. The real-time Ethernet device data is then encapsulated by the data acquisition layer, and the encapsulated data is sent to the data receiving end by the security isolation layer. This enables the data receiving end to directly obtain the real-time Ethernet device data, so that the data receiving end can perform data analysis on the real-time Ethernet device and achieve timely early warning. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0017] Figure 1 This is a schematic diagram of a control system according to an embodiment of the present invention;

[0018] Figure 2 This is a schematic diagram of a control system according to another embodiment of the present invention;

[0019] Figure 3 This is a schematic diagram of a data exchange module according to an embodiment of the present invention;

[0020] Figure 4 This is a schematic diagram of a control system according to yet another embodiment of the present invention;

[0021] Figure 5 This is a schematic diagram of a control system according to another embodiment of the present invention.

[0022] List of reference numerals in the attached diagram:

[0023] 10: Regional Control Layer 20: Data Acquisition Layer 30: Security Isolation Layer 101: Data Exchange Module 102: Real-time Ethernet devices 103: Controller 40: Data receiving end 201: Regional Aggregation Module 202: Core Convergence Module 1011: Switch 50: Local server Detailed Implementation

[0024] To enable those skilled in the art to better understand the technical solutions in the embodiments of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art should fall within the protection scope of the present invention.

[0025] Figure 1 This is a schematic diagram of a control system according to an embodiment of the present invention, as shown below. Figure 1As shown, the control system includes: multiple area control layers 10, a data acquisition layer 20, and a security isolation layer 30. The area control layer 10 includes a data exchange module 101 and multiple real-time Ethernet devices 102.

[0026] The data exchange module 101 is used to acquire raw data from the real-time Ethernet device 102, classify the raw data to obtain real-time control flow data and standard acquisition flow data, and label the real-time control flow data and standard acquisition flow data according to the first virtual LAN identifier and first network address corresponding to the data exchange module 101 to obtain real-time Ethernet device data, and send the real-time Ethernet device data to the data acquisition layer 20. The data acquisition layer 20 is used to encapsulate the real-time Ethernet device data sent by multiple data exchange modules 101, obtain encapsulated data, and send the encapsulated data to the security isolation layer 30. The security isolation layer 30 is used to send the encapsulated data to the data receiving end 40.

[0027] The lowest level of an industrial site includes multiple real-time Ethernet devices, such as PROFINET protocol I / O modules, frequency converters, valve islands, servo drives (V90PN), servo motors (1FL6), industrial cameras / depth cameras, and silk production equipment. During factory operations, these real-time Ethernet devices generate operational data in real time. When these devices experience operational problems or show a tendency to do so, this data will be reflected in the operational data. However, in current industrial control systems, real-time Ethernet devices are typically controlled by a PLC. The PLC is the "control brain" of the industrial production line; malicious attacks or tampering with its instructions can cause equipment damage, personnel injuries, and major production accidents, making it the highest priority for industrial control system security. Therefore, current industrial control systems are divided into a real-time control link for the PLC and a non-real-time data acquisition link, each using two completely independent sets of switches, network cables, and network equipment, without sharing any physical network resources. This results in data receiving ends, such as data analysis modules, being unable to obtain real-time Ethernet device operational data in a timely manner, thus failing to provide timely warnings. Therefore, in this application, the data acquisition layer 20 is connected to the data exchange module 101. The data exchange module 101 can acquire the raw data from the real-time Ethernet device 102, classify the raw data, obtain real-time control flow data and standard acquisition flow data, and annotate the real-time control flow data and standard acquisition flow data according to the first virtual LAN identifier and the first network address corresponding to the data exchange module 101 to obtain the real-time Ethernet device data. The virtual LAN identifier can be VLAN10~VLAN200 (avoiding the default VLAN1 network segment, VLAN201~4094 are reserved for operation and maintenance / management VLANs), and the network address can be the mainstream 172.24.0.0 / 16 network segment of industrial control private networks, with a unified subnet mask of ** / 24** (255.255.255.0). A single network segment supports access for 254 devices. Therefore, the data acquisition layer 20 can directly obtain the real-time Ethernet device data through the data exchange module 101, and the corresponding data of the real-time Ethernet device data is annotated by the first virtual LAN identifier and the first network address. Therefore, after the real-time Ethernet device data is encapsulated by the data acquisition layer 20 and sent to the data receiving end 40 through the security isolation layer 30, the data receiving end 40 will analyze the status of the real-time Ethernet device 102 based on the real-time Ethernet device data and the corresponding labels, and thus can make accurate early warnings.

[0028] Specifically, the security isolation layer 30 includes at least two boundary firewalls. These boundary firewalls are used to verify the encapsulated data and send the verified encapsulated data to the data receiving end 40.

[0029] Security isolation layer 30 can utilize two identical industrial-grade border firewalls. For example, in industrial control scenarios, security isolation layer 30 can be configured in a primary / backup dual-machine hot standby mode. The two border firewalls achieve real-time synchronization of sessions, configurations, and status via a heartbeat line. When the primary device in one of the two border firewalls fails, a seamless switchover to the secondary device in the two border firewalls can be achieved within milliseconds, without interrupting data acquisition and transmission. This avoids the impact of a single point of failure at the border on the system.

[0030] Specifically, the border firewall is also used to determine the target upload bandwidth based on the service type corresponding to the encapsulated data, and to send the verified encapsulated data to the data receiving end 40 according to the target upload bandwidth.

[0031] Border firewalls can perform fine-grained bandwidth allocation and priority scheduling for cross-network traffic, preventing large volumes of data from the IT network from overwhelming the PROFINET real-time control of the OT network and ensuring the determinism of the control network. For example, a border firewall can allocate a fixed target upload bandwidth to encapsulated data based on the service type corresponding to the encapsulated data, preventing it from preempting bandwidth resources on the OT network. Alternatively, a border firewall can set the highest priority for PROFINET real-time control traffic, ensuring the transmission of control messages even in the event of sudden network traffic surges. Furthermore, a border firewall can enable broadcast storm suppression, blocking broadcast and multicast packets from the IT network from entering the OT network, thus preventing interference with the broadcast domain control of PROFINET units.

[0032] Specifically, the security isolation layer 30 is used to receive the second control command, verify the second control command, and send the verified second control command to the data acquisition layer 20. The data acquisition layer 20 is used to parse the second control command, obtain the third virtual LAN identifier and the second network address included in the second control command, and send the second control command to the corresponding data exchange module 101 according to the third virtual LAN identifier and the second network address. The data exchange module 101 is used to send the second control command to the corresponding real-time Ethernet device 102 according to the third virtual LAN identifier.

[0033] During the data downlink process, the security isolation layer 30 first verifies the received control commands. For example, the security isolation layer 30 can parse the protocol type, function code, register address, and data content of the control commands to verify whether the control commands conform to the standard format of the industrial control protocol, and directly discard malformed, incomplete, or tampered illegal control commands. The security isolation layer 30 can also verify the legality of the data range of the control commands (such as the speed parameter configuration command of V90PN; if the data exceeds the rated range of the equipment, it is directly judged as an illegal command and blocked), to avoid external erroneous commands causing equipment failure. After the security isolation layer 30 verifies the data, it sends the verified second control command to the data acquisition layer 20. The data acquisition layer 20 determines the target data exchange module 101 to which the control command is sent based on the third virtual LAN identifier and the second network address. The data exchange module 101 further sends the second control command to the corresponding real-time Ethernet device 102 based on the third virtual LAN identifier.

[0034] In this embodiment, the data exchange module 101 labels the real-time control flow data and standard acquisition flow data according to the first virtual local area network identifier and the first network address corresponding to the data exchange module 101 to obtain real-time Ethernet device data. The real-time Ethernet device data is then encapsulated by the data acquisition layer 20, and the security isolation layer 30 sends the encapsulated data to the data receiving end 40. This enables the data receiving end 40 to directly obtain the real-time Ethernet device data, allowing it to perform data analysis on the real-time Ethernet device and achieve timely early warning.

[0035] Figure 2 This is a schematic diagram of a control system according to another embodiment of the present invention, as shown below. Figure 2 As shown, the data acquisition layer 20 includes multiple regional aggregation modules 201 and a core aggregation module 202. Each regional aggregation module 201 is connected to a different data exchange module 101. The regional aggregation modules 201 are used to send the regional-level device operation and maintenance data corresponding to their respective modules and the received real-time Ethernet device data to the core aggregation module 202. The core aggregation module 202 is used to encapsulate the received real-time Ethernet device data based on the regional-level device operation and maintenance data to obtain encapsulated data.

[0036] The regional aggregation module 201 receives real-time Ethernet device data from all real-time Ethernet devices 102 within its region (such as the leaf, stem processing, and high-bay warehouse units in the eastern area of ​​the tobacco processing workshop) acquired by the data exchange module 101, completing the initial centralized integration of real-time Ethernet device data within the region. The core aggregation module 202 receives regional-level equipment operation and maintenance data and real-time Ethernet device data from all regional aggregation modules 201 within the factory, encapsulates them, and completes the final centralized integration of data across the entire factory.

[0037] Specifically, both the core aggregation module 202 and the regional aggregation module 201 include at least two industrial Layer 3 switches.

[0038] For example, the core aggregation module 202 and the regional aggregation module 201 can be configured with two identical industrial Layer 3 switches (such as Siemens SCALANCE XC3000 series). These two identical industrial Layer 3 switches form a primary / backup dual-machine hot standby deployment, stacked via Gigabit / 10 Gigabit optical ports or directly connected via heartbeat lines to achieve real-time synchronization of configuration, sessions, and status. The industrial Layer 3 switch in the regional aggregation module 201 is connected to the data exchange module 101 via two redundant links, and the industrial Layer 3 switch in the regional aggregation module 201 is connected to the core aggregation module 202 via another two redundant links. By setting up redundant links, even if any switch or any uplink / downlink fails within the regional aggregation module 201, the data transmission path from the regional aggregation module 201 to the core aggregation module 202 remains uninterrupted. Real-time control / acquisition flows within the region can continue to ascend normally, and the underlying real-time Ethernet device 102 remains completely unaware of the failure.

[0039] In this embodiment, by setting up regional aggregation modules 201 and core aggregation modules 202, the pressure of the entire network is distributed to each regional aggregation module 201, while the scheduling of the entire network is centralized in the core aggregation module 202. This solves all the fatal problems of a single module and perfectly adapts to the core requirements of industrial control networking. The regional aggregation modules 201 first perform local integration, distribution, and protocol conversion on the data streams within their respective regions, only uploading the processed core data to the core aggregation module 202. This significantly reduces the forwarding and processing pressure on the core aggregation module 202, which only needs to perform network-wide targeted scheduling, thus avoiding performance bottlenecks. The regional aggregation modules 201 strictly control the fault domain to a single production area. If a broadcast storm or switch failure occurs in a certain area, only the network in that area is affected, while production lines in other areas can operate normally, and the core aggregation module 202 will not be impacted by the faulty traffic.

[0040] Figure 3 This is a schematic diagram of a data exchange module according to an embodiment of the present invention. Figure 3 As shown, the data exchange module 101 includes multiple switches 1011, which are connected in a tree topology or in a ring network coupling topology based on the media redundancy protocol.

[0041] The regional aggregation module 201 can connect to multiple switches 1011 via at least two bidirectional communication links or a star communication link, and the nodes connected to different communication links are different. For example, the regional aggregation module 201 consists of two SCALANCEXC3000 switches (201-A as the main switch and 201-B as the backup switch), interconnected by a heartbeat line, with 16 reserved gigabit optical ports. The corresponding data exchange module 101 of the regional aggregation module 201 has six switches 1011 (e.g., blade / stalk processing / high-bay warehouse units), all connected to 201-A and 201-B in a star topology via single-mode fiber. Blade unit 1011-1 is configured with two fiber links connected to 201-A and two to 201-B. 1011-1 and 201-A / B enable LACP and aggregate into a 2G link. The regional aggregation module 201 and switches 1011 enable HRP to form a regional ring network. 201-A / B are configured with a VRRP virtual gateway 172.24.100.1. QoS is enabled on all devices, and real-time flows are set to the highest priority. When any fiber in 1011-1 fails, LACP automatically switches over. If 201-A fails, VRRP switches to 201-B. If a 1011 link on a switch fails, HRP activates a backup path, ensuring uninterrupted data transmission between the area aggregation module 201 and all 1011 switches, with real-time control flow latency remaining stable at the microsecond level.

[0042] It should be noted that, Figure 3 The multiple switches 1011 shown are connected in a ring-coupled network topology based on the Media Redundancy Protocol, but the multiple switches 1011 also support a tree-like connection. Furthermore, Figure 3 Only one switch 1011 is shown connected to the real-time Ethernet device 102, but the data exchange module 101 includes multiple switches 1011 that can be connected to multiple real-time Ethernet devices 102.

[0043] In this embodiment, the tree connection of multiple switches 1011 only requires simple cascading according to the equipment process segment level, without the need for complex ring network protocol configuration. Each switch 1011 only requires 1-2 ports for cascading, resulting in high port resource utilization. At least two bidirectional links provide two independent physical transmission paths for each switch 1011. If a primary link fails, data can be immediately switched to the backup link, and a single link failure no longer affects data transmission. Under MRP ring network coupling, multiple switches 1011 are connected end-to-end to form a physical ring network. Each switch / each link has two physical communication paths (clockwise / counterclockwise). Under normal circumstances, data is transmitted along the primary path, and the MRP protocol monitors the link / device status in real time through ring network monitoring frames. When any switch 1011 fails or any link is disconnected, the MRP protocol shuts down the faulty port and opens the backup path within milliseconds. All data is automatically switched, and there is no communication interruption for any device within the ring network, completely solving the single point of failure problem of the tree topology. The star-shaped communication link ensures that the links between each switch 1011 and the area aggregation module 201 are independent and uncoupled. A link failure or device failure of a certain switch 1011 will only affect that switch 1011 and the real-time Ethernet device 102 connected to it, and will not spread to other switches 1011 or area aggregation module 201 through the link.

[0044] Figure 4 This is a schematic diagram of a control system according to another embodiment of the present invention. Figure 4 As shown, the area control layer 10 further includes a controller 103. The controller 103 is used to send a first control command to the data exchange module 101. The data exchange module 101 is used to parse the first control command, obtain the second virtual local area network (VLAN) identifier included in the first control command, and send the first control command to the corresponding real-time Ethernet device 102 according to the second VLAN identifier.

[0045] The controller 103 can be a programmable logic controller (PLC). Engineers use programming software (such as Siemens TIA Portal) to write control programs for the PLC that match the production process (such as the process logic of leaf cleaning, drying, blending and flavoring in the silk making workshop). The steps, parameters and linkage rules of the production process are converted into logical instructions that the PLC can execute. The PLC executes the control logic continuously and with high precision according to the program, realizing the fully automatic operation of the production process without continuous human intervention.

[0046] As a PROFINET IO controller, the PLC sends precise control commands to the real-time Ethernet device 102 via the data exchange module 101 in microsecond-level cycles, directly driving equipment actions. For example, it sends position / speed / torque commands to the real-time Ethernet device 102, such as a V90PN servo drive, to control the precise positioning and speed adjustment of servo motors (e.g., the feed roller speed and cutter positioning in a silk-making equipment). Alternatively, it sends digital / analog commands to the real-time Ethernet device 102, such as an IO module, to control the on / off state and data acquisition of solenoid valves, indicator lights, and sensors (e.g., material level detection in silos and valve switching). Or, it sends frequency / opening commands to the real-time Ethernet device 102, such as to a frequency converter / valve island, to control the speed of fans and pumps, as well as the opening and closing degree of pneumatic valves (e.g., variable frequency speed control of dehumidifying fans and precise opening degree of spice dispensing valves).

[0047] In this embodiment of the application, by setting up a controller 103, staff can automatically control the real-time Ethernet device 102.

[0048] Figure 5 This is a schematic diagram of a control system according to another embodiment of the present invention. Figure 5 As shown, the control system also includes a local server 50. A data acquisition layer 20 is used to send encapsulated data to the local server 50. The local server 50 is used to parse the encapsulated data and, when the encapsulated data indicates that the target real-time Ethernet device meets the warning conditions, generate warning information including the virtual local area network identifier of the target real-time Ethernet device.

[0049] The local server 50 can receive encapsulated data sent by the data acquisition layer 20. This encapsulated data can include control parameters (such as servo position / speed, IO switch status, process temperature and pressure) and operating status (start / stop, fault) of real-time Ethernet devices 102, such as PLCs, V90PNs, IOs, and frequency converters. This data is then visualized on the central control room's large screen and touchscreen (production line flowchart, equipment status panel, parameter curves), enabling real-time global monitoring of the production process. The local server 50 can also store this encapsulated data. When the encapsulated data indicates that the target real-time Ethernet device meets the warning conditions, the local server 50 generates a warning message including the virtual LAN identifier of the target real-time Ethernet device.

[0050] The local server 50 can also support maintenance personnel to issue non-real-time production control commands (such as production line start / stop, process formula switching, etc.) on the server side. The controller 103 sends the control commands to the data acquisition layer 20. The data acquisition layer 20 parses the control commands and sends them to the corresponding data exchange module 101 based on the virtual LAN identifier and network address obtained from parsing the control commands. This allows the data exchange module 101 to send the control commands to the corresponding real-time Ethernet device 102 based on the network address.

[0051] In this embodiment of the application, by setting up a local server 50, the encapsulated data can be parsed, thereby realizing real-time monitoring and centralized control of the production process.

[0052] It should be noted that not all steps and modules in the above processes and system structure diagrams are mandatory; some steps or modules can be omitted as needed. The execution order of each step is not fixed and can be adjusted as required. The system structure described in the above embodiments can be a physical structure or a logical structure. That is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or they may be jointly implemented by certain components in multiple independent devices.

[0053] In this patent application, nouns and pronouns relating to people are not limited to specific genders.

[0054] In the above embodiments, the hardware modules can be implemented mechanically or electrically. For example, a hardware module may include permanent, dedicated circuitry or logic (such as a dedicated processor, FPGA, or ASIC) to perform the corresponding operations. The hardware module may also include programmable logic or circuitry (such as a general-purpose processor or other programmable processor), which can be temporarily configured by software to perform the corresponding operations. The specific implementation method (mechanical, dedicated, permanent circuitry, or temporarily configured circuitry) can be determined based on cost and time considerations.

[0055] The present invention has been shown and described in detail above with reference to the accompanying drawings and preferred embodiments. However, the present invention is not limited to these disclosed embodiments. Based on the above multiple embodiments, those skilled in the art will know that more embodiments of the present invention can be obtained by combining the code review methods in the different embodiments above. These embodiments are also within the protection scope of the present invention.

Claims

1. A control system, characterized in that, include: The system comprises multiple area control layers, a data acquisition layer, and a security isolation layer. The area control layer includes a data exchange module and multiple real-time Ethernet devices. The data exchange module is used to acquire the raw data of the real-time Ethernet device, classify the raw data to obtain real-time control flow data and standard acquisition flow data, and label the real-time control flow data and the standard acquisition flow data according to the first virtual local area network identifier and the first network address corresponding to the data exchange module to obtain real-time Ethernet device data, and send the real-time Ethernet device data to the data acquisition layer. The data acquisition layer is used to encapsulate the real-time Ethernet device data sent by the multiple data exchange modules to obtain encapsulated data, and send the encapsulated data to the security isolation layer; The security isolation layer is used to send the encapsulated data to the data receiving end.

2. The system according to claim 1, characterized in that, The data acquisition layer includes multiple regional aggregation modules and a core aggregation module, with each regional aggregation module connected to one of the data exchange modules. The regional aggregation module is used to send the regional-level equipment operation and maintenance data corresponding to the regional aggregation module and the received real-time Ethernet equipment data to the core aggregation module; The core aggregation module is used to encapsulate the received real-time Ethernet device data based on the regional-level device operation and maintenance data to obtain the encapsulated data.

3. The system according to claim 2, characterized in that, The data exchange module includes multiple switches, which are connected in a tree topology or in a ring network coupling topology based on a media redundancy protocol.

4. The system according to claim 3, characterized in that, The data exchange module is connected to the regional aggregation module through at least two bidirectional communication links or a star-shaped communication link.

5. The system according to claim 1, characterized in that, The regional control layer also includes: a controller; The controller is used to send a first control command to the data exchange module; The data exchange module is used to parse the first control command, obtain the second virtual local area network identifier included in the first control command, and send the first control command to the corresponding real-time Ethernet device according to the second virtual local area network identifier.

6. The system according to claim 1, characterized in that, The system also includes: a local server; The data acquisition layer is used to send the encapsulated data to the local server; The local server is used to parse the encapsulated data, and when the encapsulated data indicates that the target real-time Ethernet device meets the warning conditions, it generates warning information including the virtual local area network identifier of the target real-time Ethernet device.

7. The system according to claim 1, characterized in that, The security isolation layer includes at least two boundary firewalls; The border firewall is used to verify the encapsulated data and send the verified encapsulated data to the data receiving end.

8. The system according to claim 7, characterized in that, The border firewall is also used to determine the target upload bandwidth based on the service type corresponding to the encapsulated data, and send the verified encapsulated data to the data receiving end based on the target upload bandwidth.

9. The system according to claim 2, characterized in that, Both the core aggregation module and the regional aggregation module include at least two industrial Layer 3 switches.

10. The system according to any one of claims 1-9, characterized in that, The security isolation layer is used to receive the second control command, verify the second control command, and send the verified second control command to the data acquisition layer. The data acquisition layer is used to parse the second control command, obtain the third virtual local area network identifier and the second network address included in the second control command, and send the second control command to the corresponding data exchange module according to the third virtual local area network identifier and the second network address; The data exchange module is used to send the second control command to the corresponding real-time Ethernet device according to the third virtual local area network identifier.

Images