Method and system for increasing the availability of an installation

Abstract

The present invention relates to a method and a system for increasing the availability of an installation, comprising the steps of: detecting an existing or imminent impairment of an operational functionality of at least one installation device of the installation which is in operation; and taking over operating functions of the installation affected by the impairment of the operational functionality by means of at least one virtual programmable logic controller of a backup system connected to the installation without interrupting the ongoing operation of the installation.

Description

[0001] Description

[0002] Methods and systems for increasing the availability of a plant

[0003] The present invention relates to a method and a system for increasing the availability and resilience of a plant, in particular an industrial production plant.

[0004] Cyberattacks can impair the availability of systems, particularly industrial plants. These attacks typically target specific automation components within a system. Conventional H-systems can provide an identical component structure as a backup. These backups can take over during a cyberattack to ensure the availability of the affected system. Standard defense-in-depth measures, especially physical security measures and measures to enhance network security and system integrity, can also be implemented within the system. Furthermore, security functionalities can be integrated into the system's devices to defend against attacks.

[0005] Against this background, the present invention aims to ensure the availability of a plant.

[0006] According to the invention, this problem is solved by a method with the features of claim 1 and / or by a backup system with the features of claim 13.

[0007] According to a first aspect, the invention therefore provides a method for increasing the availability of a plant comprising the following steps:

[0008] Detecting an existing or imminent impairment of the operational functionality of at least one piece of equipment in the operating plant; and taking over operational functions of the plant affected by the impairment of operational functionality through at least one virtual programmable logic controller (vPLC) of a backup system connected to the plant without interrupting the ongoing operation of the plant.

[0009] According to a further aspect, the invention provides a backup system for increasing the availability of at least one plant, wherein the backup system has at least one virtual programmable logic controller (vPLC) designed to seamlessly take over the control of operating functions of the plant without interrupting the ongoing operation of the plant as soon as an existing or imminent impairment of the operational functionality of the respective plant is detected.

[0010] A virtual programmable logic controller (vPLC) is a software-based automation component used to control an automation process within a plant. A virtual programmable logic controller is a software component that replicates the functions of a physical programmable logic controller in a virtual environment.

[0011] The underlying idea of ​​the present invention is to deploy a backup or emergency system as soon as the main system is infected, in order to maintain the availability of the plant or the production of the business. For this purpose, in the event of a successful attack, a virtual controller located in the backup system is used, which takes over the automation functions and ensures the availability of the plant, at least temporarily.

[0012] This does not necessarily involve a complete replacement of the main system or all of the plant's functions, but in most cases primarily ensures the continued operation of essential or basic functions of the affected plant. It is also possible to take over entire functions that do not have the same latency but can operate well enough to guarantee the plant's availability.

[0013] Using the method according to the invention, the availability of the system is ensured and the corresponding component is adequately protected in the event of a successful attack, without being affected again by the same attack scenario.

[0014] The inventive method thus enables operating scenarios such as live patching, meaning that software updates are installed on the automation devices of the plant while they continue to operate. Production in a manufacturing plant continues uninterrupted and is not interrupted for the installation of updates.

[0015] Other uses for the virtual programmable logic controller (vPLC) include, for example, uninterrupted maintenance of the plant or complete remote access to ensure the automation functions of the plant and to be able to operate them remotely.

[0016] In a preferred embodiment of the method according to the invention, the detection of an existing or impending impairment is carried out using at least one predictive analysis method. For this purpose, operating parameters of the plant or the at least one plant component are preferably continuously recorded and their temporal progression is analyzed. Preferably, a machine learning model trained with historical operating data detects deviations from normal behavior and classifies them according to their criticality. Both gradual changes and sudden anomalies can be taken into account. The system expediently performs statistical evaluations for this purpose, calculating means, standard deviations, and correlations between different parameters. Additionally, contextual information such as environmental conditions, current production plans, and maintenance cycles are preferably included.The combination of these methods enables the early and reliable detection of emerging problems, allowing for timely intervention to restore functionality. In this way, changes or anomalies indicative of cyberattacks can be detected early during plant operation.

[0017] Alternatively or additionally, detection of an existing or imminent impairment can preferably be carried out by monitoring operating parameters such as, in particular, one or more process variables such as temperature and / or pressure and / or one or more cycle times and / or at least one CPU utilization and / or at least one memory usage and / or at least one communication behavior and / or at least one response time.

[0018] Alternatively or additionally, methods known from the state of the art for detecting existing or imminent impairments can be used, such as monitoring methods for detecting cyberattacks and / or virus infections, in particular scanning for computer viruses.

[0019] In a preferred embodiment of the invention, the transfer of operating functions of a system affected by an impairment of operational functionality to at least one virtual programmable logic controller (PLC) of a backup system connected to the system can be accomplished by means of a hot relocation of operating functions, in which the operating functions are taken over by the virtual PLC of the backup system during operation. This preferably occurs in several coordinated steps: First, the current process state of the currently or potentially impaired system component is expediently recorded, including all relevant process variables, timer values, and status information. This status data is preferably transmitted to the backup system in real time. The backup system preferably initializes the corresponding operating functions in parallel using the transmitted status data.During a synchronization phase, both systems are preferably operated in parallel, with the backup system initially running passively and comparing its outputs with those of the original system, in particular the plant or the plant equipment. After successful synchronization, in preferred embodiments of the invention, the actual transfer of functions occurs through a switching process in which the process control seamlessly transitions from the original to the backup system. This switching process expediently takes place within a single process cycle, so that no interruption of plant operation is perceptible. The principle of hot relocation is fundamentally known from virtualization technology and / or control systems.

[0020] In a preferred embodiment of the invention, the transfer of operating functions, particularly by means of hot relocation, can also encompass operating functions that are not operating functions of at least one virtual programmable logic controller (PLC). In particular, the transfer of operating functions can occur for plant equipment that includes or operates at least one physical programmable logic controller and / or preferably are operating functions of standard computer systems and / or edge devices and / or cloud instances. Here, the operating functions are preferably emulated or virtualized in software. The system transferring the operating functions expediently and optionally provides a virtual execution environment that replicates the behavior of a physical programmable logic controller of at least one plant device.Status monitoring and transmission preferably occur analogously to classic hot relocation. This type of function takeover enables a flexible and scalable backup strategy, as the operational functions can be executed on different hardware platforms.

[0021] The virtual programmable logic controller (vPLC) used can also be employed as a "shared backup." In this configuration, it serves as a reserve system for multiple systems, acting as a generic backup system that is used as needed for any affected system component (e.g., a machine). A prerequisite for ensuring this is a reliable switchover to the respective I / O interface (local system or backup system). To increase resilience in this regard, the switchover between the instance accessing the I / O interface is preferably cryptographically protected.

[0022] Advantageous designs and further developments result from the further sub-claims as well as from the description with reference to the figures in the drawing.

[0023] In one possible embodiment of the inventive method for increasing the availability of a plant, the operational functionality of a plant device is impaired or threatened due to a detected cyberattack on the plant in question.

[0024] In one possible embodiment of the inventive method for increasing the availability of a plant, the operational functionality of a plant device is impaired or threatened due to a detected virus infection of software that is executed on the plant device or on a physical programmable logic controller (PLC) of the plant.

[0025] In one possible embodiment of the inventive method for increasing the availability of a plant, the operational functionality of a plant device is impaired or threatened due to a maintenance measure on the plant.

[0026] In one possible embodiment of the inventive method for increasing the availability of a plant, the maintenance measure comprises a software update of software that is executed by a controller of a plant device of the plant or by a physical programmable logic controller (PLC) of the plant.

[0027] In one possible embodiment of the inventive method for increasing the availability of a plant, the operating functions of the respective affected plant device and / or the operating functions of further or all other plant devices of the affected plant are automatically taken over by at least one virtual programmable logic controller (vPLC) of the backup system connected to the plant via a gateway as soon as an existing or imminent impairment of the operational functionality of at least one plant device of the plant in operation has been detected.

[0028] In one possible embodiment of the inventive method for increasing the availability of a plant, the plant is an industrial automation plant which has several automation devices which are controlled during the ongoing operation of the plant via a control bus by at least one physical programmable logic controller (PLC) of the plant which executes an instance of a control program.

[0029] In one possible embodiment of the inventive method for increasing the availability of a plant, a control program instance, which is executed during operation by a physical programmable logic controller (PLC) of the plant or by a controller of a plant device of the plant and controls operating functions of plant devices of the plant, automatically and without interruption switches to a corresponding control program instance, which is executed by at least one virtual programmable logic controller (vPLC) of the backup system connected to the plant and controls the operating functions of the respective plant devices of the affected plant, as soon as an existing or imminent impairment of the operational functionality of at least one plant device of the plant in operation has been detected.

[0030] In one possible embodiment of the inventive method for increasing the availability of a plant, the switching between the two control program instances is cryptographically protected.

[0031] In one possible embodiment of the inventive method for increasing the availability of a plant, the virtual programmable logic controller (vPLC) of the backup system connected to the plant automatically takes over predefined basic operating functions that are essential for the ongoing operation of the plant in question as soon as an existing or imminent impairment of the operational functionality of at least one plant device of the plant in operation has been detected.In one possible embodiment of the inventive method for increasing the availability of a plant, the operating functions of the affected plant are taken over by at least one physical programmable logic controller (PLC) of the plant or by a controller of a plant device of the plant from the virtual programmable logic controller (vPLC) of the backup system connected to the plant as soon as the impairment of the operational functionality of the plant device of the plant is lifted.

[0032] In one possible embodiment of the backup system according to the invention for increasing the availability of a plant, the impairment of the operational functionality of the affected plant arises due to a detected cyberattack on the affected plant, due to a detected virus infection of software that is executed on a plant device of the plant or on a physical programmable logic controller (PLC) of the plant, or due to a planned maintenance measure on the plant.

[0033] In one possible embodiment of the backup system according to the invention for increasing the availability of a plant, the backup system is connected to a gateway of the plant.

[0034] In one possible embodiment of the backup system according to the invention for increasing the availability of a plant, the virtual programmable logic controller (vPLC) is hosted on a computer of the backup system.

[0035] In one possible embodiment of the backup system according to the invention for increasing the availability of a plant, the plant connected to the backup system has several plant devices which are controlled during the ongoing operation of the plant by controllers of the respective plant devices and / or via a local control bus by at least one physical programmable logic controller (PLC) of the plant.

[0036] In one possible embodiment of the backup system according to the invention for increasing the availability of a plant, the plant comprises a logistics plant, a traffic plant, a building plant, an automation plant and / or a production plant.

[0037] The above embodiments and further developments can be combined with one another as appropriate. Further possible embodiments, further developments, and implementations of the invention also include combinations of features of the invention described previously or subsequently with regard to the exemplary embodiments, even if not explicitly mentioned. In particular, the person skilled in the art will also add individual aspects as improvements or additions to the respective basic form of the present invention.

[0038] The present invention will be explained in more detail below with reference to the exemplary embodiments shown in the schematic figures of the drawings.

[0039] This shows:

[0040] Fig. 1 shows a flowchart illustrating one possible embodiment of the method according to the invention;

[0041] Fig. 2 is a diagram illustrating a possible embodiment of the backup system according to the invention for a plant.

[0042] The accompanying figures are intended to provide a further understanding of the embodiments of the invention. They illustrate embodiments and, in conjunction with the description, serve to explain the principles and concepts of the invention. Other embodiments and many of the advantages mentioned will become apparent with reference to the drawings. The elements of the drawings are not necessarily shown to scale.

[0043] In the figures of the drawing, identical, functionally equivalent and similarly acting elements, features and components - unless otherwise stated - are each provided with the same reference symbols.

[0044] The flowchart according to Fig. 1 shows a possible embodiment of the inventive method for increasing the availability of an ANL system. In the illustrated embodiment, the method essentially comprises two main steps S1 and S2.

[0045] In a first step (S1), an existing or imminent impairment of the operational functionality of at least one piece of equipment in the operating plant ANL is detected. In a further step (S2), the operational functions of the plant affected by the impairment are taken over by at least one virtual programmable logic controller (vPLC) of a backup system connected to the plant, without interrupting the ongoing operation of the plant ANL.

[0046] One or more virtual programmable logic controllers (vPLCs) can run as a backup. The vPLCs can either take over the entire function of a disabled automation component (AK) of a plant device (ANL), or only perform and temporarily provide a portion of the functions (especially essential functions for maintaining operation).

[0047] A virtual programmable logic controller (vPLC) is a software-based automation component used to control an automation process. It can be implemented as a software component (app) on an open computing platform such as an industrial PC and can be implemented, for example, as a virtual machine (VM) or a container. It executes a user program that performs the actual control task. This allows PLC functionality to be dynamically and flexibly created and executed on a computer system as needed.

[0048] Fig. 2 schematically shows a possible embodiment of a backup system BSYS for an automation plant ANL. The automation plant ANL comprises several automation components AK (e.g., PLC, HMI, remote I / O) that are interconnected in an automation network. A plant device of the ANL can have one or more automation components AK. The automation components AKs of the ANL communicate via a control and data bus BUS, in particular via a fieldbus according to a fieldbus protocol (e.g., PROFINET), and control a physical process PHYP within the ANL plant. In the embodiment shown in Fig. 2, the automation components AKs communicate via the control and data bus BUS and remote control (remote) I / O interfaces or other control elements (such as, for example, PLCs, HMIs, and remote I / O interfaces).Frequency converters (FW or drivers T) with sensors (SEN) and / or actuators (AKT) for controlling a physical process (PHYP) within the plant (ANL). The actuators (AKT) are, for example, motors or controllable valves within the plant (ANL).

[0049] Figure 2 also shows an engineering system, ESYS. ESYS is used to design the automation components (AK) of the plant ANL. Here, the automation components (AK) of the plant ANL can be programmed and configured. The backup system (BSYS) shown in Figure 2 is designed to execute and manage one or more virtualized automation functions (PLC, HMI, fieldbus communication, etc.) and serves to increase the availability of the monitored plant ANL. The current availability status of the automation components (AKs) of the plant ANL is monitored using an availability assurance logic (AAL). The backup system (BSYS) is connected to the automation network of the plant ANL. In the embodiment shown in Figure 2, the backup system (BSYS) is connected to a Factory Automation Engineering Network (ENW) of the plant ANL.The backup system BSYS can also be connected to the control and data bus BUS of the ANL plant, as shown in Fig. 2.

[0050] The backup system BSYS can include at least one server for virtualized (backup) automation functions (vPLC, vHMI, etc.). Monitoring and detection of potential availability limitations can be performed, for example, from the BSYS backup system server. Alternatively, the automation components AK themselves can monitor and detect potential availability limitations. Upon detection of an availability limitation, the affected automation components AK can signal this to the BSYS backup system server. Some of the automation components AK of the ANL plant can have an integrated availability monitoring unit (VÜE), as shown schematically in Fig. 2.

[0051] In one possible embodiment of the inventive method for increasing the availability of a plant, the operational functionality of a plant component of the ANL plant is impaired or threatened due to a detected cyberattack on the affected ANL plant. In one possible embodiment, a cyberattack can be detected by monitoring network traffic (e.g., SYN flooding, frequency of certain connection requests). Furthermore, a cyberattack can also be detected by monitoring processes running on the system and their resource usage (e.g., RAM, CPU, network bandwidth). Another way to detect cyberattacks is through integrity checks of software and configuration or by detecting unusual behavior patterns in network traffic or application actions (e.g., executed system calls).In one possible embodiment of the inventive method for increasing the availability of a plant, the operational functionality of a plant device in the ANL plant is impaired or threatened due to a detected virus infection of software running on the plant device or on a physical programmable logic controller (PLC) of the ANL plant. A virus infection can also be detected by monitoring network traffic (SYN flooding, frequency of certain connection requests), monitoring processes running on the system and their resource usage (RAM, CPU, network bandwidth), by performing integrity checks of software and configuration, and by detecting unusual behavior patterns in network traffic or during application actions (e.g., executed system calls).

[0052] The inventive method primarily monitors types of infestation that lead to limitations in the availability of the ANL system (especially its essential functions) and / or that produce a desired malfunction (integrity).

[0053] In one possible embodiment of the inventive method for increasing the availability of a plant, the operational functionality of a plant component of the ANL plant is impaired or threatened due to a maintenance measure on the plant. The maintenance measure may include a software update of software that is executed by a controller of a plant component of the ANL plant or by a physical programmable logic controller (PLC) of the ANL plant.

[0054] The operating functions of the affected plant device and / or the operating functions of other or all other plant devices of the affected plant ANL can be automatically taken over by at least one virtual programmable logic controller (vPLC) of the backup system BSYS connected to the plant ANL via a gateway as soon as an existing or imminent impairment of the operational functionality of at least one plant device of the operating plant ANL has been detected.

[0055] The BSYS backup system can include an IPC / server PC on which virtualized automation components (especially virtualized PLCs / vPLCs) can be loaded and executed as needed. The IPC / server PC running the virtual programmable logic controller (vPLC) (e.g., as a VM, container, native process, etc.) is network-connected to the corresponding components with which the affected automation component AK normally communicates. This allows, for example, it to...

[0056] They take over control tasks by communicating with the corresponding remote IO components.

[0057] In one possible embodiment of the inventive method for increasing the availability of a plant, the plant ANL is an industrial automation system. The automation system comprises several automation devices that are controlled during operation via a control bus by at least one physical programmable logic controller (PLC) of the plant, which executes an instance of a control program. The plant ANL comprises, for example, several sensors SEN and actuators AKT. These are either directly connected to the physical programmable logic controller PLC or to dedicated I / O devices, which in turn are connected to a physical programmable logic controller PLC via a fieldbus protocol (e.g., PROFINET).

[0058] In one possible embodiment of the inventive method for increasing the availability of a plant ANL, a control program instance, which is executed during operation by a physical programmable logic controller (PLC) of the plant or by a controller of a plant device of the plant ANL and controls operating functions of plant devices of the plant ANL, automatically and without interruption switches to a corresponding control program instance, which is executed by at least one virtual programmable logic controller (vPLC) of the backup system BSYS connected to the plant ANL and controls the operating functions of the respective plant devices of the affected plant ANL, as soon as an existing or imminent impairment of the operational functionality of at least one plant device of the operating plant ANL has been detected.

[0059] Switching to a corresponding control program instance involves, in a possible implementation of the method according to the invention:

[0060] • Starting one or more vPLC instances, if not already present.

[0061] • Loading one or more vPLC instances with the corresponding user program or with a variant that implements at least the essential functions (in one variant, the essential functions can be transferred to multiple vPLCs via dedicated user programs, which then execute them independently). • Configuring the I / O devices communicating with the affected PLC so that they are prepared for communication with one or more vPLCs (e.g., by configuring a public key / certificate with which the vPLCs can then be authenticated before they are accepted as controlling vPLCs by the I / O module -> "Reliable switching" / "Cryptographically protected switching").

[0062] • Takeover of the control functionality by one or more vPLCs,

[0063] In one possible embodiment of the inventive method for increasing the availability of an ANL system, the switching between the two control program instances is cryptographically protected. The new vPLCs are authenticated as trusted communication partners before I / O commands / data are exchanged with them. The corresponding keys / certificates can either be "pre-provisioned" during commissioning / engineering and used subsequently when a switching signal is received, or, if an impairment is detected, the corresponding credentials can be generated and distributed by a higher-level system.

[0064] In one possible embodiment of the inventive method for increasing the availability of an ANL system, the virtual programmable logic controller (vPLC) of the backup system BSYS connected to the ANL system automatically takes over predefined basic operating functions that are essential for the ongoing operation of the ANL system as soon as an existing or imminent impairment of the operational functionality of at least one component of the operating system is detected. The basic operating functions can be defined by an automation engineer during the development or commissioning of the ANL system. Examples of basic operating functions include a control function for a pressure vessel / valve or a control algorithm for a drill bit.

[0065] The operating functions of the affected plant ANL can be taken over by at least one physical programmable logic controller (PLC) of the plant or by a controller of a plant device of the plant ANL from the virtual programmable logic controller (vPLC) of the backup system BSYS connected to the plant ANL as soon as the impairment of the operational functionality of the plant device of the plant ANL is resolved. According to a further aspect, the invention provides the backup system BSYS, shown by way of example in Fig. 2, for increasing the availability of at least one plant ANL. The monitored plant ANL comprises, for example, a logistics plant, a traffic system, a building system, an automation system, and / or a production plant.The ANL plant has several plant devices which are controlled during the ongoing operation of the plant by controllers of the respective plant devices and / or via a local control bus by at least one physical programmable logic controller (PLC) of the ANL plant.

[0066] The BSYS backup system includes at least one virtual programmable logic controller (vPLC). This vPLC is designed to seamlessly and cryptographically take over the control of the ANL plant's operational functions without interrupting the ongoing operation of the ANL plant as soon as an existing or imminent impairment of the ANL plant's operational functionality is detected. The virtual programmable logic controller (vPLC) is hosted on a computer within the BSYS backup system.

[0067] In one possible embodiment, the existing or imminent impairment of the operational functionality of the affected plant ANL arises from a detected cyberattack on the plant. Furthermore, the impairment of the operational functionality of the affected plant ANL can result from a detected virus infection of software running on a device within the plant ANL or on a physical programmable logic controller (PLC) within the plant ANL. The impairment of the operational functionality of the affected plant ANL can also result from a planned maintenance measure on the plant ANL.

[0068] Although the present invention has been fully described above with reference to preferred embodiments, it is not limited thereto, but can be modified in many ways.

[0069] Regardless of the grammatical gender of a given term, persons of male, female, or other gender identities are included. Reference list

[0070] AAL availability assurance logic

[0071] ANL plant

[0072] BSYS Backup System

[0073] ESYS Engineering System

[0074] ENW Engineering Network

[0075] HMI Human Machine Interface vHMI virtualized Human Machine Interface

[0076] PLC (physical programmable logic controller) vPLC (virtualized physical programmable logic controller)

[0077] VÜU Availability Monitoring Unit

[0078] PHYP physical process

[0079] SEN Sensor

[0080] Actuator

[0081] FW frequency converter

[0082] T driver

[0083] S1-S2 process steps

Claims

Patent claims 1. Procedure for increasing the availability of a plant (ANL), comprising the following steps: Identification (S1) of an existing or imminent impairment of the operational functionality of at least one piece of equipment in the operating plant (ANL); and Taking over (S2) operational functions of the plant (ANL) affected by the impairment of operational functionality by at least one virtual programmable logic controller (vPLC) of a backup system (BSYS) connected to the plant (ANL) without interrupting the ongoing operation of the plant (ANL).

2. Method according to claim 1, wherein the impairment of the operational functionality of a plant device exists or is threatened due to a detected cyberattack on the plant concerned.

3. Method according to one of the preceding claims, wherein the impairment of the operational functionality of a plant device exists or is threatened due to a detected virus infection of software that is executed on the plant device of the plant or on a physical programmable logic controller (PLC) of the plant.

4. Method according to one of the preceding claims, wherein the impairment of the operational functionality of a plant device exists or is threatened due to a maintenance measure on the plant.

5. Method for increasing the availability of a plant according to claim 4, wherein the maintenance measure comprises a software update of software executed by a controller of a plant device of the plant or by a physical programmable logic controller (PLC) of the plant.

6. A method according to any of the preceding claims, wherein such operating functions which are not operating functions of at least one virtual programmable logic controller (vPLC) are performed by the at least one virtual programmable logic controller (vPLC).

7. Method according to one of the preceding claims, wherein as soon as an existing or imminent impairment of the operational functionality of at least one piece of equipment in the plant in operation has been detected, the operational functions of the respective piece of equipment affected and / or the operational functions of other or all other pieces of equipment in the plant affected are automatically taken over by at least one virtual programmable logic controller (vPLC) of the backup system connected to the plant via a gateway.

8. Method according to one of the preceding claims, wherein the plant is an industrial automation plant comprising several automation devices which are controlled during the operation of the plant via a control bus by at least one physical programmable logic controller (PLC) of the plant which executes an instance of a control program.

9. A method according to one of the preceding claims, wherein, as soon as an existing or imminent impairment of the operational functionality of at least one piece of equipment in the plant in operation has been detected, a control program instance, which is executed during operation by a physical programmable logic controller (PLC) of the plant or by a controller of a piece of equipment in the plant and controls the operating functions of pieces of equipment in the plant, automatically and without interruption switches to a corresponding control program instance, which is executed by at least one virtual programmable logic controller (vPLC) of the backup system connected to the plant and controls the operating functions of the respective pieces of equipment in the plant concerned.

10. Method according to claim 9, wherein the switching between the two control program instances is cryptographically protected.

11. Method according to one of the preceding claims, wherein the virtual programmable logic controller (vPLC) of the backup system connected to the plant automatically takes over predefined basic operating functions that are essential for the ongoing operation of the plant concerned as soon as an existing or imminent impairment of the operational functionality of at least one plant device of the plant in operation has been detected.

12. Method according to one of the preceding claims, wherein the operating functions of the affected plant are taken over by at least one physical programmable logic controller (vPLC) of the plant or by a controller of a plant device of the plant from the virtual programmable logic controller (vPLC) of the backup system connected to the plant as soon as the impairment of the operational functionality of the plant device of the plant is removed.

13. Backup system (BSYS) for increasing the availability of at least one plant (ANL), in particular using a method according to one of claims 1 to 12, wherein the backup system (BSYS) comprises: at least one virtual programmable logic controller (vPLC) designed to seamlessly take over the control of operating functions of a respective plant (ANL) without interrupting the ongoing operation of the respective plant (ANL) as soon as an existing or imminent impairment of the operational functionality of the respective plant (ANL) is detected.

14. Backup system according to claim 13, wherein the impairment of the operational functionality of the affected plant (ANL) results from a detected cyberattack on the affected plant, from a detected virus infection of software running on a plant device of the plant (ANL) or on a physical programmable logic controller (PLC) of the plant, or from a planned maintenance measure on the plant (ANL).

15. Backup system according to one of claims 13 or 12, wherein the backup system is connected to a gateway of the plant (ANL).

16. Backup system according to one of claims 13 to 15, wherein the virtual programmable logic controller (vPLC) is hosted on a computer of the backup system (BSYS).

17. Backup system according to one of claims 13 to 16, wherein the plant (ANL) connected to the backup system (BSYS) comprises several plant devices which are controlled during the operation of the plant by controllers of the respective plant devices and / or via a local control bus by at least one physical programmable logic controller (PLC) of the plant (ANL).

18. Backup system according to any one of claims 13 to 17, wherein the system (SAS) comprises a logistics system, a transport system, a building system, an automation system and / or a production system.

Images