A method and system for inter-station safety communication of a triple redundant control station, electronic equipment and storage medium

Abstract

This invention proposes a method, system, electronic device, and storage medium for secure communication between triple-redundant control stations. Belonging to the field of industrial process control technology, the method includes: the three main processor modules (PMs) of the sending station synchronously construct request frames based on hardware clock synchronization and send them to the communication module (CM) of the sending station; the sending station CM packages and reconstructs the request frames of all PMs within its station and sends them to the receiving station CM via an Ethernet "black channel"; the receiving station CM checks the reconstructed frame header and forwards it to the first-level receiving station PM; the first-level receiving station PM synchronizes the request frames to the other two PMs; the three PMs perform security checks and voting in parallel to generate valid security data and feedback response frames. This invention supports multi-link redundancy and innovatively introduces a fault-tolerant threshold algorithm with hysteresis characteristics. Through asymmetric error increment / decrement counting, it eliminates system oscillations caused by network jitter, significantly improving the availability and fault tolerance of high-concurrency communication while meeting the SIL3 safety level.

Description

Technical Field

[0001] This invention belongs to the field of industrial process control, and particularly relates to a method, system, electronic device and storage medium for secure communication between triple-redundant control stations. Background Technology

[0002] Secure communication refers to the requirement that in a secure loop, if a communication link (often referred to as a "black channel") exists that is not designed or validated according to functional safety standards such as IEC 61508, the communication data must be protected by an end-to-end security protocol to prevent various errors such as misalignment, delay, loss, and spoofing in the communication network. In the field of industrial control, triple redundancy (TMR) safety control systems greatly improve system availability and security by using three identical processors to perform the same task and vote on it.

[0003] Existing secure communication technologies have various applications in different fields, such as the RSSP protocol in the railway signaling industry, and the CIPSafety and FSOE protocols in the motion control field. In process control automation systems, protocols such as PROFIBUS / SPA are often used; however, they are mainly used for low-level communication between controllers and field I / O devices, with weak information integration capabilities and low communication rates (usually based on RS485 / physical layer limitations), which cannot meet the needs of extending high-speed secure loops between large-scale distributed secure control systems.

[0004] With the increasing demands of modern industry for distributed control and massive data interaction, there is an urgent need for a technical solution that can establish a peer-to-peer secure communication strategy between TMR control stations via high-speed Ethernet, thereby improving information integration capabilities while ensuring the SIL3 functional safety requirements of cross-station closed-loop control. Summary of the Invention

[0005] In view of the shortcomings of existing technologies, this invention provides a method, system, electronic device, and storage medium for secure communication between triple-redundant control stations. This invention combines the high-speed data transmission capabilities of Ethernet with the "black channel" theory, applies a proprietary security protocol to all communication links in the secure loop, solves the consistency problem of asynchronous communication between heterogeneous modules, and innovatively proposes a communication error tolerance mechanism based on a hysteresis algorithm.

[0006] The first aspect of this invention discloses a method for secure inter-station communication in a triple-redundant control station system; the method is applied to a control system including a transmitting station and a receiving station, wherein both the transmitting station and the receiving station include a triple main processor module (PM) and at least one communication module (CM), and the method includes: Step S1: The three PMs of the sending station synchronously construct request frames based on the hardware synchronization clock and send the request frames to the CMs of the sending station respectively; Step S2: The CM of the sending station packages and reconstructs the request frames received from each PM of the same system within the same control cycle to generate a complete data frame, and sends it to the CM of the receiving station via Ethernet; wherein, the packaging and reconstruction only checks the frame header and does not involve parsing and reconstructing the security frame data; Step S3: After the CM of the receiving station receives the complete data frame, it checks the frame header. If the check passes, it selects the receiving station PM with the smallest number that is communicating normally with this CM for forwarding. Step S4: The receiving station PM that receives the complete data frame synchronizes the request frame to other online receiving stations PM; the three receiving stations PM use the same processing mechanism to check the validity of the security frame in the request frame. Step S5: The three PMs of the receiving station vote on the valid security frames to obtain the final security data and generate a response frame, which is then returned to the sending station CM via the receiving station CM.

[0007] Furthermore, in step S1, the process of constructing a request frame for the three-system PM synchronization of the transmitting station includes: The three PMs obtain a clock value Ts that is consistent with the hardware synchronization clock and agree to construct a request frame at time T1. T1 satisfies the condition: T1%(10×T)<(10×Tp); T is the transmission period of the transmitting station and Tp is the control period of the PM. The synchronization of the request frame and response frame adopts a question-and-answer service mechanism: the PM that receives the frame sends synchronization service data carrying the timeout time and activation time to other online PMs. After receiving the data, the other PMs return a response. When the activation time arrives, all PMs in each system process the synchronization service simultaneously.

[0008] Furthermore, in step S2, the strategy for packaging, reconstructing, and sending includes: When the link is configured as non-redundant, the PM of the three systems sends a request frame to the corresponding CM, and the CM sends a complete data frame on a single network. When the link is configured as dual-network redundancy within the same CM, the three-system PM sends a request frame to the corresponding CM, and the CM sends a complete data frame across both networks. When the link is configured with two independent CM redundancy, the three-system PM sends a request frame to each of the two CMs once, and the two CMs send complete data frames on a single network.

[0009] Furthermore, in step S4, the conditions for the validity check include: The original data and the reversed data are identical; the CRC check of the original data is correct; the sending station and receiving station numbers match; the sending sequence number is as expected; the sending control status is normal. In step S5, the voting mechanism includes: When three valid security frames exist, if the data of the three systems are consistent, any one system's data is selected; if only two systems are consistent, any one of the two systems' data is selected; if none of the three systems are consistent, the frame is deemed invalid. When two valid security frames exist, if the data from the two systems are consistent, then data from either system is selected; if the data from the two systems are inconsistent, then the frames are deemed invalid.

[0010] Furthermore, in step S4, the sequence number checking and recovery mechanism includes: The sending station PM and the receiving station PM each maintain their local sequence number. The sequence number of the three PMs at the sending station remains consistent and is incremented with each transmission. The receiving station PM checks whether the request frame sequence number is equal to the local sequence number plus 1; When the sequence numbers are not as expected and the link is configured to be redundant: if the sequence numbers of the requested frames are all equal to the local sequence numbers maintained by the receiving station, the data is determined to be duplicated and discarded; if the sequence numbers of the requested frames are all equal but not equal to the local sequence numbers, the local sequence numbers are updated to the sequence numbers in the requested frames and a communication error is recorded; otherwise, the local sequence numbers are reset to their initial values ​​and a communication error is recorded.

[0011] Furthermore, the method also includes an error handling and recovery mechanism executed independently by the sending station PM and the receiving station PM, specifically including: Based on the preset sampling filter period and hysteresis, the fault tolerance threshold is calculated as follows: Threshold = (configured tolerable number of times + 1) × increment step size - hysteresis. When a communication error is detected, the corresponding error count is increased by the increment step; if the error count is less than the threshold value, the tolerance flag is set and normal or valid data from the previous clock cycle is used; if the error count is greater than or equal to the threshold value, the error flag is set and the system is downgraded to a fail-safe value. When communication is detected to have returned to normal: if the error flag is valid, the error count is reduced by the increment step size until the error count reaches zero and then the error flag is removed; if the tolerance flag is valid, the error count is reduced by the minimum hysteresis unit and the tolerance flag is removed; if no flag is valid, the error count is reduced by the minimum hysteresis unit.

[0012] Furthermore, the incremental step size is configured to be 8, the hysteresis is configured to be 4, and the minimum hysteresis unit is configured to be 1; in order to achieve symmetrical equal-amplitude attenuation of continuous detection and slow fallback of the tolerance state, and prevent jitter and oscillation of cross-station control signals.

[0013] A second aspect of this invention discloses a triple-redundant control station inter-station secure communication system; the system employs the method described in any one of the first aspects above, and the system includes: At least one transmitting station and at least one receiving station, both of which adopt a triple redundancy architecture and are internally configured with a main processor module (PM) and a communication module (CM). The main processor module PM of the sending station is used to generate secure data frames and send them to the communication module CM of the sending station; The communication module CM of the sending station and the communication module CM of the receiving station are connected via an Ethernet channel for cross-station data transmission. The main processor module PM of the receiving station is used to receive data frames from the local communication module CM, and to perform verification, voting, and hysteresis fault tolerance processing on the data frames.

[0014] Furthermore, the main processor module (PM) of the sending station is configured with a synchronization processing unit. The synchronization processing unit is used to: realize the data and status synchronization between the three redundant main processor modules (PM) inside the sending station based on the hardware synchronization signal and software service synchronization mechanism of the triple redundancy architecture when processing cross-station communication tasks.

[0015] In some specific embodiments, the main processor module (PM) of the receiving station is configured with a sequence number checking and recovery unit. The sequence number checking and recovery unit is used to: maintain the local sequence number of the receiving station and compare the sequence number of the received request frame with the local sequence number; when a sequence number mismatch or out-of-order error is detected, execute a multi-frame buffer alignment and / or sequence number reset and recovery mechanism.

[0016] Furthermore, the main processor module (PM) of the receiving station is equipped with a hysteresis fault-tolerant unit, which is used to perform asymmetric link health status assessment, specifically including: For data frames that are checked for errors or lost, the error count value of the current channel is increased by a preset increment step. For data frames that pass verification, the error count value of the current channel is reduced by a preset minimum hysteresis unit until it is cleared to zero. When the error count reaches the preset fault tolerance threshold, channel isolation or alarm actions are triggered.

[0017] A third aspect of this invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of a triple-redundant control station inter-station secure communication method according to any one of the first aspects of this disclosure.

[0018] A fourth aspect of this invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a triple-redundant control station inter-station secure communication method according to any one of the first aspects of this disclosure.

[0019] The beneficial effects of this invention are significant, mainly reflected in the following aspects: 1. Complete hardware and software decoupling and end-to-end security: Secure communication logic is decoupled and executed synchronously within the three-system PM, with the communication module (CM) acting only as a "black channel" transporter (not parsing the security layer). This effectively prevents all communication errors defined by IEC61508, such as message corruption, duplication, out-of-order delivery, loss, delay, and spoofing.

[0020] 2. Flexible high-speed link redundancy mechanism: Supports multiple redundancy topologies such as single link, single CM dual link, and dual CM dual link. When one network or a CM is physically damaged, the system can seamlessly switch over, greatly improving communication availability.

[0021] 3. Innovative Threshold Hysteresis Fault-Tolerant Algorithm: For TMR tripletization and 2oo3D voting logic, an innovative "+8 / -8 / -1" asymmetric fault-tolerant scoring model is proposed. The threshold formula (a linear combination of intercept and slope) perfectly adapts to both strong and weak interference in the field. This avoids system "refusal to operate or false operation" caused by minute instantaneous network jitter, prevents repeated "fault-recovery" oscillations at the fault critical point, and ensures the extreme reliability of the SIL3 safety system under harsh operating conditions. Attached Figure Description

[0022] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0023] Figure 1 A flowchart illustrating a secure communication method between triple-redundant control stations according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the inter-station secure communication network topology in an embodiment of the present invention; Figure 3 This is a communication model diagram of inter-station secure communication in an embodiment of the present invention; Figure 4 This is a schematic diagram of the PM request frame format from the sending station; Figure 5 This is a schematic diagram of the request frame format after the sending station CM has been reconstructed; Figure 6 This is a schematic diagram of the PM response frame format at the receiving station; Figure 7 This is a schematic diagram of the three-system PM synchronous operation mechanism; Figure 8 This is a sequence diagram of the PM synchronization service processing for the three systems; Figure 9 This is a flowchart of the communication recovery process; Figure 10 This is a flowchart of communication error handling; Figure 11 This is a schematic diagram of the PM state machine at the sending station; Figure 12 This is a schematic diagram of the PM state machine at the receiving station; Figure 13 This is a sequence diagram of the communication between PM and CM in asynchronous communication; Figure 14 This is a flowchart of how the sending station (CM) processes its own request frames; Figure 15 This is a flowchart of the sending station (CM) processing the receiving station's response frame; Figure 16 This is a flowchart of the receiving station (CM) processing the sending station's request frame; Figure 17 This is a flowchart of how the receiving station (CM) processes its own response frames; Figure 18 This is a diagram of the normal communication sequence of the system; Figure 19 This is the sequence diagram for sequence number recovery status 1; Figure 20 This is the sequence diagram for sequence number recovery status 2; Figure 21 This is a structural diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] The first aspect of this invention discloses a method for secure communication between triple-redundant control stations.

[0026] Example 1: This embodiment provides a method for secure inter-station communication in a triple-redundant control station system. The method is applied to a control system including a transmitting station and a receiving station, where each transmitting and receiving station includes a triple main processor module (PM) and at least one communication module (CM). Figure 1 As shown, the method includes: Step S1: The three PMs of the sending station synchronously construct request frames based on the hardware synchronization clock and send the request frames to the CMs of the sending station respectively; In step S1, the process of constructing a request frame for the three-system PM synchronization of the transmitting station includes: The three PMs obtain a clock value Ts that is consistent with the hardware synchronization clock and agree to construct a request frame at time T1. T1 satisfies the condition: T1%(10×T)<(10×Tp); T is the transmission period of the transmitting station and Tp is the control period of the PM. The synchronization of the request frame and response frame adopts a question-and-answer service mechanism: the PM that receives the frame sends synchronization service data carrying the timeout time and activation time to other online PMs. After receiving the data, the other PMs return a response. When the activation time arrives, all PMs in each system process the synchronization service simultaneously.

[0027] Step S2: The CM of the sending station packages and reconstructs the request frames received from each PM of the same system within the same control cycle to generate a complete data frame, and sends it to the CM of the receiving station via Ethernet; wherein, the packaging and reconstruction only checks the frame header and does not involve parsing and reconstructing the security frame data; In step S2, the strategy for packaging, reconstructing, and sending includes: When the link is configured as non-redundant, the PM of the three systems sends a request frame to the corresponding CM, and the CM sends a complete data frame on a single network. When the link is configured as dual-network redundancy within the same CM, the three-system PM sends a request frame to the corresponding CM, and the CM sends a complete data frame across both networks. When the link is configured with two independent CM redundancy, the three-system PM sends a request frame to each of the two CMs once, and the two CMs send complete data frames on a single network.

[0028] Step S3: After the CM of the receiving station receives the complete data frame, it checks the frame header. If the check passes, it selects the receiving station PM with the smallest number that is communicating normally with this CM for forwarding. Step S4: The receiving station PM that receives the complete data frame synchronizes the request frame to other online receiving stations PM; the three receiving stations PM use the same processing mechanism to check the validity of the security frame in the request frame. In step S4, the conditions for the validity check include: The original data and the reversed data are identical; the CRC check of the original data is correct; the sending station and receiving station numbers match; the sending sequence number is as expected; the sending control status is normal. In step S4, the sequence number checking and recovery mechanism includes: The sending station PM and the receiving station PM each maintain their local sequence number. The sequence number of the three PMs at the sending station remains consistent and is incremented with each transmission. The receiving station PM checks whether the request frame sequence number is equal to the local sequence number plus 1; When the sequence numbers are not as expected and the link is configured to be redundant: if the sequence numbers of the requested frames are all equal to the local sequence numbers maintained by the receiving station, the data is determined to be duplicated and discarded; if the sequence numbers of the requested frames are all equal but not equal to the local sequence numbers, the local sequence numbers are updated to the sequence numbers in the requested frames and a communication error is recorded; otherwise, the local sequence numbers are reset to their initial values ​​and a communication error is recorded.

[0029] In step S5, the voting mechanism includes: When three valid security frames exist, if the data of the three systems are consistent, any one system's data is selected; if only two systems are consistent, any one of the two systems' data is selected; if none of the three systems are consistent, the frame is deemed invalid. When two valid security frames exist, if the data from the two systems are consistent, then data from either system is selected; if the data from the two systems are inconsistent, then the frames are deemed invalid.

[0030] Step S5: The three PMs of the receiving station vote on the valid security frames to obtain the final security data and generate a response frame, which is then returned to the sending station CM via the receiving station CM.

[0031] Furthermore, the method also includes error handling and recovery mechanisms executed independently by the sending station PM and the receiving station PM, specifically including: Based on the preset sampling filter period and hysteresis, the fault tolerance threshold is calculated as follows: Threshold = (configured tolerable number of times + 1) × increment step size - hysteresis. When a communication error is detected, the corresponding error count is increased by the increment step; if the error count is less than the threshold value, the tolerance flag is set and normal or valid data from the previous clock cycle is used; if the error count is greater than or equal to the threshold value, the error flag is set and the system is downgraded to a fail-safe value. When communication is detected to have returned to normal: if the error flag is valid, the error count is reduced by the increment step size until the error count reaches zero, at which point the error flag is removed; if the tolerance flag is valid, the error count is reduced by the minimum hysteresis unit and the tolerance flag is removed; if no flag is valid, the error count is reduced by the minimum hysteresis unit. The increment step size is configured to 8, the hysteresis value is configured to 4, and the minimum hysteresis unit is configured to 1; this achieves symmetrical equal-amplitude attenuation during continuous detection and a slow decline in the tolerance state, preventing jitter and oscillation of the cross-station control signal. Those skilled in the art will understand that the specific values ​​of the increment step size, hysteresis value, and minimum hysteresis unit can be configured or adjusted proportionally according to the actual control cycle and system safety level requirements, and are not limited to 8, 4, and 1.

[0032] Example 2: The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0033] refer to Figure 2 and Figure 3 The inter-station secure communication described in this invention is a point-to-point secure communication network based on TMR control stations called Safety Net. The communication model spans "transmitter station PM → transmitter CMBUS → transmitter CM → Ethernet black channel → receiver CM → receiver CMBUS → receiver station PM", where the three PM systems include PMA, PMB, and PMC.

[0034] In this architecture, the CM and PM work asynchronously. The PM communicates with the CM every 10ms, and the CM control cycle is 8ms, ensuring that the CM receives data without blocking. The PM is responsible for end-to-end security control data encapsulation, while the CM shields the underlying network physical layer details, which can specifically use the UDP protocol.

[0035] Among them, frame processing and redundancy distribution, on the PM side, such as Figure 4 and Figure 6 As shown: The three PMs respectively construct request frames containing "security frame header, original security frame data, flipped security frame data, and security frame CRC". The flipped data is used for subsequent cross-redundancy check.

[0036] CM side, such as Figure 5 As shown: The sending station CM will combine the three PM request frames it receives. If the user has configured link redundancy, Scenario 2: Dual networks within the same CM; Scenario 3: Two independent CMs; CM will map the reconstructed frames to the corresponding physical Ethernet ports for transmission, achieving network-level resilience.

[0037] Furthermore, core synchronization mechanisms, such as Figure 7 and Figure 8As shown, due to the triple redundancy, the three PMs must align their behavior within a very small time window.

[0038] At the hardware level: all three PM series share a single clock Ts, achieving alignment at the microsecond level.

[0039] At the software level: synchronization is achieved through PMBUS. Upon receiving external data, such as a response frame from a PM (e.g., PMA), the system packages it with the "service activation time, such as 20ms for 4 PM cycles" and sends it to PMB and PMC. Only after all three systems have acknowledged the request and the activation time has arrived will they simultaneously begin processing the data, ensuring absolute synchronization of subsequent 2oo3D secure voting input.

[0040] In some specific embodiments, the safety protection measures meet IEC 61508, and the system comprehensively adopts the following means: (1) Time Expectation - Watchdog: Monitors the sending interval and response timeout.

[0041] (2) Cross-redundancy check: The original code is compared with the inverse code (reversed information) to prevent memory tampering.

[0042] (3) 32-bit CRC check: to prevent transmission distortion.

[0043] (4) Connection verification: Verify the node MAC / IP and internal PM number.

[0044] (5) Sequence number and disordered order restoration, such as Figure 19 and Figure 20 The mechanism maintains a bidirectional monotonically increasing sequence number. A misorder alignment mechanism was specifically developed for redundant links. When a sequence number misalignment is detected, it can quickly self-correct within one cycle by comparing the sequence number states of the three systems.

[0045] The core innovation of this application lies in the fault tolerance threshold and hysteresis algorithm, such as Figure 9 and Figure 10 As shown, in industrial settings, interference can lead to continuous packet loss. The traditional "stop after one error" approach has extremely poor availability, while "stop after N consecutive errors" is prone to frequent state reversals when encountering intermittent jitter.

[0046] This application proposes an ingenious scoring system with safety hysteresis: Threshold setting: Threshold value = (configured tolerable number of times + 1) × 8 - 4. In the formula, "8" corresponds to the standard sampling / filtering period (8ms), and "4" is the fixed offset (hysteresis).

[0047] Points Rules: Error occurred: Error count +8. Matched to the threshold formula on the same scale, quickly identifying real faults.

[0048] Fault recovery: Error count -8. The count decreases gradually without instantaneous reset, preventing the oscillation of "reporting a fault again immediately after recovery".

[0049] Tolerant recovery, critical state: error count -1. Minimum hysteresis unit. Avoids repeated jumps at the threshold critical point, making "faults easier to maintain and harder to recover from," consistent with the "safety-oriented" philosophy of functional safety.

[0050] For example: the tolerable number of errors is set to 2, and the threshold value is 20. One error scores 8 points, two errors score 16 points (still within tolerance), and three errors score 24 points (>20), triggering a safety cascading output of 0. If the network recovers at this point, the score drops from -8 to 16 points in the next cycle. The system will not immediately lift the alarm because it still has a memory effect. It must recover multiple times consecutively until the score drops to zero before the downgrade is lifted, perfectly implementing "soft filtering".

[0051] This invention's triple-redundancy secure communication strategy, through strict division of module responsibilities, end-to-end strong timing synchronization, and a unique asymmetric scoring fault-tolerant algorithm, constructs a highly reliable, oscillation-free SIL3-level "black channel" communication network using standard Ethernet without increasing proprietary hardware costs. It is not only applicable to newly built TMR systems but also has compatibility and scalability for dual-redundancy control systems, greatly promoting the networking process of Safety Instrumented Systems (SIS).

[0052] Example 3: This invention discloses a method for secure communication between triple-redundant control stations, specifically a secure communication strategy for triple-redundant control stations. Secure communication refers to the requirement that if a communication link (referred to as a "black channel") not designed or validated according to IEC 61508 exists in the secure loop, the communication must be protected by an "end-to-end" security protocol to prevent various errors in the communication. The TMR control station in this application is a triple-redundant secure control system, meaning it uses three identical processors to perform the same tasks. The control station mainly includes a triple-redundant main processor module (PM), a communication module (CM), and various I / O modules controlled by the main processor module. The secure inter-station communication described in this application is a peer-to-peer secure communication based on TMR control stations, used to establish a larger secure loop between distributed TMR control stations. The network topology is as follows... Figure 2 As shown: Safe communication is widely used in the railway industry. For example, the RSSP protocol is a safe communication protocol used in railway signaling safety equipment interfaces. In the field of industrial motion control, Omron Corporation's NX series controllers support CIP Safety and FSOE safe communication protocols. PROFIBUS PA can be used in process automation systems, monitored and controlled by the process control system, and is an intrinsically safe communication protocol.

[0053] The communication model for inter-station secure communication in this application is as follows: Figure 3 As shown, it includes the following parts: source control station PM, transmitter CMBUS, transmitter CM, Safety Net, destination control station (i.e., receiver CM, receiver CMBUS, and receiver PM).

[0054] The transmitting station periodically sends security data to the receiving station, which receives the data and responds. The transmitting station PM is responsible for constructing and parsing the security layer data. The communication link between the transmitting station PM and the receiving station PM is a secure communication black channel. The three PMs are connected to the CMs via independent communication buses CMBUS, and the three PMs are connected to each other via independent communication buses PMBUS. Specifically, PMBUSA is responsible for communication between PMA and PMB, PMBUS is responsible for communication between PMB and PMC, and PMBUSC is responsible for communication between PMA and PMC. The transmitting station CM communicates with the receiving station CM via Ethernet, specifically using UDP as the transport layer protocol. A single control station supports a maximum of four CMs online simultaneously, and each CM provides two Ethernet ports.

[0055] Depending on the different functions of the modules, the working mechanism of the inter-station secure communication strategy described in this invention is as follows: (1) Sending station PM Sending station three-system PM synchronous construction request frame, frame format as follows Figure 4 As shown. Then it is sent to the CM specified in the configuration. Depending on whether the sending station has redundancy configuration and the method of redundancy configuration, there are three possible scenarios: Case 1: The link is not redundant; Scenario 2: Link redundancy, with redundancy configured as two links within the same CM; Case 3: Link redundancy, where redundancy is configured on any link of the two CMs, meaning there are two sending stations CM.

[0056] For scenarios 1 and 2, the three PMs only need to send their respective request frames to the corresponding CMs once; for scenario 3, the three PMs need to send their respective request frames to both CMs once each.

[0057] Since the CM and PM work asynchronously, if the CM sends response frames separately, it may not be possible to guarantee the complete synchronization of the three PMs. Therefore, the design is such that only one PM at the sending station may receive the response frame, and then synchronize it to other online PMs through the corresponding PMBUS.

[0058] (2) Sending station CM The sending station CM packages request frames from all PMs within the same control period into a single frame. The format of the packaged frame is as follows: Figure 5As shown. Since the CM and PM work asynchronously, the CM may not receive all request frames sent by the PM within a single CM cycle. If this happens, the CM needs to continue receiving the corresponding request frames in the next cycle. If no frames are received in the next cycle, the CM considers it a timeout and only checks the received request frames.

[0059] The inspection of request frames mainly focuses on the request frame length, CRC, and the PM address, CM address, and frame type in the frame header; it does not involve the inspection of security frames. The CM only reconstructs successful request frames into a complete data frame and sends it. This process does not involve the reconstruction of security frames. Taking all three PM security frames as valid frames as an example, the reconstructed frame format is as follows: Figure 5 As shown.

[0060] When requesting frame transmission, for scenario 1 above, the sending station CM selects single-network transmission according to user configuration; for scenario 2 above, the sending station CM selects dual-network transmission; for scenario 3 above, both CMs of the sending station need to select single-network transmission according to user configuration.

[0061] After receiving the acknowledgment frame, the sending station (CM) begins checking the frame length, CRC, and the sending station address, receiving station address, and frame type in the frame header. It does not check security frames; that is done by the sending station's third-level PM. For acknowledgment frames that pass the check, the CM forwards them to the first-level PM. The PM selection mechanism is as follows: the PM with the lowest number and normal communication with the CM is selected, with PM numbers ascending to PMA, PMB, and PMC. Acknowledgment frames that fail the check are considered invalid and are not forwarded to any PM. In scenario 2 above, the CM will receive two acknowledgment frames; deduplication of these two frames is handled by the sending station's third-level PM.

[0062] (3) Receiving station CM After receiving a request frame from the sending station CM, the receiving station CM begins checking the request frame length, CRC, and the sending station address, receiving station address, and frame type in the frame header. It does not check for security frames (the security frame check is performed by the receiving station's PM). In scenario 2 above, the CM will receive two request frames; the deduplication of these two request frames is performed by the receiving station's PM.

[0063] For request frames that pass the inspection, the CM will forward them to a set of PMs. For request frames that fail the inspection, they will be considered invalid and will not be forwarded to any PM. The mechanism for selecting a PM is as follows: the PM with the lowest number that is communicating normally with the CM will be selected.

[0064] After receiving the response frame sent by the PM, the receiving station CM begins to check the response frame length, CRC, and the sending station address, receiving station address, and frame type in the frame header. It does not involve checking the security frame.

[0065] In the case of redundant configuration, for scenario 2 above, the same receiving station CM will receive two response frames from a certain PM. The receiving station CM needs to send the two response frames to the same CM of the corresponding sending station via Ethernet 1 and Ethernet 2 respectively. For scenario 3 above, two different receiving stations CM will receive response frames from a certain PM. Both CMs need to select one Ethernet channel according to the user configuration to send their respective response frames to different CMs of the corresponding sending station.

[0066] (4) PM receiving station Only one PM at the receiving station may receive the request frame from the sending station. The receiving PM will synchronize the received request frame to other online PMs via the corresponding PMBUS. All three PMs use the same processing mechanism to check security frames in the same period, and a frame is considered valid if it meets the following conditions: (a) The original data and the flipped data are identical; (b) The original data has a correct CRC. (c) The sending and receiving station numbers are correct; (d) The sequence number is correct; (e) The transmission control status is correct.

[0067] Then, the valid security frames are voted on according to Table 1, and finally a set of security data is obtained.

[0068] Table 1. Security Data Voting Mechanism

[0069] To reduce system load and simplify software processing, only the PM who receives the request frame is responsible for responding. The response frame format is as follows: Figure 6 As shown in the table above, the response frame is sent to the CM specified in the configuration. No response is given for request frames deemed invalid in the table above, but a response is still required for redundant request frames.

[0070] The PM synchronization mechanism of the inter-site secure communication strategy in this application is as follows: (1) Synchronous construction request frame mechanism like Figure 7 As shown, the synchronous operation of the three PMs depends on the hardware synchronization clock Ts. The three PMs obtain a consistent 48-bit microsecond clock value (Ta=Tb=Tc=Ts) from this clock. The three PMs agree to construct request frames simultaneously at time T1, and T1 must satisfy: T1%(10×T)<(10×Tp).

[0071] (2) Request frame and response frame synchronization mechanism Synchronization of request or response frames is performed in a question-and-answer format, using a synchronization service approach. The PM receiving the request or response frame is responsible for synchronizing the service with other online PMs, who in turn respond. This PM assembles the service data into a packet, adding a service response timeout and a service activation time. The service response timeout is set to two PM control cycles, the PM control cycle is 5ms, and the service activation time is set to four PM control cycles. The packet is then sent to other online PMs, and the service data is added to the synchronization service processing queue for processing. Other online PMs receive the data, add it to their own synchronization service processing queue, send responses, and wait for processing. If the PM responsible for synchronization does not receive all responses within the specified time or if the responses are incorrect, the synchronization is considered to have failed, and a cancellation command is sent. All online PMs then remove the corresponding service from their synchronization service queues. Synchronized service data is then processed by the respective PMs. When the service activation time is reached, all PMs begin processing the service simultaneously. For example, the process of PMA synchronizing services with two other PMs is as follows: Figure 8 As shown.

[0072] The security measures adopted in this application for inter-station secure communication strategy are as follows: (1) Time Expectation - Watchdog The sending station PM uses a watchdog timer to monitor the time interval between two consecutive transmissions. The watchdog timer is equal to the transmission period plus a tolerance margin, which is configurable. In addition, the PM also uses the watchdog timer to monitor whether the response times out: if no response is received within a certain time after a request is sent, the watchdog timeout period is configurable, and the transmission sequence number is incremented by 1 when the response times out.

[0073] The receiving station PM uses a watchdog timer to monitor whether the time interval between two consecutive receptions exceeds the limit. The watchdog timeout time is configurable, and its value mainly depends on the process safety time of the corresponding safety loop.

[0074] (2) Cross-redundancy check After receiving the total data frame, the receiving station PM first recovers the flip information and then compares it with the corresponding information. If they are different, error handling is performed; if they are the same, subsequent checks are performed.

[0075] After receiving the response frame, the sending station PM first restores the flip information and then compares it with the corresponding information. If they are different, error handling is performed; if they are the same, subsequent checks are performed.

[0076] (3) CRC The receiving station PM checks whether the CRC in the request frame of the sending station's three-system PM is correct, and sets the status information according to the check results. When the CRC of a security frame is incorrect, the request frame is discarded directly.

[0077] The sending station PM checks whether the CRC in the response frame is correct. If it is correct, the data is considered to be undamaged; if it is incorrect, the data is considered to be damaged and the response frame is discarded directly.

[0078] (4) Connection verification The receiving station PM checks whether the source address and destination address in the sending station's three-system PM request frame are correct: whether the PM information in the source address is consistent with the PM information in the supplementary information, and whether the control station node number in the source address and destination address is correct. Based on the check results, the status information is set. When the PM information is inconsistent, it can be reported only through the status information; when the control station node number is incorrect, the request frame is discarded directly.

[0079] The sending station PM checks whether the source address and destination address in the response frame are correct. If the address is incorrect, the response frame is discarded directly.

[0080] (5) Serial number The sending station PM and the receiving station PM each maintain a sequence number. The sequence numbers of the three sending station PMs are consistent. The initial value is 0. The value increases by 1 for each frame of data sent, up to 0xFFFFFFFF. After the next transmission, the value returns to 0.

[0081] The initial sequence number of the receiving station PM is 0xFFFFFFFF. The receiving station PM checks whether the sequence number in the request frame from the sending station's three-system PMs matches the expectation: the sequence number equals the local sequence number plus 1, and sets the status information according to the check results. If a completely correct security frame exists, the local sequence number is updated to the sequence number in the correct security frame; if a completely correct security frame does not exist, the processing mechanism is related to whether the link is redundant.

[0082] Link redundancy: When the sequence numbers do not meet expectations, if all sequence numbers are equal to the local sequence number, the data is considered duplicated and discarded directly without error handling or response; if all sequence numbers are equal to but not equal to the local sequence number, the local sequence number is updated to the sequence number in the request frame and error handling is performed; otherwise, the local sequence number is reset to the initial value and error handling is performed.

[0083] Link non-redundancy: When the sequence numbers do not meet expectations, if the sequence numbers are all equal, the local sequence number is updated to the sequence number in the request frame and error handling is performed; otherwise, the local sequence number is reset to the initial value and error handling is performed.

[0084] The sending station PM checks if the sequence number in the response frame meets expectations: the sequence number is unique and matches the request frame. If the sequence number is incorrect, the handling mechanism is related to link redundancy.

[0085] Link redundancy: If the response frame is duplicated, it is discarded directly without error handling; otherwise, the status information is checked. If the status information shows that the sequence number of this PM is incorrect, and all or part of the sequence numbers of other PMs are correct, the sent sequence number is updated to the sequence number in the response frame plus 1; if the status information shows that the sequence numbers of all PMs are incorrect, the local sequence number is cleared to zero.

[0086] Link non-redundancy: Check the status information. If the status information shows that the sequence number of this PM is incorrect, but all or part of the sequence numbers of other PMs are correct, then update the sent sequence number to the sequence number in the response frame plus 1; if the status information shows that the sequence numbers of all PMs are incorrect, clear the local sequence number.

[0087] (6) Feedback information After receiving the request frame from the sending station, the receiving station PM processes it accordingly and responds.

[0088] The correspondence between security measures and communication errors in the inter-station secure communication strategy of this application: The receiving station PM employs the aforementioned security measures to detect potential communication errors. Table 2 shows the security measures and the types of communication errors they can detect. Table 2 Relationship between security measures and communication errors

[0089] Error handling and recovery mechanisms for the inter-station secure communication strategy in this application: (1) PM error handling and recovery mechanism at the sending station The transmitting station PM maintains a separate set of data for each receiving station: an error count, a tolerance flag, and an error flag, with an initial value of 0.

[0090] When an error is detected in the response frame, the corresponding error count is incremented by 8. If the updated error count is less than the threshold value, the tolerance flag is set and normal data continues to be sent; otherwise, the error flag is set, the tolerance flag is reset, and the safety status flag of the transmission control status byte is set to 1. That is, when the receiving station PM detects that this flag is valid, it will regard the system request frame as an invalid frame, and the application should send a fault-safe value or normal data.

[0091] When the response frame is detected as correct, if the error flag is 1, the corresponding error count is decremented by 8. If the updated error count is greater than 0, the application should continue to send fault-safe values ​​or normal data. Otherwise, the error flag and the safety status flag for sending control status bytes are reset, and the application should send normal data. If the tolerance flag is 1, the corresponding error count is decremented by 1, and the tolerance flag is reset. If both the error and tolerance flags are 0, the corresponding error count is decremented by 1.

[0092] (2) PM error handling and recovery mechanism at receiving station The receiving station PM maintains a separate set of data for each transmitting station: an error count, a tolerance flag, and an error flag, with an initial value of 0.

[0093] When the detection finds that the sending station has no correct security frame, the corresponding error count is incremented by 8. If the updated error count is less than the threshold value, the tolerance flag is set and the application should use the last received correct data; otherwise, the error flag is set, the tolerance flag is reset, and the application should use the fail-safe value.

[0094] When a valid security frame is detected at the transmitting station, if the error flag is 1, the corresponding error count is decremented by 8. If the updated error count is greater than 0, the application should continue to use the fail-safe value. Otherwise, the error flag is reset, and the application should use the correct data received in this cycle. If the tolerance flag is 1, the corresponding error count is decremented by 1, the tolerance flag is reset, and the application should use the correct data received in this cycle. If both the error and tolerance flags are 0, the corresponding error count is decremented by 1, and the application should use the correct data received in this cycle.

[0095] Note 1: The safety value is a closed-loop result of multi-layered verification, voting, fault tolerance counting, and threshold judgment. The final output is 1 (safe / allowed) or 0 (fault-safe / prohibited). When the system adopts the fault-safe value, the receiving station rejects the transmitting station's data and enters the local safety processing flow, forcing cross-station signals to be set to a safe state, such as: valve closure, shutdown, and start-up prohibition.

[0096] Explanation 2: Threshold value = (configured tolerable number of times + 1) × 8 - 4. This is a linear function with a slope of 8 and an intercept of 4, a typical threshold calculation logic specifically used for TMR tripletization and 2oo3D voting logic. It adapts to both strong and weak interference in the field, has safety hysteresis, and meets the overall reliability requirements of the SIL3 safety control system: no false triggering, no failure to trigger, and no oscillation. In the formula, 8 is the standard sampling / filtering period = 8ms, which is the industry-standard setting; 4 is the fixed offset = hysteresis, requiring 4 consecutive normal cycles to achieve tolerable degradation, preventing repeated oscillations of "fault-recovery-fault-recovery", and ensuring stable and reliable recovery.

[0097] Error count +8 when an error occurs: The count corresponds to the sampling / filtering period and is matched with the threshold formula on the same scale. The count of the safety system is more stable and is not affected by minor jitter. It can quickly identify real safety faults and ensure sensitivity.

[0098] Error count during fault recovery -8: Symmetric and equal-amplitude attenuation with +8. For the case of tolerating non-zero, the count is not cleared instantaneously but drops slowly. This can prevent the signal from being cleared as soon as it recovers, prevent jitter from causing "just failed and recovered, then failed again", form hysteresis and soft filtering, and be more stable. Tolerate error count -1 during recovery: The minimum hysteresis unit, avoiding repeated threshold jumps at the critical point, making it easier for faults to persist and harder to recover, in line with safety principles.

[0099] The communication error and recovery mechanism adds a design for non-consecutive error situations, and the error count can more objectively reflect the frequency of faults occurring within a period of time. If the interval period between two errors is no greater than 4, it is equivalent to two consecutive errors. Suppose the current tolerable number is 2, then the threshold value is 20. When the application detects three consecutive frame errors, the error count is 24, exceeding the threshold value of 20, and an error flag needs to be set and a fault reported. If the application detects two consecutive frame errors and then three consecutive normal frames, at this time the error count is 8×2 - 3 = 13, not exceeding the threshold value of 20. If an error frame is detected in the next cycle, the error count is 13 + 8 = 21, exceeding the threshold value of 20, and an error flag needs to be set and a fault reported.

[0100] State diagram of the inter-station security communication strategy PM of this application: The state diagram of the receiving station PM is as Figure 12 shown. The receiving station PM monitors the time interval between two consecutive receptions. If it times out, corresponding error handling is performed. After a request frame is received normally, it checks whether there is a completely correct request frame. If not, corresponding error handling is performed, and finally the communication status is replied to the sending station PM.

[0101] Flowchart of the inter-station security communication strategy CM of this application: (1) Flowchart of the sending station CM The inter-station security communication strategy of this application designs the PM control period to be 5 ms and the CM control period to be 8 ms. PM and CM are asynchronous communications. PM communicates with CM once every 10 ms, which can ensure unblocked reception by CM. Although PM is designed with a synchronization mechanism, since CM cyclically receives all request frames from this station's PM, for the Figure 13 shown situation when T1 < T < T3, an 8-ms timeout waiting time, which is the CM control period, still needs to be set. Whether to execute the waiting is automatically determined by the program. If CM receives all request frames from all online PMs in the same cycle, there is no need to wait. Otherwise, it needs to continue receiving in the next cycle. Whether all frames are received in this cycle or not, CM only checks the received request frames and finally only packs and forwards the valid frames among them.

[0102] (2) Flowchart of the receiving station CM Sequence diagram of the inter-station secure communication strategy in this application: (1) Normal communication The interaction process during normal communication between the sending station and the receiving station, such as... Figure 18 As shown: (2) Serial number error and recovery Figure 19 and Figure 20 The interaction processes for sequence number recovery scenarios 1 and 2 are shown respectively. Sequence number recovery scenario 1: All sequence numbers in all request frames of a certain period are incorrect. As shown in the figure, the sequence number error can be recovered in just one period. Sequence number recovery scenario 2: The status information of a certain period shows that the sequence number of this PM is incorrect, while the sequence numbers of other PMs are all or partially correct. Figure 20 Taking the serial number error in PMA as an example, as shown in the figure, the serial number error can be recovered in just one cycle.

[0103] In summary, the solution proposed in this invention can: 1. Inter-station secure communication strategies can effectively prevent the following errors in communication: message corruption; unexpected message duplication; message out of order; message loss; unacceptable delay in messages; unwanted message insertion; secure message spoofing; and message addressing errors.

[0104] 2. The inter-station secure communication strategy is applicable to triple-redundant control systems, supports link redundancy configuration, and can establish secure communication loops between multiple stations through user configuration.

[0105] 3. The inter-station security communication strategy can also be used to extend security communication between dual-redundant control systems.

[0106] The second aspect of this invention discloses a triple-redundant control station inter-station secure communication system. For example... Figure 2 As shown, the system includes: To implement the triple-redundant control station inter-station secure communication method described in the first aspect, the system includes at least one transmitting station and at least one receiving station, both of which adopt a triple-redundant architecture and are internally configured with a main processor module PM and a communication module CM. The main processor module PM of the sending station is used to generate secure data frames and send them to the communication module CM of the sending station; The communication module CM of the sending station and the communication module CM of the receiving station are connected via an Ethernet channel for cross-station data transmission. The main processor module PM of the receiving station is used to receive data frames from the local communication module CM, and to perform verification, voting, and hysteresis fault tolerance processing on the data frames.

[0107] Furthermore, the main processor module (PM) of the sending station is configured with a synchronization processing unit. The synchronization processing unit is used to: realize the data and status synchronization between the three redundant main processor modules (PM) inside the sending station based on the hardware synchronization signal and software service synchronization mechanism of the triple redundancy architecture when processing cross-station communication tasks.

[0108] In some specific embodiments, the main processor module (PM) of the receiving station is configured with a sequence number checking and recovery unit. The sequence number checking and recovery unit is used to: maintain the local sequence number of the receiving station and compare the sequence number of the received request frame with the local sequence number; when a sequence number mismatch or out-of-order error is detected, execute a multi-frame buffer alignment and / or sequence number reset and recovery mechanism.

[0109] Furthermore, the main processor module (PM) of the receiving station is equipped with a hysteresis fault-tolerant unit, which is used to perform asymmetric link health status assessment, specifically including: For data frames that are checked for errors or lost, the error count value of the current channel is increased by a preset increment step. For data frames that pass verification, the error count value of the current channel is reduced by a preset minimum hysteresis unit until it is cleared to zero. When the error count reaches the preset fault tolerance threshold, channel isolation or alarm actions are triggered.

[0110] A third aspect of this invention discloses an electronic device. The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the triple-redundant control station inter-station secure communication method according to any one of the first aspects of this invention.

[0111] Figure 21 This is a structural diagram of an electronic device according to an embodiment of the present invention, such as... Figure 21 As shown, the electronic device includes a processor, memory, communication interface, display screen, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, Near Field Communication (NFC), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the device's casing, or an external keyboard, touchpad, or mouse.

[0112] Those skilled in the art will understand that Figure 21 The structure shown is merely a structural diagram of the part related to the technical solution of this disclosure and does not constitute a limitation on the electronic device to which the solution of this application is applied. The specific electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements.

[0113] A fourth aspect of this invention discloses a computer-readable storage medium. The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a triple-redundant control station inter-station secure communication method according to any one of the first aspects of this invention.

[0114] Please note that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments have been described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification. The above embodiments only illustrate several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be pointed out that for those skilled in the art, several modifications and improvements can be made without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for secure communication between triple-redundant control stations, characterized in that, The method is applied to a control system including a transmitting station and a receiving station, wherein both the transmitting station and the receiving station include a three-system main processor module (PM) and at least one communication module (CM), and the method includes: Step S1: The PM of the sending station synchronously constructs a request frame based on the hardware synchronization clock and sends the request frame to the CM of the sending station respectively; Step S2: The CM of the sending station packages and reconstructs the request frames received from each PM of the same system within the same control cycle to generate a complete data frame, and sends it to the CM of the receiving station via Ethernet; wherein, the packaging and reconstruction only checks the frame header and does not involve parsing and reconstructing the security frame data; Step S3: After the CM of the receiving station receives the complete data frame, it checks the frame header. If the check passes, it selects the receiving station PM with the smallest number that is communicating normally with this CM for forwarding. Step S4: The receiving station PM that receives the complete data frame synchronizes the request frame to other online receiving stations PM; the three receiving stations PM use the same processing mechanism to check the validity of the security frame in the request frame. Step S5: The three PMs of the receiving station vote on the valid security frames to obtain the final security data and generate a response frame, which is then returned to the sending station CM via the receiving station CM.

2. The method for secure inter-station communication of triple-redundant control stations according to claim 1, characterized in that, In step S1, the process of constructing a request frame for the three-system PM synchronization of the transmitting station includes: The three PMs obtain a clock value Ts that is consistent with the hardware synchronization clock and agree to construct a request frame at time T1. T1 satisfies the condition: T1%(10×T)<(10×Tp); T is the transmission period of the transmitting station and Tp is the control period of the PM. The synchronization of the request frame and response frame adopts a question-and-answer service mechanism: the PM that receives the frame sends synchronization service data carrying the timeout time and activation time to other online PMs. After receiving the data, the other PMs return a response. When the activation time arrives, all PMs in each system process the synchronization service simultaneously.

3. The method for secure inter-station communication of triple-redundant control stations according to claim 1, characterized in that, In step S2, the strategy for packaging, reconstructing, and sending includes: When the link is configured as non-redundant, the PM of the three systems sends a request frame to the corresponding CM, and the CM sends a complete data frame on a single network. When the link is configured as dual-network redundancy within the same CM, the three-system PM sends a request frame to the corresponding CM, and the CM sends a complete data frame across both networks. When the link is configured with two independent CM redundancy, the three-system PM sends a request frame to each of the two CMs once, and the two CMs send complete data frames on a single network.

4. The method for secure inter-station communication of triple-redundant control stations according to claim 1, characterized in that, In step S4, the conditions for the validity check include: The original data and the reversed data are identical; the CRC check of the original data is correct; the sending station and receiving station numbers match; the sending sequence number is as expected; the sending control status is normal. In step S5, the voting mechanism includes: When three valid security frames exist, if the data of the three systems are consistent, any one system's data is selected; if only two systems are consistent, any one of the two systems' data is selected; if none of the three systems are consistent, the frame is deemed invalid. When two valid security frames exist, if the data from the two systems are consistent, then data from either system is selected; if the data from the two systems are inconsistent, then the frames are deemed invalid.

5. A method for secure inter-station communication of triple-redundant control stations according to claim 4, characterized in that, In step S4, the sequence number checking and recovery mechanism includes: The sending station PM and the receiving station PM each maintain their local sequence number. The sequence number of the three PMs at the sending station remains consistent and is incremented with each transmission. The receiving station PM checks whether the request frame sequence number is equal to the local sequence number plus 1; When the sequence numbers are not as expected and the link is configured to be redundant: if the sequence numbers of the requested frames are all equal to the local sequence numbers maintained by the receiving station, the data is determined to be duplicated and discarded; if the sequence numbers of the requested frames are all equal but not equal to the local sequence numbers, the local sequence numbers are updated to the sequence numbers in the requested frames and a communication error is recorded; otherwise, the local sequence numbers are reset to their initial values ​​and a communication error is recorded.

6. The method for secure inter-station communication of triple-redundant control stations according to claim 1, characterized in that, It also includes error handling and recovery mechanisms executed independently by the sending station PM and the receiving station PM, specifically including: Based on the preset sampling filter period and hysteresis, the fault tolerance threshold is calculated as follows: Threshold = (configured tolerable number of times + 1) × increment step size - hysteresis. When a communication error is detected, the corresponding error count is increased by the increment step; if the error count is less than the threshold value, the tolerance flag is set and normal or valid data from the previous clock cycle is used; if the error count is greater than or equal to the threshold value, the error flag is set and the system is downgraded to a fail-safe value. When communication is detected to have returned to normal: if the error flag is valid, the error count is reduced by the increment step size until the error count reaches zero and then the error flag is removed; if the tolerance flag is valid, the error count is reduced by the minimum hysteresis unit and the tolerance flag is removed; if no flag is valid, the error count is reduced by the minimum hysteresis unit.

7. A method for secure inter-station communication of triple-redundant control stations according to claim 6, characterized in that, The incremental step size is configured to be 8, the hysteresis is configured to be 4, and the minimum hysteresis unit is configured to be 1; in order to achieve symmetrical equal amplitude attenuation of continuous detection and slow fallback of the tolerance state, and prevent jitter and oscillation of cross-station control signals.

8. A triple-redundant control station inter-station secure communication system, used to implement the method as described in claim 1, characterized in that, It includes at least one transmitting station and at least one receiving station, both of which adopt a triple redundancy architecture and are internally configured with a main processor module (PM) and a communication module (CM). The main processor module PM of the sending station is used to generate secure data frames and send them to the communication module CM of the sending station; The communication module CM of the sending station and the communication module CM of the receiving station are connected via an Ethernet channel for cross-station data transmission. The main processor module PM of the receiving station is used to receive data frames from the local communication module CM, and to perform verification, voting, and hysteresis fault tolerance processing on the data frames.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the triple-redundant control station inter-station secure communication method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the triple-redundant control station inter-station secure communication method according to any one of claims 1 to 7.

Images