Automated controller and method for operating an automated controller

Abstract

The invention relates to an automation controller and a method for operating an automation controller, the automation controller (1) having Ethernet channels (E11,..., E22), network interfaces (P1, P2) being assignable to the Ethernet channels, the assignment being implemented via a first register (5041) having a first register value (HWIF1) and a second register (5042) having a second register value (HWIF2) and the assignment being checked for deviations by means of a check value.

Description

Technical Field

[0001] This invention relates to an automation controller, comprising: a processor on which an operating system is loaded; a first interface module having at least a first Ethernet channel and a second Ethernet channel connected to a first selection circuit; a second interface module having at least a first Ethernet channel and a second Ethernet channel connected to a second selection circuit; a first network interface for connecting to a first network and a second network interface for connecting to a second network; a connection mechanism designed to connect the selection circuit to the network interface; a first register having a first register value and a second register having a second register value, wherein the selection circuit is designed to allocate Ethernet channels to the network interface according to the register values. Background Technology

[0002] Especially when the automation controller is designed as a functional safety-oriented control unit, safety-related settings, such as hardware configuration, must not be tampered with and must be appropriately protected during runtime. Previously, this protection was implemented in a so-called F-CPU (Fail-Safe CPU) from the user program. Previous solutions cannot be used for protected values ​​that are not accessible to the user program. Potential tampering must also be identified when the automation controller is stopped or without the assistance of a safety program (F-program / user program). Summary of the Invention

[0003] Therefore, the object of the present invention is to provide an automation controller that reliably identifies tampering, particularly tampering of register values ​​used for network interface allocation.

[0004] Regarding the automation controller mentioned at the beginning, this objective is achieved as follows: the operating system is designed to generate numbers within a defined period and includes a query mechanism designed to apply a logic function to the register value containing the number in each period to generate a return value. The operating system is also designed to apply a logic function to the return value containing the number to generate the register value again. Furthermore, there are code instructions designed to compare the regenerated register value with a check value and, if there is a deviation, to set the automation controller to a safe state.

[0005] Network separation is now achieved by protecting security-related values, especially register values, through dual inputs (rated value and check value).

[0006] Furthermore, it is advantageous to periodically read the actual value and compare it with the checksum. In case of inconsistency, appropriate reactions occur, such as a stop state or a failure accompanied by the shutdown of all network interfaces.

[0007] The actual value of the register can be read through the following mechanism. Asynchronous services can be used to define the path to the facility EDDP (Ethernet Device Driver PNIP) using the facility PNIO basic package. The automation controller's operating system can generate a 32-bit random value every 1000ms and transmit it to the EDDP. In the EDDP, the 32-bit random value is XORed with the actual value and sent back to the operating system. The automation controller then uses special code instructions to compare these so-called actual port mapping values ​​with a checksum, and if there is a discrepancy, the automation controller is switched to a fault state, thereby disconnecting all physical ports / network interfaces.

[0008] Another design variant of the automation controller proposes a checksum table and a combination table with checksum values. The combination table lists the combinations of Ethernet channel-to-network interface assignments, while the checksum table stores the checksum value assigned to each combination. Since the known checksum values ​​are now assigned to combinations, port mappings can be configured for the expected periodic checks.

[0009] If the automation controller has code instructions, the verification is further improved. The code instructions are designed to multiply the first register value generated again by a first factor and check whether the product corresponds to a first check value, and to multiply the second register value generated again by a second factor and check whether the product corresponds to a second check value.

[0010] For example, if we perform a checksum operation with 0x200 as the first check value... H The multiplication and the addition of 0x20000O as the second check value H If the multiplication is such that only one bit (the minimum value) of the register content changes during runtime, then it is also possible to detect that the register content has changed at runtime.

[0011] In professional security applications, it is advantageous to select the register values ​​used for the allocation of Ethernet channels and network interfaces in a way that ensures the separation of the first and second networks.

[0012] This security-related setting of the register value must be protected against tampering due to hardware and software errors. This setting (register value) relates to the function provided by the fail-safe CPU (F-CPU) "Network splitter according to IEC 61784-3-3 (Professional Safety)". This protection can also be effectively implemented in a favorable manner when there is no user program (F-program) or when it is still stopped.

[0013] Within the scope of this invention, a network splitter is understood as an absolute network splitter between two network interfaces. For cases where the first and second network interfaces belong to different local Ethernet interfaces or networks, bridging at communication layer 2 is not permitted for these interfaces. Bridging at communication layer 2 is also not permitted for a configuration where the first interface is intended to connect to a local Ethernet network and the other interface connects to a backplane bus module of an automation controller with an Ethernet interface.

[0014] Advantageously, the automation controller has an input mechanism designed to allow users to select and set combinations. Through a display on the automation controller, the user can, for example, select interface changes or combinations. The selected combination can be confirmed by the user by verifying relevant check values.

[0015] The objective mentioned at the beginning is also achieved through a method for operating an automation controller, wherein, for network separation of the first network and the second network, the first register value of the first register and the second register value of the second register are monitored to prevent tampering due to hardware and software errors. The register values ​​are used to set a first selection circuit or a second selection circuit. Here, the selection circuit is operated to allocate the Ethernet channel of the interface module to the network interface and then to the network according to the register value. A number is generated from the operating system of the automation controller within a defined period, and a logic function is applied to the register value with that number in each period to generate a return value. The operating system then applies a logic function to the return value with that number to generate another register value. Code instructions are also executed, which compare the regenerated register value with a checksum and, if there is a deviation, set the automation controller to a safe state.

[0016] Regarding the implementation of code instructions, checksum tables and combination tables with check values ​​have proven beneficial. The combination table lists and compares the combinations of Ethernet channels and network interfaces, while the checksum table stores the checksum associated with each combination.

[0017] In order to still be able to identify changes of only 1 bit, the first register value generated again is multiplied by the first factor and the product is checked to see if it corresponds to the first check value, and the second register value generated again is multiplied by the second factor and the product is checked to see if it corresponds to the second check value.

[0018] When operating an automation controller for functional safety, it is advantageous that the automation controller operates as an automation control unit designed for functional safety, and that the first network and the second network are separated according to the standard IEC 61784-3. Attached Figure Description

[0019] The accompanying drawings illustrate embodiments of the present invention. The drawings show:

[0020] Figure 1 Showing the automation controller,

[0021] Figure 2 Show the combination table,

[0022] Figure 3 The checksum table is shown, and

[0023] Figure 4 This shows an explanation of assigning register values ​​to registers. Detailed Implementation

[0024] Figure 1 An automation controller 1 is shown. The automation controller 1 has a processor MP on which an operating system FW is loaded. For communication connectivity, the automation controller 1 has a first interface module IF1 and a second interface module IF2. The first interface module IF1 is designed, for example, as a PN-IP 100 Mbps module. The second interface module IF2 is designed as a PN-IP 100 Gbps module. Selection circuits Mux1 and Mux2 are provided between the interface modules IF1 and IF2 and the network interfaces P1, ..., P4. Because the first interface module IF1 has a first Ethernet channel E11, a second Ethernet channel E12, a third Ethernet channel E13, and a fourth Ethernet channel E14, as well as different Ethernet channels E11, ..., E14, it can be connected to different network interfaces P1, P2, P3, P4 via the selection circuits Mux1 and Mux2 (EDD, Ethernet device driver). For this purpose, the automation controller 1 has a first register 5041 with a first register value HWIF1 and a second register 5042 with a second register value HWIF2. The selection circuits Mux1 and Mux2 are designed to assign Ethernet channels E11, ..., E22 to network interfaces P1, P2, P3, and P4 based on register values ​​HIF1 and HIF2. Because this assignment is particularly relevant to the security-critical functionality of network splitters in specialized security environments, the assigned register values ​​HIF1 and HIF2 must be monitored.

[0025] To this end, the operating system FW is designed to generate a number ZZ, such as a random number, within a defined period Z and utilize a query mechanism AM. This query mechanism is designed to apply a logic function to register values ​​HWIF1 and HWIF2 with the number ZZ in each period Z. This generates a return value ZZ' and returns it to the operating system FW. In the operating system FW, the logic function XOR is reapplied to the return value ZZ' with the number ZZ, thereby generating register values ​​HWIF1' and HWIF2' again. For further verification, there is a code instruction SC, which is designed to compare the newly generated register values ​​HWIF1' and HWIF2' with the checksum values ​​CV_HWIF1 and CV_HWIF2 (see...). Figure 3 The comparison is performed, and if there is a discrepancy, the automation controller 1 is set to a safe state. For this purpose, for example, a comparator 30 is provided, which forces the automation controller 1 into a stop state.

[0026] The code instruction SC is also designed to multiply the newly generated first register value HWIF1' by the first factor F1 and check whether the product corresponds to the first check value CV_HWIF1, and to multiply the newly generated second register value HWIF2' by the second factor F2 and check whether the product corresponds to the second check value CV_HWIF2.

[0027] As an example configuration of the automated controller 1 for the network splitter, from Figure 2 In the configuration table KT shown, the sixth combination K6 is selected. The sixth combination K6 specifies that the first Ethernet channel E11 of the first interface module IF1 is connected to the first network interface P1, and the second Ethernet channel E12 of the second interface module IF2 is connected to the second network interface P2.

[0028] from Figure 3 The following register values ​​were obtained for the sixth combination K6. The first register value, HWIF1, obtained the value 0x7770. H And the second register value HWIF2 obtained the value 0x71. H Accordingly, for the first register value HWIF1 and the second register value HWIF2, the checksum 0xEE E000 is selected in the sixth combination K6. H and 0xE200 0000 H This means the register value is 0x770. H With 0x200 H The multiplication must yield the corresponding check value 0xEE E000 H .

[0029] Figure 4The possible allocation is illustrated using register 5041 as an example. Register 5041 has an address of 000504H. In the line named "bit number," 32 bits can be allocated to the register. For example, 0x7770 is given. H The configuration is as follows. This means that bits 0 to 2 are configured with 0, bits 4 to 6 with 1, bits 8 to 10 with 1, and bits 12 to 14 with 1. The binary number can be divided into groups of four and simply converted to hexadecimal, i.e., a block with four "1"s corresponds to "7". As shown in the explanation columns (BES, BEZ) for bits 0 to 2, the configuration with "000" has the same meaning as wiring to the first network interface P1, the allocation of bits "001" corresponds to the connection to the second network interface E2, the allocation of bits with "010" corresponds to the connection to the third network interface P3, and the allocation with "011" corresponds to the connection to the fourth network interface P4. The allocation of bits with "100" to "110" is reserved and behaves similarly to the allocation with "111" (no physical port), which is equivalent to no network interface allocation.

[0030] All bits are initialized to 0x7. H This initial value corresponds to "111" and therefore no port assignment is given for security reasons.

Claims

1. An automation controller (1), comprising: Processor (MP), on which an operating system (FW) is loaded, A first interface module (IF1) having at least a first Ethernet channel (E11) and a second Ethernet channel (E12) connected to a first selection circuit (Mux1). The second interface module (IF2) has at least a first Ethernet channel (EA21) and a second Ethernet channel (EA22) connected to the second selection circuit (Mux2). A first network interface (P1) for connecting to a first network (N1) and a second network interface (P2) for connecting to a second network (N2), A connection mechanism (VM) designed to connect selection circuits (Mux1, Mux2) to network interfaces (P1, P2). A first register (5041) has a first register value (HWIF1) and a second register (5042) has a second register value (HWIF2), wherein the selection circuit (Mux1, Mux2) is designed to allocate Ethernet channels (E11, ..., E22) to network interfaces (P1, P2) according to the register values ​​(HWIF1, HWIF2). The operating system (FW) is characterized in that it is designed to generate a number (ZZ) within a defined period (Z) and has a query mechanism (AM) designed to apply a logical function (XOR) to the register values ​​(HWIF1, HWIF2) with the number (ZZ) in each period (Z) to generate a return value (ZZ'). The operating system (FW) is also designed to apply the logical function (XOR) to the return value (ZZ') with the number (ZZ) to generate the register values ​​(HWIF1', HWIF2') again. It also has code instructions (SC) designed to compare the regenerated register values ​​(HWIF1', HWIF2') with check values ​​(CV_HWIF1, CV_HWIF2) and set the automation controller (1) to a safe state if there is a deviation.

2. The automation controller according to claim 1, comprising a checksum table (PWT) with the checksums (CV_HWIF1, CV_HWIF2) and a combination table (KT), wherein the combination table lists combinations (K1, ..., K6) of the allocation of Ethernet channels (E11, ..., E22) to network interfaces (P1, P2), wherein, The check value table (PWT) stores the check values ​​(CV_HWIF1, CV_HWIF2) associated with each combination (K1, ..., K6).

3. The automation controller (1) according to claim 2, wherein, The code instruction (SC) is designed to multiply the first register value (HWIF1') generated again by a first factor (F1) and check whether the product corresponds to a first check value (CV_HWIF1), and to multiply the second register value (HWIF2') generated again by a second factor (F2) and check whether the product corresponds to a second check value (CV_HWIF2).

4. The automation controller (1) according to any one of claims 1 to 3, wherein, The register values ​​(HWIF1, HWIF2) used to assign Ethernet channels (E11, ..., E22) to network interfaces (P1, P2) are selected to ensure that the first network (N1) and the second network (N2) are isolated from each other.

5. The automation controller according to any one of claims 1 to 4, wherein, An input mechanism (EM) is provided, which is designed to enable the user to select and set combinations (K1, ..., K6).

6. A method for operating an automation controller (1), wherein, To separate the first network (N1) from the second network (N2), the first register value (HWIF1) of the first register (5041) and the second register value (HWIF2) of the second register (5042) are monitored to prevent tampering due to hardware and software errors. The register values ​​(HWIF1, HWIF2) are used to set the first selection circuit or the second selection circuit (Mux1, Mux2). The selection circuit (Mux1, Mux2) is operated to allocate the Ethernet channels (E11, ..., E22) of the interface modules (IF1, IF2) to the network interfaces (P1, P2) and then to the network (NW1, NW2) according to the register values ​​(HWIF1, HWIF2). A number (ZZ) is generated from the operating system (FW) of the automation controller (1) within a defined period (Z), and the number is used to select the network interface (NW1, NW2) in each period (Z). The register values ​​(HWIF1, HWIF2) of (Z) are subjected to a logical function (XOR) to generate a return value (Z'). In the operating system (FW), the logical function (XOR) is applied to the return value (Z') with the number (ZZ) to generate register values ​​(HWIF1', HWIF2') again. Code instructions (SC) are also executed, which compare the regenerated register values ​​(HWIF1', HWIF2') with check values ​​(CV_HWIF1, CV_HWIF2) and set the automation controller (1) to a safe state if there is a deviation.

7. The method according to claim 6, wherein, A check value table (PWT) and a combination table (KT) with the check values ​​(CV_HWIF1, CV_HWIF2) are used, wherein the combination table lists the combinations (K1, ..., K6) of the allocation from Ethernet channels (E11, ..., E22) to network interfaces (P1, P2), wherein the check value table (PWT) stores the check value (CV_HWIF1, CV_HWIF2) associated with the corresponding combination (K1, ..., K6) for each combination (K1, ..., K6).

8. The method according to claim 6 or 7, wherein, The code instruction (SC) is used to multiply the first register value (HWIF1') generated again by the first factor (F1) and check whether the product corresponds to the first check value (CV_HWIF1), and the second register value (HWIF2') generated again is multiplied by the second factor (F2) and check whether the product corresponds to the second check value (CV_HWIF2).

9. The method according to any one of claims 6 to 8, wherein, The automation controller (1) operates as an automation control unit designed for functional safety, and the first network (N1) and the second network (N2) are network-separated according to the standard IEC 61784-3.

Images