An endogenous security-based power security zone isolation device

Abstract

A power safety zone isolation device based on endogenous safety, upstream area is connected with input end of double-redundancy isolation module group through Ethernet link, output end of double-redundancy isolation module group is divided into two ways: one way is connected with data temporary storage and cleaning module, another way is connected with mirror port of endogenous safety monitoring module; main control unit is located at the center position, and is connected with double-redundancy isolation module group, endogenous safety monitoring module and dynamic switching module through different buses; relay contact of dynamic switching module is connected in series in the link between double-redundancy isolation module group and downstream area; power module is connected with all modules through power supply line.The utility model realizes "module fault does not interrupt, power failure does not go off-line". Four-level protection of protocol filtering + physical isolation + data verification + cleaning, power service data misintercept rate is less than or equal to 0.05%, transmission delay is less than or equal to 180ms. Endogenous safety monitoring module collects 12 key parameters in real time, and meets the real-time requirement of power system.

Description

Technical Field

[0001] This utility model relates to the field of power system security protection technology, specifically an isolation device for achieving physical isolation and secure data transmission between power security zone I (production control zone) and zone II (non-control production zone), and between zone II and zone III (management information zone), based on an inherent security mechanism. Background Technology

[0002] According to the "Regulations on Security Protection of Power Monitoring Systems," the power security zone is divided into the production control zone (Zone I / II) and the management information zone (Zone III / IV). These zones require isolation devices to achieve "secure isolation and limited interconnection." Existing isolation devices mostly rely on single physical isolation or static access control, which has the following drawbacks: Defect 1. Insufficient inherent security: Lack of module-level redundancy and fault self-healing capability; failure of a single module can easily lead to isolation failure or data transmission interruption.

[0003] Defect 2. Single protection level: Basic isolation is achieved only through protocol filtering, and no dedicated verification and cleaning mechanism is designed for power business data (such as SCADA real-time data and distribution network dispatch instructions).

[0004] Defect 3. Lack of status monitoring: The operating status of the isolation module cannot be monitored in real time. After an abnormality is triggered, manual intervention is required for switching, and the response delay exceeds the 500ms threshold allowed by the power system.

[0005] Therefore, it is necessary to design an isolation device with inherent safety characteristics of "redundancy and fault tolerance, real-time monitoring, and dynamic protection" to address the safety shortcomings of existing devices. Utility Model Content

[0006] To address the problems existing in the prior art, this utility model provides a power safety regional isolation device based on intrinsic security.

[0007] The technical solution adopted by this utility model to solve its technical problem is: An intrinsically safe power safety regional isolation device is disclosed. The device has a box-like structure, and its internal controller unit includes a main control unit, a dual-redundant isolation module group, an intrinsic safety monitoring module, a dynamic switching module, a data storage and cleaning module, and a power supply module. Each module is connected to an industrial-grade Ethernet bus via a silver-plated copper busbar. Specifically, the upstream regional isolation area is connected to the input of the dual-redundant isolation module group via an Ethernet link. The output of the dual-redundant isolation module group is divided into two paths: one connected to the data storage and cleaning module, and the other connected to the mirror port of the intrinsic safety monitoring module. The main control unit is located centrally and is connected to the dual-redundant isolation module group, the intrinsic safety monitoring module, and the dynamic switching module via different buses. The relay contacts of the dynamic switching module are connected in series in the link between the dual-redundant isolation module group and the downstream regional isolation area. The power supply module is connected to all modules via power supply lines.

[0008] This utility model also has the following additional technical features: As a further specific optimization of the technical solution of this utility model: the main control unit adopts a dual-core ARM Cortex-A9 processor, a power-specific FPGA chip, and 256MB DDR3 cache. The input terminals of both modules of the main control unit are connected to the upstream region via RJ45 interfaces, and the output terminals are connected to the downstream region via RJ45 interfaces. Both modules also communicate bidirectionally with the main control unit and the dynamic switching module via a CAN bus.

[0009] As a further specific optimization of the technical solution of this utility model: the main control unit, as the core coordination unit of the device, receives the status signals from the intrinsic security monitoring module, sends switching commands to the dynamic switching module, and simultaneously parses the power business data protocol. The main control unit is connected to the dual redundant isolation module group via SPI bus, connected to the intrinsic security monitoring module via RS485 interface, and connected to the data temporary storage and cleaning module via Ethernet interface.

[0010] As a further specific optimization of the technical solution of this utility model: the dual-redundant isolation module group includes a main isolation module and a backup isolation module. The two modules have completely identical structures, both including a protocol filtering unit, a physical isolation unit, and a data verification unit. Wherein: As a further specific optimization of the technical solution of this utility model: the protocol filtering unit adopts a dedicated ASIC chip, presets a whitelist of allowed protocols for power services, and blocks protocols not on the whitelist.

[0011] As a further specific optimization of the technical solution of this utility model: the physical isolation unit has two sets of independent optocoupler isolation circuits built in, so as to realize electrical isolation of I / O ports.

[0012] As a further specific optimization of the technical solution of this utility model: the data verification unit integrates the SHA-256 hash verification module and the power data format verification subunit.

[0013] As a further specific optimization of the technical solution of this utility model: the intrinsic security monitoring module includes 3 current sensors, 2 voltage sensors, 1 message analysis subunit, and 1 temperature sensor.

[0014] As a further specific optimization of the technical solution of this utility model: the intrinsic safety monitoring module collects the electrical parameters (current 0~5A, voltage 0~220V), data frame integrity, and temperature of the dual redundant isolation module in real time, and sends a status message to the main control unit once every 100ms.

[0015] As a further specific optimization of the technical solution of this utility model: the sensor probe of the intrinsic security monitoring module is connected to the power supply and data terminals of the dual redundant isolation module through a terminal block, the message analysis subunit is connected to the Ethernet link of the isolation module through a mirror port, and the output terminal is connected to the main control unit through an RS485 interface.

[0016] As a further specific optimization of the technical solution of this utility model: the dynamic switching module adopts 2 sets of electromagnetic relays and 1 set of switching logic circuit.

[0017] As a further specific optimization of the technical solution of this utility model: the dynamic switching module receives instructions from the main control unit to realize seamless switching of the dual redundant isolation modules. When the main module fails, it automatically switches to the backup module and automatically switches back to the main module after the fault is recovered.

[0018] As a further specific optimization of the technical solution of this utility model: the input end of the dynamic switching module is connected to the main control unit through a CAN bus, and the output end is connected in series with the power supply end and data end of the dual redundant isolation module through relay contacts to realize the on / off control of the module.

[0019] As a further specific optimization of the technical solution of this utility model: the data temporary storage and cleaning module includes a 16GB NAND Flash storage chip and a power data cleaning subunit.

[0020] As a further specific optimization of the technical solution of this utility model: the data temporary storage and cleaning module temporarily stores the data to be verified transmitted by the dual redundant isolation module, and after cleaning, it is forwarded to the downstream region through the main control unit.

[0021] As a further specific optimization of the technical solution of this utility model: the input end of the data temporary storage and cleaning module is connected to the output end of the dual redundant isolation module through an Ethernet interface, and the output end is connected to the main control unit through an SPI bus.

[0022] As a further specific optimization of the technical solution of this utility model: the power supply module adopts a dual-redundant switching power supply and a power monitoring subunit.

[0023] As a further specific optimization of the technical solution of this utility model: the power supply module provides stable power supply for all the above modules, and the other power supply is automatically switched on when one power supply fails.

[0024] As a further specific optimization of the technical solution of this utility model: the output terminal of the power module is connected to the power interfaces of the main control unit, the dual redundant isolation module group, the intrinsic safety monitoring module, etc., respectively through the terminal block.

[0025] Compared with the prior art, the advantages of this utility model are: Advantage 1. Significantly improved inherent safety: Dual redundant isolation modules + dual power supply redundancy, achieving "no interruption in module failure and no downtime in power failure", with a fault self-repair rate of 99.9%.

[0026] Advantage 2. Protection levels adapted to power requirements: four-level protection of protocol filtering + physical isolation + data verification + cleaning, power business data false interception rate ≤0.05%, transmission delay ≤180ms.

[0027] Advantage 3. Status is monitorable and controllable: The intrinsic safety monitoring module collects 12 key parameters in real time, and the abnormal response time is ≤200ms, which meets the real-time requirements of the power system. Attached Figure Description

[0028] Figure 1 This is a schematic diagram of the module connection of this utility model. Detailed Implementation

[0029] Exemplary embodiments of the present invention will now be described in more detail with reference to the accompanying drawings.

[0030] An intrinsically safe power safety regional isolation device is disclosed. The device has a box-like structure, and its internal controller unit includes a main control unit, a dual-redundant isolation module group, an intrinsic safety monitoring module, a dynamic switching module, a data storage and cleaning module, and a power supply module. All modules are connected to an industrial-grade Ethernet bus via silver-plated copper busbars. Specifically, the upstream regional isolation area is connected to the input of the dual-redundant isolation module group via an Ethernet link. The output of the dual-redundant isolation module group is divided into two paths: one connected to the data storage and cleaning module, and the other connected to the mirror port of the intrinsic safety monitoring module. The main control unit is located centrally and is connected to the dual-redundant isolation module group, the intrinsic safety monitoring module, and the dynamic switching module via different buses. The relay contacts of the dynamic switching module are connected in series in the link between the dual-redundant isolation module group and the downstream regional isolation area. The power supply module is connected to all modules via power supply lines.

[0031] (1) Description of the composition, function and connection relationship of the main control unit: Composition: It adopts a dual-core ARM Cortex-A9 processor (1.2GHz), a power-specific FPGA chip (XilinxArtix-7), and 256MB DDR3 cache.

[0032] Function: As the core coordination unit of the device, it receives status signals from the intrinsic safety monitoring module, sends switching commands to the dynamic switching module, and parses power business data protocols (such as IEC61850, DL / T634.5).

[0033] Connection relationships: Connected to the dual redundant isolation module group via SPI bus, connected to the intrinsic safety monitoring module via RS485 interface, and connected to the data storage and cleaning module via Ethernet interface.

[0034] (2) Description of the composition, function and connection relationship of the dual-redundant isolation module group (core isolation component): Composition: Includes a main isolation module and a backup isolation module. The two modules have completely identical structures and both include: Protocol filtering unit: Uses a dedicated ASIC chip (model BCM56850), with a preset whitelist of allowed protocols for power services (IEC61850MMS, IEC104, MODBUS-TCP), and blocks protocols not on the whitelist.

[0035] Physical isolation unit: Built-in two sets of independent optocoupler isolation circuits (isolation voltage 5000Vrms) to achieve electrical isolation of I / O ports.

[0036] Data verification unit: integrates SHA-256 hash verification module and power data format verification subunit (verifies APPID, length field and checksum of IEC61850 message).

[0037] Function: When the main module is working normally, it is responsible for the isolated transmission of data in the region, while the standby module is in hot standby mode.

[0038] Connection relationship: The input terminals of both modules are connected to the upstream region (such as region I) via RJ45 interface, and the output terminals are connected to the downstream region (such as region II) via RJ45 interface. Both modules communicate bidirectionally with the main control unit and dynamic switching module via CAN bus.

[0039] (3) Description of the composition, function and connection relationship of the endogenous safety monitoring module: Composition: Includes 3 current sensors (monitoring the power supply current of the isolation module), 2 voltage sensors (monitoring the input / output voltage of the isolation module), 1 message analysis subunit (parses the power data frames transmitted by the isolation module), and 1 temperature sensor (monitoring the module's operating temperature, range -40~85℃).

[0040] Functions: Real-time acquisition of electrical parameters (current 0~5A, voltage 0~220V), data frame integrity (packet loss rate ≤0.01%), and temperature (alarm triggered when temperature exceeds 70℃) of the dual redundant isolation module, and sending a status message to the main control unit every 100ms.

[0041] Connection relationship: The sensor probe is connected to the power supply and data terminals of the dual redundant isolation module through the terminal block. The message analysis subunit is connected to the Ethernet link of the isolation module through the mirror port, and the output terminal is connected to the main control unit through the RS485 interface.

[0042] (4) Description of the composition, function and connection relationship of the dynamic switching module: Composition: It adopts 2 sets of electromagnetic relays (model OMRONG5LE) and 1 set of switching logic circuit (based on 51 microcontroller).

[0043] Function: Receives instructions from the main control unit to achieve seamless switching between dual redundant isolation modules (switching time ≤ 50ms). When the main module fails (such as abnormal current or excessive packet loss), it automatically switches to the backup module and automatically switches back to the main module after the fault is recovered.

[0044] Connection relationship: The input end is connected to the main control unit via CAN bus, and the output end is connected in series with the power supply and data end of the dual redundant isolation module via relay contacts to realize the module on / off control.

[0045] (5) Description of the composition, function, and connection relationship of the data temporary storage and cleaning module: Composition: Includes a 16GB NAND Flash memory chip and a power data cleaning subunit (filters invalid messages, such as IEC61850 messages with abnormal length or incorrect address).

[0046] Function: Temporarily store the data to be verified transmitted by the dual redundant isolation module (temporary storage time ≤ 1s), and then forward it to the downstream region through the main control unit after cleaning.

[0047] Connection relationship: The input end is connected to the output end of the dual redundant isolation module via an Ethernet interface, and the output end is connected to the main control unit via an SPI bus.

[0048] (6) Description of the composition, function, and connection relationship of the power supply module: Composition: It adopts a dual-redundant switching power supply (input AC220V±10%, output DC24V / 5A) and a power monitoring subunit (monitors output voltage fluctuations, and triggers an alarm if the fluctuation exceeds ±5%).

[0049] Function: Provides stable power supply for all the above modules, and automatically switches on the other power supply when one power supply fails (switching time ≤ 10ms).

[0050] Connection relationship: The output terminal is connected to the power interface of the main control unit, the dual redundant isolation module group, the intrinsic safety monitoring module, etc. through the terminal block.

[0051] Instructions for the deployment and use of power safety zone isolation devices: Device deployment: The isolation device is installed in the cabinet at the boundary of the power safety zone. The upstream RJ45 interface is connected to the SCADA system switch in Zone I, and the downstream RJ45 interface is connected to the distribution network monitoring system switch in Zone II. The power supply is connected to the cabinet via dual AC220V power supply.

[0052] Normal operation: The main control unit enables the main isolation module by default. SCADA data from Zone I is transmitted to the data storage and cleaning module after protocol filtering (only IEC61850MMS messages are allowed), physical isolation, and data verification by the main isolation module. Invalid messages are cleaned and then forwarded to Zone II. The intrinsic safety monitoring module collects the main module's current (normal range 1~1.5A), temperature (normal range -10~60℃), and packet loss rate (normal ≤0.01%) every 100ms and sends them to the main control unit.

[0053] Fault switching: When the temperature of the main isolation module exceeds 70℃, the intrinsic safety monitoring module sends an "abnormal message" to the main control unit. The main control unit immediately sends a "switching command" to the dynamic switching module, the electromagnetic relay is activated (switching time 45ms), the backup isolation module is activated, and at the same time a "main module fault" alarm is sent to the remote monitoring center through the RS485 interface.

[0054] Fault recovery: After the main module temperature drops below 60℃, the intrinsic safety monitoring module sends a "recovery message", the main control unit controls the dynamic switching module to switch back to the main module, and the standby module returns to hot standby status.

[0055] The above detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention.

Claims

1. A power safety regional isolation device based on intrinsic security, characterized in that: This isolation device has a box-like structure. The internal controller unit includes a main control unit, a dual-redundant isolation module group, an intrinsic safety monitoring module, a dynamic switching module, a data storage and cleaning module, and a power supply module. Each module is connected to an industrial-grade Ethernet bus via a silver-plated copper busbar. Specifically, the upstream area is connected to the input of the dual-redundant isolation module group via an Ethernet link. The output of the dual-redundant isolation module group is divided into two paths: one connects to the data storage and cleaning module, and the other connects to the mirror port of the intrinsic safety monitoring module. The main control unit is located in the center and is connected to the dual-redundant isolation module group, the intrinsic safety monitoring module, and the dynamic switching module via different buses. The relay contacts of the dynamic switching module are connected in series in the link between the dual-redundant isolation module group and the downstream area. The power supply module is connected to all modules via power supply lines.

2. The power safety regional isolation device based on intrinsic security according to claim 1, characterized in that: The main control unit adopts a dual-core ARM Cortex-A9 processor, a power-specific FPGA chip, and 256MB DDR3 cache. The input terminals of both modules of the main control unit are connected to the upstream region via RJ45 interfaces, and the output terminals are connected to the downstream region via RJ45 interfaces. Both modules communicate bidirectionally with the main control unit and the dynamic switching module via CAN bus.

3. The power safety regional isolation device based on intrinsic security according to claim 1, characterized in that: The main control unit, as the core coordination unit of the device, receives the status signals from the intrinsic security monitoring module, sends switching commands to the dynamic switching module, and parses the power business data protocol. The main control unit is connected to the dual redundant isolation module group through the SPI bus, connected to the intrinsic security monitoring module through the RS485 interface, and connected to the data storage and cleaning module through the Ethernet interface. The dual-redundant isolation module group includes a primary isolation module and a backup isolation module. The two modules have identical structures, both including a protocol filtering unit, a physical isolation unit, and a data verification unit; wherein: The protocol filtering unit uses a dedicated ASIC chip, with a pre-defined whitelist of allowed protocols for power services, and blocks protocols not on the whitelist. The physical isolation unit has two sets of independent optocoupler isolation circuits built in, which realize electrical isolation of I / O ports; The data verification unit integrates the SHA-256 hash verification module and the power data format verification subunit.

4. The power safety regional isolation device based on intrinsic security according to claim 1, characterized in that: The intrinsic security monitoring module includes 3 current sensors, 2 voltage sensors, 1 message analysis subunit, and 1 temperature sensor. The intrinsic safety monitoring module collects the electrical parameters (current 0~5A, voltage 0~220V), data frame integrity, and temperature of the dual redundant isolation module in real time, and sends a status message to the main control unit once every 100ms. The sensor probe of the intrinsic security monitoring module is connected to the power supply and data terminals of the dual redundant isolation module via a terminal block. The message analysis subunit is connected to the Ethernet link of the isolation module via a mirror port, and the output terminal is connected to the main control unit via an RS485 interface.

5. A power safety regional isolation device based on intrinsic security according to claim 1, characterized in that: The dynamic switching module uses two sets of electromagnetic relays and one set of switching logic circuits. The dynamic switching module receives instructions from the main control unit to achieve seamless switching between the dual redundant isolation modules. When the main module fails, it automatically switches to the backup module and automatically switches back to the main module after the fault is recovered. The input of the dynamic switching module is connected to the main control unit via a CAN bus, and the output is connected in series with the power supply and data terminals of the dual redundant isolation module via relay contacts to realize the on / off control of the module.

6. The power safety area isolation device based on intrinsic security according to claim 1, characterized in that: The data temporary storage and cleaning module includes a 16GB NAND Flash storage chip and a power data cleaning subunit; The data storage and cleaning module temporarily stores the data to be verified transmitted by the dual redundant isolation module, and after cleaning, it forwards it to the downstream region through the main control unit. The input of the data storage and cleaning module is connected to the output of the dual redundant isolation module via an Ethernet interface, and the output is connected to the main control unit via an SPI bus.

7. A power safety regional isolation device based on intrinsic security according to claim 1, characterized in that: The power module adopts a dual-redundant switching power supply and a power monitoring subunit. The power module provides stable power to all the above modules, and automatically switches on when one power supply fails. The output terminal of the power module is connected to the power interfaces of the main control unit, the dual redundant isolation module group, and the intrinsic safety monitoring module through terminal blocks.

Images