A data acquisition method for power plant safety management

Abstract

The application discloses a data acquisition method for power plant safety management and relates to the technical field of power plant safety management. The method sets field acquisition nodes on a boiler island, a steam turbine island, a cold end system and an electrical system respectively, each field acquisition node performs synchronous acquisition on access signals according to a 1-second sampling period, combines all sampling values obtained by the same node within the same second into one node combined sampling record, and encapsulates the node combined sampling record into one node combined evidence frame; each field acquisition node writes corresponding information per second into one witness cell in a metal witness sheet, fills one metal witness sheet per 3600 seconds, and writes an hour abstract code generated by 3600 node combined evidence frames into an abstract area; a partitioned concentrator sequentially writes the node combined evidence frames into a one-time writing and multiple-time reading storage area to form a tamper-proof evidence chain, and sends the tamper-proof evidence chain to an evidence base through a one-way output link; and the evidence base reads 3600 node combined evidence frames corresponding to a witness sheet serial number to generate a digital hour abstract code.

Description

Technical Field

[0001] This invention relates to the field of power plant safety management technology, specifically a data acquisition method for power plant safety management. Background Technology

[0002] In existing power plant safety management, on-site data acquisition typically relies on distributed control systems, programmable logic controller systems, monitoring systems, or safety instrumented systems. These systems, under normal operating conditions, can complete process quantity acquisition, status quantity acquisition, alarm triggering, trend display, and interlocking control, thus demonstrating a high level of maturity at the production operation level. However, the design focus of existing systems is primarily on operation control and process monitoring, neglecting evidence preservation and accident investigation as the primary objectives of the data acquisition chain.

[0003] In actual power plant safety management, a long-standing and unresolved problem exists: when boiler combustion conditions change abruptly, turbine shaft system status is abnormal, cold-end vacuum fluctuates, electrical trips occur, or field nodes restart and lose power, the operating system can generate alarm records and historical curves. However, these records are mostly stored in a centralized database, historical stations, or host computers. Once an accident occurs, it is necessary to verify the event sequence, signal authenticity, data integrity, and responsibility for modifications. Often, judgment can only be made based on results exported from the central database or operation logs. If there are issues such as timing anomalies, missing log segments, unauthorized modifications, host computer reinstallation, station-side cache loss, or network attack traces overwriting, it is difficult to obtain strong evidence from a single digital record chain to prove whether the original data is authentic, whether the data already existed at the time, or whether it was subsequently rewritten. Summary of the Invention

[0004] To overcome the shortcomings of the prior art, the present invention provides the following technical solution: a data acquisition method for power plant safety management, comprising the following steps: S1, setting up a first field acquisition node on the boiler island, a second field acquisition node on the turbine island, a third field acquisition node on the cold end system, and a fourth field acquisition node on the electrical system, and setting up a time authority module, a zone aggregator, a unidirectional output link, and an evidence library; S2, the first, second, third, and fourth field acquisition nodes synchronously acquire the field signals they receive according to a 1-second sampling period, and merge all sampled values ​​obtained by the same field acquisition node within the same second into a node combination sampling record, while the rule judgment unit performs judgment on the node combination sampling record and outputs the event bitmap corresponding to that second; S3, the data encapsulation unit inside each field acquisition node encapsulates the node combination sampling record, sampling timestamp, witness piece sequence number, witness grid sequence number, previous hash, current frame hash, and node signature into a node combination evidence frame, wherein each field acquisition node in Only one node combination evidence frame is generated per second; S4, the physical witnessing unit inside each field acquisition node writes the corresponding witness grid on the metal witness sheet according to the witness grid number, with one witness grid written every second, and one metal witness sheet is filled every 3600 seconds, and the hourly digest code calculated from the 3600 node combination evidence frames generated by the field acquisition node within that 3600 seconds is written in the digest area of ​​the metal witness sheet; S5, the partition aggregator receives the node combination evidence frames sent by each field acquisition node, and according to the sampling timestamp, The node identifier, witness piece number, and witness grid number are sequentially written into the write-once-read-many storage area to form a tamper-proof evidence chain; S6, the partition aggregator sends a read-only copy of the tamper-proof evidence chain to the evidence library via a one-way output link; S7, the evidence library reads 3600 node combination evidence frames corresponding to the same witness piece number, generates a digital hour digest code, and uses a portable witness reader to read the physical hour digest code in the corresponding metal witness piece digest area, and performs consistency verification between the digital hour digest code and the physical hour digest code.

[0005] Preferably, the first field acquisition node is connected to the furnace negative pressure signal, the steam drum water level signal, and the feedwater flow signal; the second field acquisition node is connected to the bearing vibration signal, the overspeed trigger signal, and the lubricating oil pressure signal; the third field acquisition node is connected to the circulating water inlet temperature signal, the circulating water outlet temperature signal, and the condenser vacuum signal; and the fourth field acquisition node is connected to the circuit breaker open position signal, the circuit breaker closed position signal, and the trip trigger signal.

[0006] Preferably, the time authority module sends a unified time synchronization signal to the first field acquisition node, the second field acquisition node, the third field acquisition node, the fourth field acquisition node, and the partition aggregator; the unified time synchronization signal adopts the IEEE 1588 precision time protocol; when the unified time synchronization signal is interrupted for 1800 seconds, the time reference unit inside the corresponding field acquisition node switches to a local temperature-controlled crystal oscillator to maintain the time synchronization, and the rule determination unit sets a time synchronization interruption flag bit in the event bitmap corresponding to that second.

[0007] Preferably, the event bitmap consists of 7 event flag bits; the first event flag bit indicates a threshold exceeding the limit event, the second event flag bit indicates a rate of change exceeding the limit event, the third event flag bit indicates a dual-channel voting divergence event, the fourth event flag bit indicates a seal opening event, the fifth event flag bit indicates a time synchronization interruption event, the sixth event flag bit indicates a node restart event, and the seventh event flag bit indicates a power failure ending the write event; when two or more events occur within the same second at the same field acquisition node, the corresponding event flag bits are set simultaneously, and the setting result is written to the same node combined evidence frame and the same witness grid.

[0008] Preferably, the node combined evidence frame includes a plant identifier, unit identifier, area identifier, node identifier, three-channel identifier, three-channel parameter code, three-channel parameter value, three-channel unit code, sampling timestamp, event bitmap, witness piece sequence number, witness grid sequence number, preceding hash, current frame hash, and node signature; the preceding hash is composed of the current frame hash of the previous node combined evidence frame; the current frame hash is calculated from all fields of the current node combined evidence frame except for the node signature field; the node signature is generated by the security key chip inside the field acquisition node; the witness grid sequence number is from 0 to 3599, and the witness grid sequence number is mapped to a unique witness grid in the 60×60 witness grid array on the metal witness piece in row priority order.

[0009] Preferably, the metal witness sheet has a length of 120 mm, a width of 120 mm, and a thickness of 0.10 mm; a 60×60 witness grid array is arranged within a 90 mm×90 mm recording area; the center-to-center distance of a single witness grid is 1.5 mm; the metal witness sheet is provided with a summary area adjacent to the recording area; the physical witness unit uses a galvanometer laser writing mechanism to perform non-contact writing on the recording area and the summary area; after every 3600 seconds, the physical witness unit sends the current metal witness sheet into the archiving bin and sends the next metal witness sheet into the writing station.

[0010] Preferably, the metal witness sheet box contains 720 metal witness sheets; each metal witness sheet corresponds to a 1-hour sampling period; the continuous working time of a single metal witness sheet box is 30 days; the metal witness sheet box is replaced after 30 days.

[0011] Preferably, each witness cell contains a time placeholder, an event bitmap short code, a short digest code, and a check code; the short digest code is formed by truncating 16 bits of the hash of the evidence frame of the node combination evidence frame corresponding to the witness cell number; the digest area contains the witness piece number, node identifier, 128-bit hour digest code, and 32-bit error correction code; after the portable witness reader reads the digest area, it first verifies the 32-bit error correction code, and then outputs the 128-bit hour digest code.

[0012] Preferably, the partition aggregator is equipped with a 180-second circular buffer and an independent power supply unit. When a set event exists in the event bitmap of any node combined evidence frame, the partition aggregator freezes the node combined evidence frames from 30 seconds before the event to the time of the event, and continues to receive node combined evidence frames 120 seconds after the event to form an event evidence packet. The independent power supply unit continues to supply power to the partition aggregator for 180 seconds after the external power supply is interrupted to ensure that the event evidence packet is completely written to the write-once-read-many storage area.

[0013] Compared with the prior art, the present invention has the following beneficial effects: (1) The present invention merges three data channels within the same second of the same field acquisition node into a node combined evidence frame, which solves the problem of quantity mismatch caused by the separate framing of multi-channel data from the source, so that one frame per second, one grid per second, and one piece per hour form a strict correspondence, and the summary window and the verification window are completely consistent; (2) The present invention uses an addressable metal witness piece to replace the continuous long strip physical medium, so that the physical witness carrier changes from a continuous transmission structure to a fragmented archiving structure. Each witness sheet corresponds to only 1 hour of data. The metal witness sheet box only needs to be managed according to the number of sheets. The maintenance method is clear and the on-site replacement cycle is clear, avoiding the impractical problems of ultra-long witness tapes in terms of winding, conveying, alignment, tension control and long-term storage; (3) The present invention adopts a 60×60 witness grid array, so that 3600 witness grids form a one-to-one correspondence with 3600 seconds in 1 hour. Each witness grid has a unique address. With the witness sheet number and witness grid number, a precise mapping relationship between digital evidence frames and physical locations can be directly established, and post-event verification no longer relies on speculation; (4) The present invention uses the summary area to record the hourly summary code. Combined with the short summary code and check code in the witness grid, it can achieve consistency at the whole hour level. Verification can also be performed on single-second-level locations when necessary, improving the hierarchy and operability of the evidence system; (5) This invention forms a cross-regional isolated evidence storage structure through a partitioned aggregator, a write-once-read-many storage area and a unidirectional output link, so that the data generated on site can be first solidified in the production control area and then sent to the evidence library in the form of a read-only copy, which satisfies both the security isolation requirements and the external audit and accident review requirements; (6) This invention sets up a 180-second-long circular buffer and an independent power supply unit, so that the event evidence package can be stably formed after the event occurs. Even if the external power supply is interrupted, the data writing of the first 30 seconds to the last 120 seconds can continue to be completed, ensuring the integrity of the key event evidence. Attached Figure Description

[0014] Figure 1 This is a schematic diagram of the overall process of the present invention.

[0015] Figure 2 This is a schematic diagram of the external signal access of the first field acquisition node of the present invention.

[0016] Figure 3 This is a schematic diagram of the external signal access of the second field acquisition node of the present invention.

[0017] Figure 4 This is a schematic diagram of the external signal access of the third field acquisition node of the present invention.

[0018] Figure 5 This is a schematic diagram of the external signal access of the fourth field acquisition node of the present invention. Detailed Implementation

[0019] The following is in conjunction with the appendix Figures 1-5 The technical solution of the present invention will be further illustrated through specific embodiments.

[0020] This invention provides a data acquisition method for power plant safety management, establishing a three-layer data acquisition structure consisting of node-combined evidence frames, metal witness pieces, and a cross-regional evidence library. At the field layer, field acquisition nodes are deployed for the boiler island, turbine island, cold-end system, and electrical system, respectively. Each field acquisition node is fixedly connected to three signals directly related to safety management, and data is acquired synchronously at a 1-second sampling cycle. Unlike the traditional method of forming one frame per channel, this method merges the three sampling results from the same field acquisition node within the same second into a single node-combined sampling record, which is then uniformly encapsulated by a data encapsulation unit into a single node-combined evidence frame, thus ensuring that each field acquisition node generates only one frame of data per second.

[0021] Instead of using continuous long strip media, each field acquisition node uses addressable metal witness sheets. Each metal witness sheet corresponds to a one-hour sampling period, with a 60×60 witness grid array on the sheet, totaling 3600 witness grids, perfectly corresponding to the 3600 seconds within one hour. This ensures that one second corresponds to one witness grid, and the witness grid number perfectly matches the witness grid number in the node combined evidence frame, thus establishing a clear mapping relationship between digital and physical addresses. Every second, the physical witness unit writes a time placeholder, event bitmap short code, short digest code, and check code to the corresponding witness grid; at the end of each hour, it writes the hourly digest code generated from the 3600 node combined evidence frames into the digest area. Once the metal witness sheet is full, it automatically enters the archiving bin, and the next metal witness sheet enters the writing station.

[0022] The partition aggregator receives node-combined evidence frames from each field acquisition node and writes them to the write-once-read-many storage area in chronological, node-identity, and physical-address order, forming a tamper-proof evidence chain. Then, a read-only copy is sent to the evidence repository via a unidirectional output link, providing the repository with a physically isolated copy synchronized with the original data in the production area. The evidence repository extracts the corresponding 3600 node-combined evidence frames based on the witness piece sequence number, generates a digital hour digest code, and then uses a portable witness reader to read the physical hour digest code on the corresponding metal witness piece, completing the consistency verification between the digital and physical sides.

[0023] All rule determinations are based on deterministic rules. Specifically, the rule determination unit uses a threshold table, a rate of change table, a dual-channel voting table, a time synchronization interruption table, a seal opening table, a node restart table, and a power-down end-of-write table to determine the node combination sampling records, and organizes the determination results into an event bitmap. When multiple events occur within the same second, the flag bits of multiple events are set simultaneously, and the corresponding node combination evidence frame and witness cell for that second are written uniformly, thereby ensuring the integrity of the records under concurrent multi-event conditions.

[0024] A node-combined evidence frame structure of one frame per second per node is adopted. By merging three signals from the same node within the same second into one node-combined evidence frame, the problems of frame number expansion, digest window ambiguity, and unclear physical address mapping caused by the traditional single-parameter frame scheme in multi-channel scenarios are avoided, ensuring that the time granularity, address granularity, and digest granularity of the digital side and the physical side are consistent.

[0025] A fixed-address metal witness sheet structure is adopted, with one sheet per hour. Each metal witness sheet is responsible for one hour, and the number of witness cells is fixed at 3600, with serial numbers fixed from 0 to 3599. As a result, any node combination evidence frame can be uniquely mapped to a specific witness cell on the witness sheet, eliminating the problems of cumulative positional errors and long-distance mechanical transmission found in continuous long-band structures.

[0026] A two-layer physical write structure is adopted, consisting of a digest area and a witness grid array. The witness grid array is used to record second-level mapping information, while the digest area is used to record hour-level overall digest information. The former supports partial sampling and second-level correspondence, while the latter supports whole-scale verification and hour-level consistency proof. Together, they constitute a complete physical witnessing system.

[0027] It adopts a non-contact writing method. The physical witness unit uses a galvanometer laser writing mechanism to write to the metal witness plate, avoiding the problems of easy wear, misalignment and inaccuracy of traditional mechanical engraving methods in high temperature, vibration and dust environments, thus improving long-term operational reliability.

[0028] A parallel digital and physical chain is used for evidence preservation. Each node's combined evidence frame not only enters the tamper-proof evidence chain, but also leaves a corresponding physical witness in the metal witness sheet. This ensures that digital modifications must simultaneously face physical verification constraints, significantly improving the overall credibility of the evidence.

[0029] Example: The data acquisition system includes a first field acquisition node, a second field acquisition node, a third field acquisition node, a fourth field acquisition node, a time authority module, a zone aggregator, a one-way output link, an evidence library, and a portable witness reader. The first field acquisition node is located on the boiler island, receiving nearby signals from the furnace negative pressure, steam drum water level, and feedwater flow rate. The second field acquisition node is located on the turbine island, receiving nearby signals from the bearing vibration, overspeed trigger, and lubricating oil pressure. The third field acquisition node is located in the cold end system, receiving nearby signals from the circulating water inlet temperature, circulating water outlet temperature, and condenser vacuum. The fourth field acquisition node is located in the electrical system, receiving nearby signals from the circuit breaker open position, circuit breaker closed position, and trip trigger. Each field acquisition node is connected to the time authority module to receive unified time synchronization signals; each field acquisition node is connected to the zone aggregator to send node-combined evidence frames; the zone aggregator is connected to the evidence library via a one-way output link; the evidence library is connected to the portable witness reader to receive witness chip reading results and perform verification.

[0030] Each field acquisition node includes a process acquisition unit, a time reference unit, a rule determination unit, a data encapsulation unit, a physical witness unit, a communication unit, a power supply unit, an independent write-holding unit, a seal monitoring unit, and a redundant self-test unit. The process acquisition unit is responsible for signal access and signal conditioning. Of the three inputs, analog signals are accessed through an isolated sampling channel, status signals through an opto-isolated input channel, and triggered pulse signals through an edge-latched input channel. Within each 1-second sampling period, the process acquisition unit first synchronously latches the three signals, and then sends the sampling result for that second to the rule determination unit and the data encapsulation unit.

[0031] The time base unit is responsible for maintaining the node's internal time. Under normal conditions, the time base unit receives unified time synchronization from the time authority module; under normal time synchronization conditions, each 1-second boundary corresponds to a specific sampling timestamp. If the unified time synchronization interruption reaches 1800 seconds, the node's time base is maintained by the local oven-controlled crystal oscillator, and a time synchronization interruption flag is set in the event bitmap corresponding to that second.

[0032] The rule determination unit is responsible for performing deterministic judgments on the node combination sampling records. Internally, the rule determination unit stores a threshold table, a rate of change table, a dual-channel voting table, a timing interruption table, a seal opening table, a node restart table, and a power-off end-of-write table. Specifically, the threshold table determines whether the three sampled values ​​exceed preset safety boundaries; the rate of change table determines whether the rate of change between two or three consecutive seconds exceeds the allowable range; the dual-channel voting table determines whether inconsistencies occur in the dual-loop sampling results (for key parameters in furnace negative pressure signals, steam drum water level signals, bearing vibration signals, and condenser vacuum signals, the field acquisition nodes set a main sampling channel and a verification sampling channel; the rule determination unit performs a consistency comparison on the sampling results of the main sampling channel and the verification sampling channel, and when the difference exceeds a preset difference threshold, a dual-channel voting divergence event flag is placed in the event bitmap corresponding to that second); the timing interruption table records the timing interruption duration threshold; the seal opening table records the physical anti-tamper monitoring status; the node restart table records node reset and restart events; and the power-off end-of-write table records whether the node completed the final frame write to disk before and after a power outage. The rule determination unit determines events in the following ways: when the furnace negative pressure signal is lower than the preset negative pressure lower limit threshold, a threshold exceedance event flag is set; when the increase of the bearing vibration signal in two consecutive sampling cycles exceeds the preset rate of change threshold, a rate of change exceedance event flag is set; when the unified timing signal is interrupted for 1800 seconds, a timing interruption event flag is set; when the seal detection structure of the archiving bin is in the open state, a seal open event flag is set.

[0033] The data encapsulation unit is responsible for organizing the node combination sampling records for that second into node combination evidence frames. The fields in the node combination evidence frame have a fixed order and include: plant identifier, unit identifier, area identifier, node identifier, three-channel identifier, three-channel parameter code, three-channel parameter value, three-channel unit code, sampling timestamp, event bitmap, witness piece sequence number, witness grid sequence number, previous hash, current frame hash, and node signature. Specifically, the witness piece sequence number is accumulated hourly within the node; the witness grid sequence number increments from 0 to 3599 within the current hour; the previous hash is constructed from the current frame hash of the previous node combination evidence frame; the current frame hash is calculated from all fields of the current node combination evidence frame except for the node signature field; and the node signature is completed by a secure key chip to ensure that the signature private key is not exposed in the general-purpose processor environment.

[0034] Each field acquisition node generates one node combination evidence frame per second, specifically as follows: The first field acquisition node simultaneously obtains three sampling results—furnace negative pressure, steam drum water level, and feedwater flow rate—within each 1-second sampling cycle. Traditional methods might encapsulate these three sampling results into three separate records, while this invention combines them into a single node combination sampling record, which is further encapsulated into a single node combination evidence frame. The second, third, and fourth field acquisition nodes employ the same method. Thus, any single field acquisition node generates a fixed 3600 node combination evidence frames per hour, perfectly consistent with the 3600 witness grids per hour. When one event occurs within the same second, the corresponding event flag is set in the event bitmap; when two or more events occur within the same second, the corresponding event flags are set simultaneously. For example, if a timing interruption condition is met and a node restart is detected in a certain second, the 5th and 6th event flags are set simultaneously and written into the same node combination evidence frame.

[0035] The metal witness strip is 120 mm long, 120 mm wide, and 0.10 mm thick. It uses a corrosion-resistant metal substrate and has pre-drilled boundary positioning areas and clamping holes around its perimeter. A recording area, measuring 90 mm × 90 mm, is located in the center of the metal witness strip. This recording area contains a 60 × 60 witness grid array, totaling 3600 witness grids. The center-to-center distance between each witness grid is 1.5 mm. A summary area is located on one side of the recording area. This summary area records the witness strip number, node identifier, 128-bit hour digest code, and 32-bit error correction code. Both the summary and recording areas are written using the same galvanometer laser writing mechanism, but the data content differs: the recording area is mapped to second-level data, while the summary area is mapped to hour-level data. The witness grid numbers are mapped using a row-major order. Specifically: the first row corresponds to witness grid numbers 0 to 59 from left to right; the second row corresponds to witness grid numbers 60 to 119 from left to right; and so on, with the sixtieth row corresponding to witness grid numbers 3540 to 3599 from left to right. For any given second of node combination evidence frame, only the witness piece number and witness grid number are needed to locate a unique witness grid on the physical witness piece.

[0036] The physical witness unit employs a galvanometer laser writing mechanism for non-contact writing. This mechanism is fixedly mounted inside a sealed housing, which incorporates a dust filter layer, a temperature insulation layer, and a positive pressure micro-blowing structure to reduce dust adhesion and thermal drift. Compared to traditional mechanical stamping heads, this writing method eliminates the need for continuous impact on the metal medium, does not rely on long-distance transmission mechanisms, and does not use a continuous ratchet propulsion structure, making it more suitable for long-term operation in power plant environments. Every one-second interval, the physical witness unit controls the galvanometer laser writing mechanism to write four types of content to the corresponding witness cell based on its current witness cell number: the first is a time placeholder marker, indicating which second of the current hour the witness cell corresponds to; the second is an event bitmap short code, recording whether an event exists in that second and the event type combination; the third is a short digest code, recording the 16-bit truncation result of the hash of the corresponding node combination evidence frame for that second; and the fourth is a checksum, verifying whether the witness cell has been correctly read. Every 3600 seconds, all 3600 witness cells on the current metal witness plate are filled. At this point, the data encapsulation unit calculates a 128-bit hourly digest code according to the fixed order of the 3600 node combination evidence frames in the current hour, and writes the hourly digest code into the digest area. Simultaneously, a 32-bit error correction code is generated and written along with the digest code. After the digest area is written, the physical witness unit sends the current metal witness sheet to the archiving bin and the next metal witness sheet to the writing station to begin recording for the next hour.

[0037] To accommodate long-term operation in the field, each metal witness box contains 720 metal witness films, with each film corresponding to one hour. Therefore, a single metal witness film box corresponds to 30 days of continuous operation. After 30 days, maintenance personnel replace the metal witness film box and transfer the full box as the original physical evidence for archiving. The archiving compartment is used to temporarily store full metal witness films; once a witness film enters the archiving compartment, it is not returned to the writing station. The archiving compartment is equipped with a sealing structure and an opening detection structure. Once the archiving compartment is opened, the sealing monitoring unit immediately places a sealing opening marker in the current second's event bitmap and simultaneously writes the corresponding node combined evidence frame and the corresponding witness cell to create a field record.

[0038] The partition aggregator, located within the production control area, receives node-combined evidence frames from various field acquisition nodes and writes them to the write-once-read-many storage area in a unified order. The partition aggregator includes at least a receiving interface, a sorting module, a circular buffer, an event evidence packet freezing module, a write-once-read-many storage module, a read-only copy output module, and an independent power supply unit. The sorting module uniformly sorts node-combined evidence frames from different field acquisition nodes according to the sampling timestamp, node identifier, witness piece sequence number, and witness grid sequence number. The circular buffer has a length of 180 seconds and is used to retain node-combined evidence frames from the most recent 180 seconds. Once the partition aggregator receives a node-combined evidence frame with an event bitmap set, the event evidence packet freezing module extracts data from the circular buffer from 30 seconds before the event to the time of the event, while continuing to receive data from 120 seconds after the event, ultimately forming a complete event evidence packet. After the event evidence packet is formed, it is written to the write-once-read-many storage area along with the original node-combined evidence frames from the corresponding time period. The independent power supply unit ensures data integrity in the event of a power outage. When the external power supply is interrupted, the independent power supply unit continues to supply power to the partition aggregator for 180 seconds to ensure that the event evidence packets being formed and the write-once-read-many storage content to be written can be completely written to the disk.

[0039] The partition aggregator is connected to the evidence repository via a unidirectional output link. This unidirectional output link only allows data to flow from the partition aggregator to the evidence repository; it prohibits the evidence repository from sending any write, modification, or configuration commands to the production control area. This maintains boundary security on the production side while ensuring that evidence copies are independently stored. The evidence repository receives the following: 1) read-only copies of node-combined evidence frames; 2) read-only copies of event evidence packets; 3) chained sequence information generated by the partition aggregator; 4) node signature verification results; 5) verification results corresponding to witness pieces; and 6) sampling reports and archived records. During the verification process, the evidence repository uses the witness piece sequence number as the organizational thread. Specifically, the evidence repository extracts 3600 node-combined evidence frames corresponding to the same witness piece sequence number, recalculates the digital hour digest code in a fixed order, and reads the physical hour digest code uploaded by a portable witness reader. If the two match, the verification of the witness piece is output as passed; if they do not match, the verification of the witness piece is output as failed, and a single-second sampling mechanism is further invoked to compare the short digest code in the witness grid with the current frame hash truncation result of the corresponding node combined evidence frame item by item.

[0040] The portable witness reader includes a witness piece holder, positioning pins, a plane illumination module, an optical reading head, a surface scratch recognition head, an error correction decoding unit, a serial number parsing unit, and a verification output unit. In use, maintenance personnel place the metal witness piece to be inspected on the witness piece holder. The positioning pin engages with the witness piece positioning hole to ensure stable reading coordinates. The plane illumination module provides constant illumination. The optical reading head reads the marking information in the summary area, and the surface scratch recognition head reads the fine writing marks in the recording area. The error correction decoding unit first verifies the 32-bit error correction code in the summary area, then outputs a 128-bit physical hour summary code and the witness piece serial number. The verification output unit uploads the reading results to the evidence library, which performs further consistency verification. When second-level sampling is required, the portable witness reader can also read the time placeholder mark, event bitmap short code, short summary code, and check code in the target witness cell according to the specified witness cell serial number, and send the reading results to the evidence library. The evidence library locates the corresponding node combination evidence frame based on the witness piece serial number and witness cell serial number, and performs item-by-item comparison.

[0041] Taking a thermal power unit as an example, the first field acquisition node is installed in the instrument area on the boiler front wall, the second field acquisition node is installed near the turbine head, the third field acquisition node is installed in the circulating water system control area, and the fourth field acquisition node is installed in the medium-voltage switchgear area. Assuming that the second field acquisition node detects a bearing vibration value exceeding the threshold within the sampling period corresponding to 14:25:10, and simultaneously the overspeed trigger signal changes from non-triggered to triggered, then the combined sampling record for that second node contains at least three data streams: bearing vibration sampling value, overspeed trigger status, and lubricating oil pressure sampling value. After the rule judgment unit performs a judgment on the data for that second, it simultaneously places the threshold overrun marker bit in the event bitmap. If the overspeed trigger status belongs to a threshold event or a status overrun event, it is also reflected in the same event bitmap. Subsequently, the data encapsulation unit generates the node combined evidence frame corresponding to that second and assigns the current witness piece sequence number and the current witness grid sequence number. The physical witness unit writes the content of that second into the corresponding witness grid. Once the partition aggregator detects a set bit in the event bitmap of the combined evidence frame for that second node, it immediately initiates the event evidence package process. This process completely writes the data from 30 seconds before the event to 120 seconds after the event into the write-once-read-many storage area and sends it to the evidence repository. If the authenticity of the records within that hour needs to be verified later, the metal witness piece with the corresponding witness piece number can be removed. A portable witness reader is used to read the physical hour digest code in the digest area. The evidence repository then extracts the digital hour digest code from the 3600 combined evidence frames corresponding to that witness piece number for comparison. If they match, the digital record for that hour is consistent with the physical witness. If they do not match, the error correction code in the digest area and the short digest code of the specified witness cell are further checked to pinpoint the specific second or record where the discrepancy occurred.

[0042] Operation and Maintenance Method: Replace the metal witness card box every 30 days and seal any full witness card boxes in the archiving bin. Every 7 days, randomly select one currently in use metal witness card for a reading test to verify the readability of the summary area and witness slots. Every 30 days, perform a calibration check on the alignment accuracy of the galvanometer laser writing mechanism. Every 30 days, verify the positioning accuracy, error correction decoding capability, and summary reading success rate of the portable witness reader. Each time the archiving bin is opened, the seal opening event must be recorded, and the corresponding opening time and operational responsibility information must be stored in the evidence database. Each time a node restarts, it must be checked whether the event evidence package for the corresponding time period has been formed. After each external power outage, it must be checked whether the independent power supply unit has completed the 180-second power supply task and whether the corresponding event evidence package has been completely written to disk.

Claims

1. A data acquisition method for power plant safety management, characterized in that, Includes the following steps: S1. Set up a first field acquisition node on the boiler island, a second field acquisition node on the turbine island, a third field acquisition node on the cold end system, and a fourth field acquisition node on the electrical system, and set up a time authority module, a zone aggregator, a unidirectional output link, and an evidence library. S2. The first field acquisition node, the second field acquisition node, the third field acquisition node and the fourth field acquisition node synchronously acquire the field signals they receive according to a 1-second sampling period, and merge all the sampled values ​​obtained by the same field acquisition node in the same second into a node combination sampling record. At the same time, the rule judgment unit performs a judgment on the node combination sampling record and outputs the event bitmap corresponding to the second. S3. The data encapsulation unit inside each field acquisition node encapsulates the node combination sampling record, sampling timestamp, witness piece sequence number, witness grid sequence number, previous hash, current frame hash and node signature into a node combination evidence frame. Each field acquisition node generates only one node combination evidence frame per second. S4. The physical witnessing unit inside each field acquisition node writes the corresponding witnessing grid on the metal witnessing sheet according to the witnessing grid number. One witnessing grid is written every second, and a metal witnessing sheet is filled every 3600 seconds. The hourly digest code calculated by the 3600 node combination evidence frames generated by the field acquisition node within the 3600 seconds is written in the digest area of ​​the metal witnessing sheet. S5. The partition aggregator receives the node combination evidence frames sent by each field acquisition node and writes them into the write-once-read-many storage area in the order of sampling timestamp, node identifier, witness piece number and witness grid number to form a tamper-proof evidence chain. S6. The partition aggregator sends a read-only copy of the tamper-proof evidence chain to the evidence library via a one-way output link; S7. Read 3600 node combination evidence frames corresponding to the same witness piece number from the evidence library, generate a digital hour digest code, and use a portable witness reader to read the physical hour digest code in the corresponding metal witness piece digest area, and verify the consistency between the digital hour digest code and the physical hour digest code.

2. The data acquisition method for power plant safety management according to claim 1, characterized in that: The first field acquisition node receives the furnace negative pressure signal, the steam drum water level signal, and the feedwater flow signal; the second field acquisition node receives the bearing vibration signal, the overspeed trigger signal, and the lubricating oil pressure signal; the third field acquisition node receives the circulating water inlet temperature signal, the circulating water outlet temperature signal, and the condenser vacuum signal; and the fourth field acquisition node receives the circuit breaker open position signal, the circuit breaker closed position signal, and the trip trigger signal.

3. The data acquisition method for power plant safety management according to claim 1, characterized in that: The time authority module sends a unified time synchronization signal to the first field acquisition node, the second field acquisition node, the third field acquisition node, the fourth field acquisition node, and the partition aggregator. The unified time synchronization signal adopts the IEEE 1588 precision time protocol. When the unified time synchronization signal is interrupted for 1800 seconds, the time reference unit inside the corresponding field acquisition node switches to a local temperature-controlled crystal oscillator to maintain the time synchronization, and the rule determination unit sets a time synchronization interruption flag bit in the event bitmap corresponding to that second.

4. The data acquisition method for power plant safety management according to claim 1, characterized in that: The event bitmap consists of 7 event flag bits; the first event flag bit indicates a threshold out-of-bounds event, the second event flag bit indicates a rate of change out-of-bounds event, the third event flag bit indicates a dual-channel voting divergence event, the fourth event flag bit indicates a seal opening event, the fifth event flag bit indicates a time synchronization interruption event, the sixth event flag bit indicates a node restart event, and the seventh event flag bit indicates a power failure ending write event. When two or more events occur at the same field acquisition node within the same second, the corresponding event flag bits are set simultaneously, and the setting results are written into the same node combined evidence frame and the same witness grid.

5. The data acquisition method for power plant safety management according to claim 1, characterized in that: The node combined evidence frame includes plant identifier, unit identifier, area identifier, node identifier, three-channel identifier, three-channel parameter code, three-channel parameter value, three-channel unit code, sampling timestamp, event bitmap, witness piece sequence number, witness grid sequence number, preceding hash, current frame hash, and node signature; the preceding hash is composed of the current frame hash of the previous node combined evidence frame; the current frame hash is calculated from all fields of the current node combined evidence frame except for the node signature field; the node signature is generated by the security key chip inside the field acquisition node; the witness grid sequence number is from 0 to 3599, and the witness grid sequence number is mapped to a unique witness grid in the 60×60 witness grid array on the metal witness piece in row priority order.

6. The data acquisition method for power plant safety management according to claim 1, characterized in that: The metal witness sheet is 120 mm long, 120 mm wide, and 0.10 mm thick; a 60×60 witness grid array is arranged within a 90 mm×90 mm recording area; the center-to-center distance of a single witness grid is 1.5 mm; the metal witness sheet has a summary area adjacent to the recording area; the physical witness unit uses a galvanometer laser writing mechanism to perform non-contact writing on the recording area and the summary area; after every 3600 seconds, the physical witness unit sends the current metal witness sheet into the archiving bin and sends the next metal witness sheet into the writing station.

7. A data acquisition method for power plant safety management according to claim 6, characterized in that: The metal witness film box contains 720 metal witness films; each metal witness film corresponds to a 1-hour sampling period. The continuous working time of a single metal witness box is 30 days; replace the metal witness box after 30 days.

8. A data acquisition method for power plant safety management according to claim 6, characterized in that: Each witness cell contains a time placeholder, an event bitmap short code, a short digest code, and a check code. The short digest code is formed by truncating 16 bits of the hash of the evidence frame of the node combination evidence frame corresponding to the witness cell number. The digest area contains the witness piece number, node identifier, 128-bit hour digest code, and 32-bit error correction code. After the portable witness reader reads the digest area, it first verifies the 32-bit error correction code and then outputs the 128-bit hour digest code.

9. A data acquisition method for power plant safety management according to claim 1, characterized in that: The partition aggregator is equipped with a 180-second circular buffer and an independent power supply unit. When a set event exists in the event bitmap of any node combined evidence frame, the partition aggregator freezes the node combined evidence frames from 30 seconds before the event to the time of the event, and continues to receive node combined evidence frames for 120 seconds after the event to form an event evidence packet.

10. A data acquisition method for power plant safety management according to claim 9, characterized in that: The independent power supply unit continues to supply power to the partition aggregator for 180 seconds after an external power outage to ensure that the event evidence packet is completely written to the write-once-read-many storage area.

Images