PLC-based support for zero-downtime upgrade of control functions
By introducing a cyclic PubSub data bus and primary/secondary command identifiers into the PLC, the problem of the PLC's inability to support zero-downtime updates was solved, enabling safe and seamless control function updates and improving the system's reliability and automation level.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SIEMENS AG
- Filing Date
- 2021-11-25
- Publication Date
- 2026-06-09
AI Technical Summary
Existing PLCs cannot support the parallel operation of two control functions with the same function name without shutting down the system, resulting in control command conflicts and the inability to determine which command is passed to the actuator.
By introducing a cyclic PubSub data bus into the PLC, the control function and the actuator are decoupled. In each cycle, primary and secondary command identifiers are added to the control function, and only the primary command is transmitted to the actuator, thus achieving zero-downtime updates of the control function.
It enables safe and seamless updates of control functions without system downtime, reduces system downtime, improves the reliability and automation of updates, and supports field testing and rapid response to customer requests.
Smart Images
Figure CN116848476B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to a computer-implemented method for upgrading at least one control function performed on a technical system, the technical system including a PLC and at least one actuator controlled by the PLC. The control function is adapted to provide an output that controls the actuator, such as the movement of a robot. The invention further relates to an arrangement with a PLC using the computer-implemented method. Background Technology
[0002] PLCs (Programmable Logic Controllers, German: SPS—Speicher-programmierbare Steuerung) that provide publish / subscribe 1 communication modules (according to the communication standard OPC UA PubSub) need to support zero-downtime updates (zero-downtime deployment) of connected control functions from one version to another while the control functions and their actuators are running.
[0003] As an example, the control function "MoveRobotV1.0" issues control commands to the PLC actuator output, which controls the robot's movement. While the robot hardware (correspondingly MoveRobot V1.0) is running, this control function should eventually be replaced by another version, "MoveRobot V2.0," through an update. Therefore, both control functions, MoveRobot V1.0 and MoveRobot V2.0, need to run in parallel, but only one control function, MoveRobot V1.0 or MoveRobot V2.0, should control the robot. During the update process, actual control is transferred from the running control function MoveRobotV1.0 to the running control function MoveRobot V2.0. This update process throughout the operation of the entire system requires PLC support.
[0004] Current PLCs do not support this zero-downtime update scenario due to the following shortcomings:
[0005] a) The PLC does not support the deployment and execution of two different control functions with the same function / file name (e.g., "MoveRobot") that can run in parallel at the same time.
[0006] (b) Modern PLCs provide a publish-subscribe data bus (=communication module), where control functions can register as publishers for PubSub topics to publish control commands to the data bus via registered PubSub topics (e.g., MoveCommand). Other functions and applications can subscribe to this topic and other PubSub topics to receive control commands and pass them to the physical devices they are connected to, such as robots.
[0007] However, in current PLC implementations, two or more control functions running in parallel (even without different file / function names) and registered as publishers on the same PubSub topic (e.g., MoveCommand) cannot exclusively issue control commands to the PLC. The problem is that once both control functions are started and running, and both are registered as publishers on the same PLC PubSub topic, they compete to issue control commands to the same PubSub topic in parallel and in each scan cycle. Subsequently, the PLC cannot explicitly determine which of the two commands should be passed to the actuator. Typically, the PLC passes the command that was last set in the PLC's PubSub topic within the current scan cycle.
[0008] A PLC operates within a program scan cycle (PLC cycle), in which it repeatedly executes its program. The simplest scan cycle consists of three steps:
[0009] -Read input,
[0010] -Execute the program,
[0011] - Write to output.
[0012] The program follows a sequence of instructions. It typically takes the processor tens of milliseconds to evaluate all instructions and update the state of all outputs.
[0013] More details about PLC functionality are available, for example, at https: / / en.wikipedia.org / wiki / Programmable_logic_controller. Summary of the Invention
[0014] The purpose of this invention is to provide a solution for upgrading the control functions of a PLC with zero downtime.
[0015] To achieve the stated objective, the present invention provides a solution according to the independent claims. Advantageous embodiments are provided in the dependent claims.
[0016] The expected PLC support is as follows:
[0017] The PLC supports the deployment and execution of two control functions with the same name (e.g., MoveRobot).
[0018] • When two control functions are running in parallel, only one control function is controlling the actuator (primary control function). The other control function should be started and running, but should not (yet) issue control commands to the PLC PubSub topic (secondary control function with silent actuator output).
[0019] The PLC needs to support the following concepts: primary and secondary control functions—both with the same file / function name, both running in parallel, and both registered as publishers of control commands for the same PLC PubSub topic. Only commands for the primary control function should be passed to the actuator (e.g., robot) by the PLC PubSub engine.
[0020] • Update control functions using interrupts; the current PLC does not support deploying alternative control functions with the same name or running them in parallel. Only one of multiple control functions with the same name can run exclusively. Updating will require stopping and undeploying the current control function. Then deploy and start the new control function.
[0021] This invention addresses the need for PLC support for zero-downtime updates of control functions. It discloses a PLC providing a cyclic PubSub data bus that decouples control functions from physical actuators. In a further aspect, this invention relates to control functions implemented in higher-level programming languages such as C++. It does not cover control functions implemented in PLC programming languages covered by IEC 61131-34.
[0022] The CFC method does not provide information about the parallel deployment of CFCs, where one CFC is the primary control function and the parallel CFCs are secondary control functions. It does not provide information about whether control is transferred between the two parallel control functions. It states that type changes in the Run method are updates made during runtime, and in the event of an error, these updates appear not to be quickly recoverable.
[0023] To support zero-downtime updates for the control functions described above, the PLC needs to be able to perform the following:
[0024] • Deploy and run two alternative versions of the control functionality (e.g., MoveRobotV1.0 and MoveRobotV2.0).
[0025] Both control functions must be able to be registered as publishers on the same PLC PubSub topic (e.g., MoveCommand).
[0026] Both control functions must operate in parallel. It is important to note that the control functions themselves are aware of their primary / secondary states. They also know how to transfer actual control between themselves, as disclosed, for example, in patent application EP 3502875A1, “Seamless and safe upgrades of software intensive systems during operation.”
[0027] Both control functions publish their commands to the PLC PubSub topic in each cycle, along with additional information about whether the published control command is a primary or secondary command.
[0028] The PLC stores two control commands plus information about whether they are primary or secondary control commands.
[0029] The PLC only passes the main commands to the receiving app / function / subscriber of this PubSub topic.
[0030] This invention claims a computer-implemented method for upgrading at least one control function executed on a technical system, the technical system including a PLC and at least one actuator controlled by the PLC, wherein the control function is adapted to provide an output controlling the actuator, and wherein the computer-implemented method is adapted to:
[0031] a. Deploy at least one updated version of the control function on the system, while maintaining the current version of the control function on the system.
[0032] b. Where the updated version is prevented from controlling the actuator, thereby the current version and the updated version publish their commands to the PLC's publish / subscribe communication module in each PLC cycle, additionally containing information about whether the published control command is a primary or secondary control command, and
[0033] c. In each PLC cycle, the PLC transmits the issued control commands, which serve as the main control commands, to the actuator.
[0034] d. Thus, during the mutual negotiation process between the current version and the updated version, the information of the control commands issued by the updated version is changed to primary control commands, and the control commands issued by the current version are changed to secondary control commands.
[0035] In a further embodiment of the method, the PLC is configured to process the control function and an updated version of the control function in parallel, such that both control functions have the same file and / or function name, run in parallel, and are both registered as publishers of control commands on the same PLC publish / subscribe communication module.
[0036] In a further embodiment of the method, the control function is to control the movement of a machine, such as a robot.
[0037] In a further embodiment of the method, the control function and its updated version publish their control commands to the PLC publish / subscribe communication module in each cycle, along with additional information about whether the published control command is a primary or secondary command.
[0038] In a further embodiment of the method, the control function is written in a higher-level programming language, preferably C++.
[0039] In a further embodiment of the method, the cyclic publish / subscribe communication module decouples the control function from the actuator.
[0040] The present invention further claims an arrangement for upgrading at least one control function, including a PLC and at least one actuator controlled by the PLC, wherein the control function is adapted to provide an output controlling the actuator, wherein:
[0041] Deploy at least one updated version of the control function while maintaining the current version of the control function.
[0042] The PLC is designed and programmed to publish its commands to the PLC's publish / subscribe communication module in each PLC cycle, both the current and updated versions, and additionally includes information about whether the published control commands are primary or secondary control commands.
[0043] The PLC is designed and programmed to pass it to the actuator only in each PLC cycle if the issued control command is the primary control command.
[0044] -Thus, during the mutual negotiation process between the current version and the updated version, the information of the control commands issued by the updated version is changed to the primary control commands, and the control commands issued by the current version are changed to the secondary control commands.
[0045] In a further embodiment of the arrangement, the PLC is designed and programmed to handle the control function and an updated version of the control function in parallel, such that both control functions have the same file and / or function name, both run in parallel, and both are registered as publishers of control commands on the same PLC publish / subscribe communication module.
[0046] In a further embodiment of the arrangement, the control function is designed to control the movement of a machine, such as a robot.
[0047] In a further embodiment of the arrangement, the control function and its updated version publish their control commands to the PLC publish / subscribe communication module in each cycle, along with additional information about whether the published control command is a primary or secondary command.
[0048] In a further embodiment of the arrangement, the control functions are written in a higher-level programming language, preferably C++.
[0049] In a further embodiment of the arrangement, the cyclic publish / subscribe communication module is designed and programmed to decouple the control functions from the actuator.
[0050] This invention differs from the prior art Continuous Function Chart (CFC) method and is advantageous compared to the prior art as follows:
[0051] a. It solves the problem of zero-downtime updates for control functions written in higher-level programming languages (such as C++). The CFC method solves the problem of continuous function graphs. A graphical language for implementing control functions.
[0052] b. This invention addresses the provision of a cyclic PubSub data bus in a PLC that decouples control functions from physical actuators. The CFC method does not provide information about the existence of a cyclic PubSub engine in PCS 7. Instead, it states that control commands are directly mapped to the actuators.
[0053] c. The objective of this invention is the parallel deployment of two alternative control functions, where actual control can be safely and seamlessly transferred from one version to another, e.g., from MoveRobot V1.0 to MoveRobot V2.0, and vice versa, e.g., in the event of an error following an update to MoveRobot V2. PubSub-based PLCs only pass control commands for the primary control function to the actuators. The CFC method does not provide information about the parallel deployment of CFCs, where one CFC is the primary control function and the parallel CFCs are secondary control functions. It does not provide information about whether control is transferred between the two parallel control functions. It states that a Type Change in the Run method is an update during runtime, which appears not to be quickly recoverable in the event of an error.
[0054] The new method allows for seamless and secure updates to industrial control functions using a PLC to set control commands to its actuators, without stopping and interrupting the actuators for the update process. Furthermore, it allows for testing of the new control function on the target hardware and in the field with real-world data (such as robot sensor data) before the new control function (e.g., MoveRobot V2.0) is finally activated to take over control of the actuators.
[0055] Further benefits and advantages of the invention will become apparent after a careful reading of the detailed description with appropriate reference to the accompanying drawings. Attached Figure Description
[0056] Figure 1 A block diagram illustrating an embodiment where the robot moves is shown, and
[0057] Figure 2 It shows Figure 1 A spreadsheet containing commands. Detailed Implementation
[0058] Before explaining any embodiments of the invention in detail, it is to be understood that the invention is not limited in its application to the details of the construction and arrangement of the components set forth in the following description or illustrated in the following drawings. The invention can have other embodiments and can be practiced or implemented in various ways.
[0059] Furthermore, it should be understood that the wording and terminology used herein are for descriptive purposes and should not be considered restrictive. The use of “comprising,” “including,” or “having,” and variations thereof, herein means to cover the items listed thereafter and their equivalents, as well as additional items. The terms “connection” and “coupling” are used broadly and cover both direct and indirect connections and couplings. Moreover, electronic communication and notification can be performed using any known means, including wired connections, wireless connections, etc.
[0060] It should also be noted that the present invention can be implemented using multiple hardware and software-based devices and multiple different structural components. Furthermore, it should be understood that embodiments of the present invention may include hardware, software, and electronic components or modules, which, for the purposes of discussion, may be illustrated and described as if most components were implemented solely in hardware. However, those skilled in the art, and based on reading this detailed description, will recognize that in at least one embodiment, the electronic aspects of the present invention may be implemented in software executable by one or more processors (e.g., stored on a non-transitory computer-readable medium). Accordingly, it should be noted that the present invention can be implemented using multiple hardware and software-based devices and multiple different structural components. For example, the “control unit” and “controller” described in the specification may include one or more processors, one or more memory modules including a non-transitory computer-readable medium, one or more input / output interfaces, and various connections (e.g., system buses) connecting these components.
[0061] As an example of the present invention Figure 1 The diagram shows a block diagram of a PLC controlling robot R using the control functions MoveRobot V1.0 and MoveRobot V2.0 with the control commands "turn left" and "turn right". "Turn left" and "turn right" represent command sequences, such as turning left 90 degrees and turning back to 0 degrees when completed. Figure 2 A corresponding spreadsheet showing the valid commands in each PLC cycle (=cycles 0 to 100) is provided.
[0062] • In loop 0…99, the control function MoveRobot V1.0 issues the command “Turn Left” via the PubSub topic MoveCommand, including information that this is the primary command.
[0063] • In parallel (looping 0…99), the control function MoveRobot V2.0 issues commands via the PubSub topic MoveCommand to turn right, including information that this is a secondary command.
[0064] • In all PLC cycles, the PLC only passes the main command to the relevant actuator / subscriber, which in this embodiment is to the robot R. In cycles 0…99, the main command is a left turn provided by the control function MoveRobot V1.0.
[0065] In cycle 100, the two control functions MoveRobot V1.0 and V2.0 are arranged to (and without the aid of a PLC) transfer control of the actuator from MoveRobot V1 to MoveRobot V2.0.
[0066] This means that MoveRobot V1.0 changes its internal state from a primary control function to a secondary control function. On the other hand, MoveRobot V2.0 correspondingly changes its internal state from a secondary control function to a primary control function. It should be noted that a detailed description of this transfer process is not part of this application; it is described in a separate patent application EP 3502875A1.
[0067] The novelty of this approach lies in the fact that a PLC with a PubSub data bus (i.e., a publish / subscribe module) supports zero-downtime updates of the PLC control functions described above throughout the system's operation. Specifically, the PLC supports the parallel publishing of control commands from two alternative control functions on the same PLC PubSub topic, including indicators of which command is the primary and secondary command. Based on this, the PLC only transmits the primary command to the actuator. In this case, the PLC supports a safe and seamless transfer of control from one control function version to another. Explicit on / off / interrupt commands for the control function and associated actuators are not required to transfer control from one version to another.
[0068] This approach not only includes version updates as described above (MoveRobot V1.0 to MoveRobot V2.0), but also supports a safe and seamless handover to "alternative versions" of control functions, such as versions that can run with minimal resources in the event of PLC resource overload.
[0069] Combined with a continuous integration and continuous delivery (CI / CD) pipeline, software updates for PLC-based control functions can be fully automated from the initial steps of building, testing, and packaging the software, delivering it, and deploying the new control functions on the target device, until the control functions are fully automated, safe, and seamlessly updated on the target device while the system is running.
[0070] Another advantage of the described PLC primary / secondary command support is the so-called field software revision or field testing. The secondary version of the control function runs in parallel with the primary version on the target device without controlling the actuators. However, it does consume real sensor information, such as robot servo position, current, temperature, speed, etc. New (secondary) control functions can be tested using this real data from field sensors over any time period (second, hour, month). Therefore, testing the software in a laboratory environment does not require simulation data. This field testing mitigates the risk of software updates. New control functions do not necessarily need to be activated to become primary control functions. This use case is solely about field testing the software.
[0071] Generally, the implementation of the new method allows for faster, more reliable, and automated deployment of new PLC control functions during operation. It helps industrial systems and software providers respond quickly to changes such as new customer requests, software failures, etc. Instead of accepting primary and secondary control commands from the two alternative control functions described above, the PLC can support zero-downtime updates as follows.
[0072] • Control functions can be registered to the PLC PubSub data bus as the issuer of control commands.
[0073] • Once a control function is running, its control commands will not be automatically set to the PubSub data bus by the PLC. Instead, in each cycle, the PLC will transfer the entire process image of the control function to the PLC memory / PubSub data bus.
[0074] Instead, the control function itself should decide in each cycle whether to issue control commands to the PLC PubSub data bus, and which control commands to issue.
[0075] • Control commands issued to the PLC PubSub data bus in a previous cycle are not available on the PLC data bus in subsequent cycles (there is no data traced back from the previous cycle).
[0076] Other solutions are:
[0077] Zero-downtime updates for control functions are published on different PubSub topics: An alternative method for zero-downtime updates of PLC control functions is to deploy and execute two alternative versions of the control function on the PLC, and execute them in parallel (e.g., V1.0, V2.0). Both control functions are sent to different PLC PubSub topics; for example, control function V1.0 is sent on the PubSub topic MoveCommand_BLUE, while V2.0 is sent on the topic MoveCommand_GREEN.
[0078] The drawback of this solution is that the app receiving these control commands needs to subscribe to both topics MoveCommand_BLUE and MoveCommand_GREEN, and must be told in each loop which of the two PLCPUbSub topics it should get the command to pass to the hardware.
[0079] • Seamless swapping of redundant PLC hardware: In this method, two redundant PLC hardware units are provided, which host the same control functions (or alternative versions of the same control functions, such as V1.0 and V2.0). When the control functions are running on both PLCs, the two PLC hardware nodes can seamlessly take over control of the connected actuators.
[0080] Here, instead of updating a single software function, the entire PLC hardware, including all its control functions, is replaced.
[0081] Siemens SIMATIC Process Control System PC S7 – CFC Type Changes in Operation: The goal of this approach is to define control functions via Continuous Function Charts (CFCs). Changes to CFCs can be deployed and implemented without stopping the control system.
Claims
1. A computer implementation method for upgrading at least one control function executed on a technical system, the technical system comprising a PLC and at least one actuator (R) controlled by the PLC, wherein the PLC is capable of deploying and running an updated version and a current version of the control function, and wherein the PLC is configured to process the two versions of the control function in parallel, and wherein the PLC is configured to execute a primary control function controlling the actuator and a secondary control function having a silent actuator output, wherein the control function is adapted to provide an output controlling the actuator (R), and wherein the computer implementation method is adapted to: a. Deploy at least one updated version of the control function on the system, while maintaining the current version of the control function on the system. b. Wherein the updated version of the control function is prevented from controlling the actuator (R), thereby the current version and the updated version of the control function publish control commands to the PLC's publish / subscribe communication module in each PLC cycle, and additionally publish information about whether the published control command is a primary or secondary control command, and c. In each PLC cycle, the PLC transmits the issued control commands, which serve as the main control commands, to the actuator (R). d. Thus, during the mutual negotiation process between the current version and the updated version, the information of the control commands issued by the updated version is changed to primary control commands, and the control commands issued by the current version are changed to secondary control commands.
2. The method of claim 1, wherein the two control functions have the same file and / or function name, operate in parallel, and are both registered as publishers of control commands on the same PLC publish / subscribe communication module.
3. The method according to claim 1, thereby The control function is controlling the machine.
4. The method according to claim 3, thereby The machine is a robot (R), and the control function is controlling the movement of the robot.
5. The method according to any one of claims 1-4, thereby The control functions and their updated versions publish their control commands to the PLC publish / subscribe communication module in each PLC cycle, along with additional information about whether the published control command is a primary or secondary command.
6. The method according to any one of claims 1-4, thereby The control functions are written in higher-level programming languages, including C++.
7. The method according to any one of claims 1-4, thereby The cyclic publish / subscribe communication module decouples the control function from the actuator.
8. An arrangement for upgrading at least one control function, comprising a PLC and at least one actuator controlled by the PLC, wherein the PLC is capable of deploying and running an updated version and a current version of the control function, and wherein the PLC is configured to process both versions of the control function in parallel, and wherein the PLC is configured to perform a primary control function controlling the actuator and a secondary control function having a silent actuator output, wherein the control function is adapted to provide an output controlling the actuator, wherein: Deploy at least one updated version of the control function while maintaining the current version of the control function. The PLC is designed and programmed to publish commands to the PLC's publish / subscribe communication module in each PLC cycle, for both the current version and the updated version of the control function, and additionally includes information about whether the published control command is a primary or secondary control command. The PLC is designed and programmed to pass it to the actuator only in each PLC cycle if the issued control command is the primary control command. Therefore, during the mutual negotiation process between the current version and the updated version, the information of the control commands issued by the updated version is changed to primary control commands, and the control commands issued by the current version are changed to secondary control commands.
9. The arrangement according to claim 8, wherein the two control functions have the same file and / or function name, operate in parallel, and are both registered as publishers of control commands on the same PLC publish / subscribe communication module.
10. The arrangement according to claim 8, thereby The control function is designed to control the machine.
11. The arrangement according to claim 10, thereby The machine is a robot, and the control function is controlling the movement of the robot.
12. The arrangement according to any one of claims 8 to 11, thereby The control functions and their updated versions publish their control commands to the PLC publish / subscribe communication module in each PLC cycle, along with additional information about whether the published control command is a primary or secondary command.
13. The arrangement according to any one of claims 8 to 11, thereby The control functions are written in higher-level programming languages, including C++.
14. The arrangement according to any one of claims 8 to 11, thereby The cyclic publish / subscribe communication module is designed and programmed to decouple the control functions from the actuator.