Method and apparatus for data separation between safety control applications and process control applications

Abstract

The method for data separation between safety and process control applications includes the step S1 of allocating an exchange data area to a safety / process control task, and the step S2 of performing data separation exchange between the safety and process control applications based on the allocated exchange data area. The apparatus for data separation between safety and process control applications includes at least two systems of multi-channel architecture, each channel includes a separated safety data area and a process data area, the process control task can read but cannot rewrite the process exchange input area while not being able to rewrite the safety data area, and the safety control task can read but cannot rewrite the safety exchange input data area while not being able to directly access the process data area.

Description

Related Applications

[0001] This application claims priority to a Chinese patent application filed on December 29, 2020, bearing application number 202011590531.2 and entitled "Method and Apparatus for Data Separation Between Safety and Process Control Applications," the entire contents of which are incorporated herein by reference. [Technical Field]

[0002] This application relates to the technical field of industrial process control, and more particularly to a method and apparatus for data separation between safety and process control applications. [Background technology]

[0003] In order to integrate the functional advantages of safety control systems and general process control systems, increase the flexibility of control system deployment and application development, and reduce the production and usage costs of control systems, there is an increasing need to support both safety control functions and process control functions within the same control system in industrial application fields such as oil and gas transportation and small-scale mission-critical system control.

[0004] Safety control functions require high reliability and availability and must be developed and implemented in accordance with relevant functional safety standards. In safety control applications, the safety control application that implements the safety control function generally includes safety input data (generally referring to safety input signal points such as DI and AI), safety control algorithms / function blocks, and safety output data (generally referring to safety output signal points such as DO). Generally, process data (including process input / output signal points, process intermediate variables, etc.) is not allowed to directly enter or affect the safety application, and the operation of the process control application should not directly affect the safety control application. Failure to do so would degrade the safety integrity of the safety control function. In other words, it is necessary to ensure separation between the safety control application and the process control application. Therefore, the process data accessed by the safety control application is limited and small in size.

[0005] In safety hybrid control systems, to ensure the functional integrity of safety control applications, a multi-channel voting system architecture is generally adopted to enhance fault tolerance. Each controller channel contains the same safety control application and process control application, and all control applications run independently. The control system selects one channel as the master channel and the other channels as slave channels according to a certain policy. Here, the safety control application outputs to the outside world through a specific software and hardware voting mechanism, while the process control application generally outputs from the master channel but not from the slave channel.

[0006] To ensure the fault tolerance of the control system and the availability of the process control function, the control system redundantly synchronizes the process data of the master channel to each slave channel. This data includes process input / output signal points and their associated process variables. The period required to complete one redundant synchronization is long, typically spanning multiple control cycles. The control system must avoid the problem of data rebound at the output of the safety application after the process data of the slave channels enters the safety control application. For example, if the process data changes (from data value A to data value B), the safety control application of each slave channel is affected by this process data (data value B) and immediately votes to output (output data value B). Subsequently, each slave channel receives the redundant process data (data value A) from the master channel within a short time. At this time, each slave channel is affected by this process data and immediately votes to output the data before the change (data value A). Only after each slave channel receives the redundant process data (data value B) from the master channel does it vote to output the changed data (data value B) under the influence of this process data.

[0007] In addition, in actual control application scenarios, the process data area, safety data area, and exchange data area are all structured data or a combination of multiple data. Therefore, if there is a possibility that multiple asynchronous tasks may read or write these data areas simultaneously, it is necessary to ensure mutual exclusivity of reading and writing between tasks. This prevents one task from reading data incompletely or incorrectly when another task reads the structured data while the other task is rewriting part of the structured data.

[0008] In related technology, there is a first processor for running non-safety applications and a second processor dedicated to running safe applications. The safe application has only one task, exchanges data through a global data area, and mutual exclusion protection is provided for shared access to the safety control and process control memories based solely on a microcontroller system. Summary of the Invention [Problem to be solved by the invention]

[0009] This application relates to the functional safety integrity, functional accuracy, and control response of safety control applications in industrial control systems with multitasking control and multi-channel operation. to ensure A method and apparatus for data separation between safety and process control applications is provided. [Means for solving the problem]

[0010] A first aspect of the present application provides a method for data separation between safety and process control applications, wherein the safety control application includes a safety data area and several safety control tasks including several safety control programs, and the process control application includes a process data area and several process control tasks including several process control programs, the method for data separation including step S1 of assigning an exchange data area to the safety control application / control tasks in the process control application, and step S2 of performing data separation exchange between the safety and process control applications based on the assigned exchange data area.

[0011] Furthermore, step S1 specifically includes a step of allocating independent safety exchange data areas of a size defined based on a first capacity threshold to several safety control tasks of the safety control application, where the safety exchange data areas include a safety exchange input data area and a safety exchange output data area, and a step of allocating independent process exchange input data areas of a size defined based on a second capacity threshold to several process control tasks of the process control application.

[0012] Furthermore, the safety exchange input data area stores the necessary process data copied from the process data area and is further intended to be read by the safety control program under the safety control task, the safety exchange output data area stores the exchange variables of the process data rewritten by the safety control task, and the process exchange input data area copies the specified safety data from the safety exchange data area of ​​the associated safety control task and is further intended to be read by the process control program under the process control task.

[0013] Furthermore, the data separation and exchange in step S2 includes, but is not limited to, a step of limiting the process control task to be unable to directly read or write to the safety exchange input data area but being able to read the process exchange input data area and the safety exchange output data area by setting different memories, dividing the memory space, and setting access attributes, and limiting the safety control task to be unable to directly read or write to the process exchange input data area but being able to read the safety exchange input data area and rewrite the safety exchange output data area.

[0014] Furthermore, step S21 specifically includes step S211 of allocating memory for corresponding exchange variables to the process data read by the safety control task in the safety exchange input data area, and allocating memory for corresponding exchange variables to the process data rewritten by the safety control task in the safety exchange output data area, and step S212 of allocating memory for corresponding exchange variables to the safety data read by the process control task in the process exchange input data area.

[0015] Furthermore, step S22 specifically includes step S221 of executing a safety control task and copying the required process data from the process data area to the safety exchange input data area, and / or step S222 of executing a process control task and copying the safety data from the safety exchange output data area of ​​the associated control task to the process exchange input data area, and step S223 of executing a safety control task / process control program based on the executed safety control task / process control task.

[0016] Furthermore, the method for data separation further includes a step of avoiding read / write conflicts between the safety control task and the process control task to the process data area, the safety exchange input data area, and the safety exchange output data area based on access conflict resolution mechanisms that are preset for the process data area and the safety exchange output data area, respectively.

[0017] Additionally, the access conflict resolution mechanisms include, but are not limited to, control task prioritization, read / write locks between tasks, double buffering of data, and MMU memory protection.

[0018] A second aspect of the present application provides an apparatus for data separation between safety and process control applications, the apparatus including at least two systems with a multi-channel architecture, each channel for executing several safety control applications and / or several process control applications, the safety control applications including a safety data area and several safety control tasks, the process control applications including a process data area and several process control tasks, the safety data area and the process data area being separated from each other, the process control tasks cannot rewrite the safety data area but can read but cannot rewrite a process exchange input area of ​​the process data area, and the safety control tasks cannot directly access the process data area but can read but cannot rewrite a safety exchange input data area of ​​the safety data area.

[0019] Furthermore, one channel in a multi-channel architecture system functions as a master channel, and the remaining channels are slave channels, allowing safety data and process data to be transferred between the channels.

[0020] Furthermore, the safety control task of the master channel copies the process data from the process data area to the safety exchange input data area of ​​the safety control task and distributes it to the slave channel.

[0021] Furthermore, the safety control task of the slave channel selects the safety exchange input data distributed from the master channel to cover the safety exchange input data area of ​​the safety control task of the slave channel.

[0022] Furthermore, if the slave channel and the master channel cannot communicate, the required process data is copied from the process data area of ​​the current channel to the safety exchange input data area of ​​the safety control task. [Effects of the Invention]

[0023] The present application has the following beneficial technical effects:

[0024] 1. It can handle multiple safety control tasks.

[0025] 2. Effectively protect safety data from process control application data, tasks / programs, and ensure the integrity of functional safety in safety control applications.

[0026] 3. Ensure the integrity of data exchange between tasks during multitasking.

[0027] 4. It can better solve the real-time synchronization of data exchange among multiple channels and ensure the real-time control response.

[0028] 5. It can be widely used not only in safety control applications and process control applications, but also in any industrial control system or device that requires high controllability, completeness, or real-time data exchange between multiple tasks. [Brief explanation of the drawings]

[0029] The drawings described herein are intended to provide a further understanding of the present application and constitute a part of the present application, and the schematic embodiments and description thereof are intended to illustrate the present application and are not intended to unduly limit the present invention. [Figure 1] 1 is a schematic flow chart illustrating a method for data separation between safety and process control applications in accordance with an embodiment of the present application. [Figure 2] 1 is a schematic flow chart illustrating a method for isolated data exchange between safety and process control applications in accordance with an embodiment of the present application. [Figure 3] FIG. 1 is a partial schematic diagram illustrating an apparatus for data separation between safety and process control applications in accordance with an embodiment of the present application. [Figure 4] FIG. 2 is a partial schematic diagram illustrating data separation between safety and process control applications within a single channel in an embodiment of the present application. [Figure 5] FIG. 2 is a partial schematic diagram illustrating data separation between multiple tasks of a safety and process control application within a single channel in an embodiment of the present application. DETAILED DESCRIPTION OF THE INVENTION

[0030] In order to further understand the present application, preferred embodiments of the present application will be described below with reference to examples. However, it should be understood that these descriptions are merely for the purpose of further illustrating the features and advantages of the present application and are not intended to limit the scope of the claims of the present application.

[0031] To facilitate understanding of this application, we first explain some of the terminology referred to in this application.

[0032] Safety Hybrid Control System: Refers to an industrial control system that includes both safety control applications and process control applications.

[0033] Channel: A term specific to system devices with a multiple voting architecture, such as a functional safety control system. A channel is the basic processing unit of a multiple voting system architecture. One channel generally includes one CPU, corresponding memory, and associated microelectronic devices. Each system channel executes control logic independently and operates asynchronously in parallel with other channels. Generally, in a safety hybrid control system, each channel contains the same safety control application and process control application. The safety control application outputs to the outside world through a specific hardware and software voting mechanism (master channel and slave channel participate simultaneously), while the process control application generally outputs from the master channel but not from the slave channel, a work / standby mechanism.

[0034] Safety control applications: These refer to control applications aimed at functional safety. Their function is to monitor the operation of production equipment and respond quickly to abnormal operating conditions according to established safety control logic, minimizing harm and ensuring safe production for personnel and equipment. Highly reliable, they are widely used in areas such as the protection and control of major equipment and devices, gas and fire monitoring and protection, oil and gas transportation process safety, steam boiler monitoring and protection, and unit control protection. Standards they comply with include IEC 61508 and GB / T20438.

[0035] The safety control application does not allow arbitrary access to unsafe signal point data. The safety control application includes a safety data area and several safety control tasks, each of which includes a task background control program and several safety control programs, and each of which includes several safety control loops. Each safety control loop includes safe signal input / output points and safe control logic.

[0036] Process control application: This refers to a control application for process control, which is applied to the continuous measurement, process control, and operation control management of general production processes to ensure the smooth operation of production equipment. A process control application includes a process data area and several process control tasks, each of which includes a task background control program and several process control programs, and each process control program includes several process control loops. Each process control loop includes process signal input / output points and process control logic.

[0037] Safety data area: Refers to the data area that is subordinate to the safety control application, and generally includes safety input signal data, safety output signal data, safety internal data, etc. The data area is generally structured data or a combination of closely related data, and when the control task or control program reads or writes data, it must ensure that it can completely read or write the entire data structure or the entire combination of data, rather than reading or writing only a portion of the data.

[0038] Process data area: This refers to the data area that is dependent on the process control application and generally includes process input signal data, process output signal data, process internal data, etc. Similarly, the data area is generally structured data or a combination of closely related data, and when a control task or control program reads or writes data, it must ensure that it can completely read or write the entire data structure or combination of data, rather than reading or writing only a portion of the data.

[0039] Task: A task includes several control programs, a portion of data, and a task background control program. It is the main subject of scheduling control of the control logic in a control system. Task execution is asynchronous and relatively independent, and there may be situations where multiple tasks access the same data at the same time.

[0040] Control program: Contains several program segments, and generally describes the control logic using a programming language that complies with the IEC 61131-3 standard.

[0041] Control Loop: A basic unit of control logic, which generally includes input signal point data, output signal point data, a control algorithm or function block, etc., such as a classic PID control loop.

[0042] The present application aims to solve the problem of data separation between safety control applications and process control applications in a safety hybrid control system, and designs a method and corresponding device for data separation between safety and process control applications. In order to help those skilled in the art better understand the present invention, the present application will now be described in detail with reference to examples.

[0043] FIG. 1 is a schematic flow chart illustrating a method for data separation between safety and process control applications according to the present application, which includes the following steps:

[0044] In S1, an exchange data area is allocated. For each safety control task of the safety control application, an independent safety exchange data area of ​​a specified size is allocated, including a safety exchange input data area and a safety exchange output data area. Also, for each process control task of the process control application, an independent process exchange input data area of ​​a specified size is allocated. The safety exchange input data area stores specified process data copied from the process data area, and is further read by the safety control program under the safety control task. The safety exchange output data area stores exchange variables of the process data rewritten by the safety control task. The process exchange input data area copies specified safety data from the safety exchange data area of ​​the associated safety control task, and is further read by the process control program under the process control task.

[0045] In S2, data is exchanged between the safety and process control applications based on the allocated exchange data area.

[0046] 2, the data exchange includes, but is not limited to, steps of limiting the process control task to be unable to directly read or write to the safety exchange input data area but being able to read the process exchange input data area and the safety exchange output data area by dividing different memories, memory space, and setting access attributes, and limiting the safety control task to be unable to directly read or write to the process exchange input data area but being able to read the safety exchange input data area and rewrite the safety exchange output data area. Specifically, the data exchange includes the following steps:

[0047] In S21, variable memory is allocated.

[0048] In the safety exchange input data area, memory for a corresponding exchange variable is allocated for each piece of process data input to the safety control task, where exchange variables corresponding to process data read by the safety control task are allocated to the safety exchange input data area, exchange variables for process data rewritten by the safety control task are allocated to the safety exchange output data area, and process exchange input variables corresponding to safety exchange variables read by the process control task are allocated to the process exchange input data area.

[0049] In S22, the safety exchange input data area / process exchange input data area is updated and read.

[0050] Specifically, the process includes the steps of updating and reading the safety exchange input data area, and when executing each safety control task, first copying a portion of the specified process data from the process data area to the corresponding safety exchange input data area, and then executing each safety control program under the safety control task.

[0051] The method further includes a step of updating and reading the process exchange input data area, and when executing each process control task, first copying a portion of the specified data from the safety exchange output data area of ​​the associated safety control task to the process exchange input data area, and then executing each process control program under the process control task.

[0052] The execution of each safety control task and process control task is independent and asynchronous from each other, and the step of updating and reading the safety exchange input data area and the step of updating and reading the process exchange input data area can be executed in parallel.

[0053] In addition, to ensure the accuracy and completeness of the process data read by the safety control task and to avoid conflicts between the safety control task and the process control task when reading and writing to the process data area, the device employs access conflict resolution mechanisms such as "control task priority setting," "inter-task read / write lock," "data double buffering," or "MMU memory protection."

[0054] In some embodiments, it is ensured that the safety control task is allowed to rewrite the process data field only after the safety control task has finished reading the process data field.

[0055] In the following embodiment, Figure 3 is a partial schematic diagram showing an apparatus for data separation between safety and process control applications according to the present application. The apparatus includes at least two multi-channel architecture systems, each channel for executing several safety control applications and / or several process control applications, where the safety control applications include a safety data area and several safety control tasks, and the process control applications include a process data area and several process control tasks, and the safety data area and the process data area are separated from each other. The process control tasks cannot rewrite the safety data area, but can read but cannot rewrite the process exchange input area of ​​the process data area. The safety control tasks cannot directly access the process data area, but can read but cannot rewrite the safety exchange input data area of ​​the safety data area.

[0056] In FIG. 3, the device includes one master channel and two slave channels, and the control tasks and control programs contained therein are all the same between the channels. The safety control task of the master channel copies a portion of the designated process data from the process data area of ​​the master channel to the safety exchange input data area of ​​the master channel and distributes it quickly to slave channel 1# and slave channel 2#. "Quickly" here generally means that the safety control tasks of slave channel 1# and slave channel 2# select the safety exchange input data from the master channel within one basic control cycle or task cycle. When the connection between the slave channel and the master channel is disconnected, the safety control task of slave channel 1# or slave channel 2# copies a portion of the designated process data from its corresponding process data area to the safety exchange input data area of ​​the safety control task.

[0057] In order to help those skilled in the art better understand the present invention, the method and apparatus for data separation between safety and process control applications shown in the above embodiment will be further described below with an actual operation example.

[0058] 4 is a schematic diagram showing a portion of a single channel, in which the single channel includes one process control application and one safety control application, and the data and programs of the safety control application and the process control application are relatively independent and separated from each other. The process control application mainly includes a process data area and several process control tasks, and the safety control application mainly includes a safety data area and several safety control tasks.

[0059] Generally, a process control task can directly read data in the safety data area. However, to contribute to the integrity and consistency of the safety data read during the execution of a process control task, in an embodiment of the present application, data that requires high structure or consistency can be assigned to the safety exchange output data area and transferred to the process control task via the process exchange input data area, as shown in FIG.

[0060] A dedicated safety exchange input data area is assigned to each safety control task. Each time a safety control task is executed, a portion of the designated process data is first copied from the process data area to the safety exchange input data area, and then each safety control program under that safety control task is executed. This device limits the safety control program to only being able to read the safety exchange input data area, but not to rewrite it, by dividing the memory space and setting access attributes.

[0061] As shown in Figure 4, a dedicated safety exchange output data area is assigned to each safety control task, and a dedicated process exchange input data area is assigned to each process control task. This device uses different memories, memory space division, access attribute settings, etc. to restrict the process control task to directly read the process exchange input data area, but the safety control task cannot directly access the process exchange input data area. Similarly, the safety control task can read and write the safety exchange output data area, but each process control program in the process control task cannot directly access the safety exchange output data area.

[0062] Each time a process control task is executed, it copies a portion of the specified data from the safety exchange output data area of ​​the associated safety control task to the process exchange input data area, and then executes each process control program under that process control task. To ensure the accuracy and completeness of the safety exchange output data read by the process control task and to avoid conflicts between the safety control task and the process control task reading and writing to the safety exchange output data area, an access conflict resolution mechanism such as "control task priority setting," "inter-task read / write lock," "data double buffering," or "MMU memory protection mechanism" is used to ensure that the process control task is allowed to read the safety exchange output data area after the safety control task has finished rewriting the safety exchange output data area.

[0063] FIG. 5 is a partial schematic diagram showing data separation between multiple safety control tasks and multiple process control tasks. In this embodiment, one process control application and one safety control application are executed within a single channel of the device. The safety control application includes safety control task 1# and safety control task 2#, and the process control application includes process control task 1# and process control task 2#. Note that the safety control application and the process control application may each include several control tasks, and the safety control tasks and the process control tasks are executed relatively independently and asynchronously. For clarity of explanation, this embodiment shows only a case where each includes two control tasks. The rules for executing the safety control task and the process control task are as follows:

[0064] 1. Safety control task 1# and safety control task 2# can simultaneously and independently read the specified data in the process data area and copy it to safety exchange input data 1# and safety exchange input data 2#, respectively.

[0065] 2. Process control task 1# and process control task 2# can simultaneously and independently read the specified data in the safety exchange output data area 1# and safety exchange output data area 2# of the associated safety task and copy it to process exchange input data area 1# and process exchange input data area 2#, respectively.

[0066] The above description of the embodiments is merely intended to facilitate understanding of the method and core idea of ​​the present application. Those skilled in the art should note that slight improvements and modifications to the present application are possible without departing from the principles of the present application, and these improvements and modifications are also within the scope of protection of the claims of the present application. The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combinations of these technical features are not contradictory, they should all be considered within the scope described in this specification.

Claims

1. 1. A method for data separation between safety control applications and process control applications, comprising: The safety control application includes a safety data area and several safety control tasks including several safety control programs; the process control application includes a process data domain and a number of process control tasks including a number of process control programs; the safety control application is a control application for functional safety, and the process control application is a control application for process control; the safety data area is for storing safety data, and the process data area is for storing process data; the safety data includes at least one of safety input signal data, safety output signal data, and safety internal data; and the process data includes at least one of process input signal data, process output signal data, and process internal data; The method for data separation comprises: Step S1, in which an apparatus for data separation between a safety control application and a process control application allocates exchange data areas to control tasks in the safety control application / process control application; and a step S2 of performing data separation exchange between the safety control application and the process control application based on an exchange data area allocated by a device for data separation between the safety control application and the process control application; Step S1 a step of allocating independent safety exchange data areas of sizes defined based on a first capacity threshold to several safety control tasks of the safety control application, respectively, the safety exchange data areas including a safety exchange input data area and a safety exchange output data area; and allocating independent process exchange input data areas of a size defined based on a second capacity threshold to each of the process control tasks of the process control application; the safety exchange input data area stores necessary process data copied from the process data area, and is further intended to be read by the safety control program under the safety control task; the safety exchange output data area is for storing exchange variables of process data rewritten by the safety control task; The process exchange input data area copies designated safety data from a safety exchange data area of ​​an associated safety control task, and is further read by the process control program under the process control task; Data separation exchange The method includes a step of limiting the process control task to be unable to directly read or write to the safety exchange input data area but to be able to read the process exchange input data area and the safety exchange output data area by setting different memories, dividing memory space, and access attributes, and limiting the safety control task to be unable to directly read or write to the process exchange input data area but to be able to read the safety exchange input data area and rewrite the safety exchange output data area.

1. A method for data separation between a safety control application and a process control application, comprising:

2. Step S2 is A step S21 of allocating memory for variables; a step S22 of updating and reading the safety exchange input data area / the process exchange input data area; Step S21 is Step S211: allocating a memory of a corresponding exchange variable to the process data read by the safety control task in the safety exchange input data area, and allocating a memory of a corresponding exchange variable to the process data rewritten by the safety control task in the safety exchange output data area; 2. The method for data separation according to claim 1, further comprising: a step S212 of allocating memory for corresponding exchange variables for safety data read by the process control task in the process exchange input data area.

3. Step S22 is Step S221 of executing the safety control task and copying the necessary process data from the process data area to the safety exchange input data area; and / or Step S222 of executing the process control task and copying safety data from the safety exchange output data area of ​​the associated control task to the process exchange input data area; and executing a safety control program / process control program based on the executed safety control task / process control task (S223).

4. The method comprises: The method further includes a step of avoiding a read / write conflict between the safety control task and the process control task to the process data area, the safety exchange input data area, and the safety exchange output data area based on a preset access conflict resolution mechanism for the process data area and the safety exchange output data area, respectively; 2. The method for data isolation of claim 1, wherein the access conflict resolution mechanisms include controlling task prioritization, read / write locks between tasks, double buffering of data, and MMU memory protection.

5. 1. An apparatus for data separation between safety control applications and process control applications, comprising: at least two systems of multi-channel architecture; Each channel is for running several safety control applications and / or several process control applications; The safety control application includes a safety data area and several safety control tasks; The process control application includes a process data domain and several process control tasks; the safety data area and the process data area are separated from each other; the safety control application is a control application for functional safety, and the process control application is a control application for process control; the safety data area is for storing safety data, and the process data area is for storing process data; the safety data includes at least one of safety input signal data, safety output signal data, and safety internal data; and the process data includes at least one of process input signal data, process output signal data, and process internal data; The apparatus for data separation further comprises: Allocating exchange data areas to control tasks in a safety control application / process control application; and performing data separation exchange between the safety control application and the process control application based on the assigned exchange data area; Allocating exchange data areas to control tasks in a safety control application / process control application includes: Allocating independent safety exchange data areas of sizes defined based on a first capacity threshold to several safety control tasks of the safety control application, respectively, wherein the safety exchange data areas include a safety exchange input data area and a safety exchange output data area; and allocating to each of the process control tasks of the process control application an independent process exchange input data area of ​​a size defined based on a second capacity threshold; the safety exchange input data area stores necessary process data copied from the process data area, and is further intended to be read by a safety control program under the safety control task; the safety exchange output data area is for storing exchange variables of process data rewritten by the safety control task; The process exchange input data area copies designated safety data from a safety exchange data area of ​​an associated safety control task, and is further read by a process control program under the process control task; Data separation exchange By setting different memories, dividing memory spaces, and access attributes, the process control task cannot directly read or write to the safety exchange input data area, but is limited to being able to read the process exchange input data area and the safety exchange output data area, and the safety control task cannot directly read or write to the process exchange input data area, but is limited to being able to read the safety exchange input data area and rewrite the safety exchange output data area.

1. An apparatus for data separation between a safety control application and a process control application, comprising:

6. 6. The device for data separation according to claim 5, wherein one channel in the multi-channel architecture system functions as a master channel and the remaining channels are slave channels, and safety data and process data are transferred between the channels.

7. 7. The apparatus for data separation of claim 6, wherein the safety control task of the master channel copies the process data from the process data area to a safety exchange input data area of ​​the safety control task and distributes it to the slave channel.

8. 7. The apparatus for data separation according to claim 6, wherein the safety control task of the slave channel selects the safety exchange input data delivered from the master channel and covers a safety exchange input data field of the safety control task of the slave channel.

9. 7. The device for data separation according to claim 6, wherein if the slave channel and the master channel cannot communicate, the device copies the required process data from the process data area of ​​the current channel to the safety exchange input data area of ​​the safety control task.

Images