Method and system for providing time-critical control applications

Abstract

The invention relates to a time-critical control application provided by a sequence control component (113, 123, 133), each of which can be loaded into a sequence control environment (112, 122, 132) formed by means of a server device (101-103) and can be executed there. The control application uses periodically acquired measured variables and / or state variables (12) to periodically determine manipulated variables (11) for a process to be controlled or regulated. A plurality of mutually redundant sequence control components (113, 123, 133) are executed in parallel with one another. As soon as the majority of mutually redundant sequence control components send a signal that the measured variables and / or state variables (12) for the corresponding acquisition time are correctly present, the mutually redundant sequence control components (113, 123, 133) determine the manipulated variables (11) for the corresponding process cycle, which process cycle is after the corresponding acquisition time of the measured variables and / or state variables (12). Alternatively or additionally, the determined manipulated variable is transmitted to the actuator (320) and / or the control unit (31-32) together with a serial number assigned to the respective process cycle.

Description

Technical Field

[0001] The invention relates to a method for providing a time-critical control application, in particular a control application in an industrial automation system, and to a system which is suitable for carrying out the method. Background Art

[0002] Industrial automation systems usually include a large number of automation devices that are networked to each other via an industrial communication network and serve to control or regulate facilities, machines or equipment within the framework of manufacturing or process automation. Due to the time-critical framework conditions in industrial automation systems, real-time communication protocols such as PROFINET, PROFIBUS, Real-Time Ethernet or Time Sensitive Network (TSN) are mainly used for communication between automation devices.

[0003] In Ethernet-based communication networks, due to the common use of very different applications, problems may arise, for example, when network resources for transmitting data streams or data frames with real-time requirements are used competitively for transmitting data frames with a large user data content without special quality of service requirements. This may result in that the data streams or data frames with real-time requirements cannot be transmitted according to the requested or required quality of service.

[0004] WO2019 / 001718A1 describes a method for data transmission that is able to associate protected communication with a low network configuration effort. Here, when reserving resources for the transmission of a data stream from a sender to a receiver, at least two at least partially redundant paths are reserved. By extending the reservation protocol, duplicate filters are automatically configured at the network nodes assigned to the redundant path portions during resource reservation.

[0005] It is known from EP3674824A1 that the data streams assigned to the selected control applications running on the terminal device are respectively specified as separate time windows within a predetermined time interval. Each time window has a separate cycle duration, which corresponds to a multiple of the general cycle duration or corresponds to the general cycle duration. The first or second communication device checks for each selected control application whether the specified time window for data transmission is available. If the time window is available, information about the start of the time window is transmitted to the terminal device within the specified time interval, and the corresponding selected control application is running on the terminal device. The data streams assigned to the selected control application are transmitted according to the information about the start of the corresponding time window.

[0006] A method for providing centralized management of a software defined automation system (SDA system) is described in WO2017 / 064560A1. The SDA system includes the acquisition of controller nodes and the acquisition of logically centralized but physically dispersed computing nodes by monitoring the activities of computing nodes. Here, the execution, network and security environment within the SDA system can be monitored by system components to identify critical events in a predetermined environment. At least one component is corrected in a predetermined environment in response to the identified critical events. The correction in the predetermined environment causes the correction of at least one component to occur in at least one other environment.

[0007] In industrial automation systems, control applications are usually executed in real-time systems (such as programmable controllers) so that deterministic operation of the control application can be ensured. Within the scope of a process cycle, measured variables and / or state variables are first queried from the process to be controlled or regulated as input signals. The control application then determines the manipulated variables as output signals based on the queried input signals. Finally, the output signals are transmitted to the device to be controlled or regulated via a communication system that is ideally capable of real-time.

[0008] However, in a virtualized control system or an operating system without real-time extensions, control applications do not have direct access to the hardware and control flow environment. This means, for example, that immediate execution of control commands cannot be forced. In particular, in a virtualized control system or an operating system without real-time extensions, it is possible for high-priority control applications to be replaced or delayed in execution. This can happen, for example, when two control applications running in a virtualized environment simultaneously request exclusive access to the same resource. Summary of the invention

[0009] The object of the present invention is to provide a method for providing a time-critical control application in an environment which itself does not have real-time capabilities or to specify a suitable device for carrying out the method.

[0010] This object is achieved according to the invention by a method having the features specified in the invention and by a system having the features specified in the invention. Advantageous developments are specified in the dependent claims.

[0011] According to the method of the invention, a control application is provided by means of a sequence control component, which can be loaded into a sequence control environment formed by means of a server device and can be executed in the sequence control environment. The control application uses periodically acquired measured variables and / or state variables to periodically determine manipulated variables for a process to be controlled or regulated.

[0012] The sequence control component is preferably a software container, Java bytecode or an application running on an operating system, while the sequence control environment can be a container runtime environment, such as a Docker engine, a Java virtual machine or an operating system without real-time extensions. In principle, the sequence control component can also use alternative micro-virtualization concepts, such as Snaps. Accordingly, the sequence control environment can also include a Snap Core.

[0013] Preferably, the software containers are designed and configured to run on a host operating system installed in a server device in isolation from other software containers or container groups in a sequence control environment. In particular, the software containers use the kernel of the host operating system of the server device together with other software containers running on the server device.

[0014] According to the invention, a plurality of mutually redundant sequence control components are executed in parallel with one another. Furthermore, the mutually redundant sequence control components transmit the determined manipulated variables together with the sequence numbers assigned to the respective process cycles to the actuators or control units. The actuators or control units recognize the copies of the transmitted manipulated variables based on the sequence numbers and filter them accordingly. Furthermore, it can be provided that the mutually redundant sequence control components determine the manipulated variables for the respective process cycles, which follow the respective acquisition times of the measured variables and / or state variables, as soon as the majority of the mutually redundant sequence control components signal the correct presence of the measured variables and / or state variables for the respective acquisition times.

[0015] The invention makes it possible to execute time-critical control applications in sequence control environments which are not themselves real-time capable, namely by the coordination of the above-mentioned mutually redundant sequence control components or by the coordinated, redundant transmission of certain manipulated variables. Thus, conventional IT infrastructures can be used to implement control tasks which usually require real-time capabilities. Particularly high availability is achieved when mutually redundant sequence control components transmit the manipulated variables to the actuators or to the transmission control units via disjoint paths or when the manipulated variables are respectively transmitted to mutually redundant control units.

[0016] According to the invention, mutually redundant sequence control components subscribe to a data stream containing periodically acquired measured variables and / or state variables in a consistent manner. In this way, it can be ensured that the mutually redundant sequence control components operate with a consistent process image. Preferably, the data stream containing periodically acquired measured variables and / or state variables is published by the corresponding data source and / or sensor in each case by means of a data stream announcement, and the data stream is transmitted to a multicast address, which is assigned to the sequence control components subscribing to the corresponding data stream.

[0017] Furthermore, according to the invention, the measured variables and / or state variables are transmitted to mutually redundant sequence control components together with the sequence numbers assigned to the respective acquisition times. For this purpose, the mutually redundant sequence control components transmit the determined manipulated variables to the actuators or control units by means of data streams. For transmitting the measured variables and / or state variables for the respective acquisition times, the same sequence numbers are used as for transmitting the determined manipulated variables for the respective process cycles that follow the respective acquisition times of the measured variables and / or state variables. In this way, the random properties of the distributed system can be effectively utilized in combination with the communication system functions for deterministic and redundant transmission of the data streams, thereby achieving random determinism for the control application.

[0018] According to the present invention, quality of service requirements are specified for the transmission of data streams. According to these quality of service requirements, resources for transmitting the data stream are reserved in a communication device that forwards the data stream, such as a switch, a bridge or a router. According to the quality of service requirements, resources for transmitting the data stream are reserved in the communication device that forwards the data stream with sufficient availability, wherein the resources include an available transmission time window in the switch or the bridge, a bandwidth, a guaranteed maximum delay, a number of queues, a queue buffer and / or an address buffer.

[0019] According to a particularly preferred embodiment of the invention, the communication devices forwarding the data streams are connected to one another via a time-critical network, in particular in accordance with IEEE 802.3, IEEE 802.1Q, IEEE 802.1AB, IEEE 802.1AS, IEEE 802.1BA or IEEE802.1CB. The forwarding of the data streams is therefore controlled in particular in accordance with IEEE 802.1Q by means of frame preemption, in particular in accordance with IEEE 802.1Q by means of a time-aware shaper, in particular in accordance with IEEE 802.1Q by means of a credit-based shaper, by means of a burst-limiting shaper, by means of a creeping shaper and / or by means of a priority-based shaper. In this way, a reliable and verified communication system function can be achieved for deterministic and redundant transmission of the data streams.

[0020] The mutually redundant sequence control components each signal the correct presence of the measured variable and / or state variable for the corresponding acquisition time by means of a confirmation message sent to the other redundant sequence control components. In addition, if the measured variable and / or state variable is present in a delayed and / or erroneous manner in the majority of mutually redundant sequence control components, an error signal is sent and / or the last determined manipulated variable is transmitted again. As a result, the prescribed system behavior can be ensured even in the event of an error. For example, if the sequence control component does not receive the measured variable and / or state variable within the permissible delay of the corresponding acquisition time, the measured variable and / or state variable appears in a delayed manner.

[0021] The system for providing a time-critical control application according to the present invention is suitable for executing the method according to the above-mentioned embodiment, and comprises a plurality of server devices, a plurality of sequence control environments formed by means of the server devices, and a plurality of sequence control components for providing a control application. The sequence control components can be loaded into the sequence control environment formed by means of the server devices and can be executed in the above-mentioned sequence control environment. For this purpose, the control application is configured and designed to periodically determine the manipulated variables for the process to be controlled or adjusted according to the periodically acquired measured variables and / or state variables.

[0022] The sequence control components of the system according to the invention are arranged and designed to be executed in parallel as mutually redundant sequence control components, to subscribe to a data stream containing periodically acquired measured variables and / or state variables in a consistent manner and to transmit certain manipulated variables to actuators or control units by means of the data stream. Accordingly, the system according to the invention is arranged and designed such that a quality of service requirement is specified for the transmission of the data stream and the measured variables and / or state variables are transmitted to the mutually redundant sequence control components together with a sequence number assigned to the acquisition time.

[0023] In addition, the sequence control component is configured and designed to transmit the determined manipulated variables together with the sequence numbers assigned to the corresponding process cycles to the actuator or control unit. Accordingly, the actuator or control unit is configured and designed to identify and filter the copies of the transmitted manipulated variables according to the sequence numbers. In addition, the system according to the invention is configured and designed to use the same sequence numbers as the sequence numbers used to transmit the determined manipulated variables for the corresponding process cycles for transmitting the measured variables and / or state variables for the corresponding acquisition times, the process cycles being after the corresponding acquisition times of the measured variables and / or state variables. In addition, the system is configured and designed so that in the communication device forwarding the data stream, resources for transmitting the data stream are reserved with sufficient availability according to the quality of service requirements, wherein the resources include available transmission time windows, bandwidths, guaranteed maximum delays, number of queues, queue buffers and / or address buffers in switches or bridges. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The present invention will be explained in more detail below based on the embodiments in the accompanying drawings. The drawings show:

[0025] Figure 1 A system for providing a time critical control application is shown. DETAILED DESCRIPTION

[0026] The system shown in the figure includes a plurality of server devices 101-103 for providing a control application for an industrial automation system. The control application for an industrial automation system is an example of a time-critical service and can also include a monitoring function. In the present embodiment, the server devices 101-103 are connected to two mutually redundant input / output units 301-302 via a communication network including a plurality of switches 201-203, and the input / output units serve as control units for the connected sensors and actuators. For example, a camera system 310 can be used as a sensor, and a machine controlled by the above-mentioned control application can be connected to the input / output units 301-302 as an actuator.

[0027] The switches 201-203 are designed in particular for forwarding data flows via time-critical networks according to IEEE 802.3, IEEE 802.1Q, IEEE 802.1AB, IEEE 802.1AS, IEEE 802.1BA and IEEE 802.1CB. For this purpose, the forwarding of the data flows is controlled in particular according to IEEE 802.1Q by means of frame preemption, in particular according to IEEE 802.1Q by means of a time-aware shaper, in particular according to IEEE 802.1Q by means of a credit-based shaper, by means of a burst-limiting shaper, by means of a creeping shaper and / or by means of a priority-based shaper.

[0028] The server devices 101-103 can realize the functions of, for example, a control device (such as a programmable controller) of an industrial automation system by means of a control application. In this way, the server devices 101-103 can be used in particular for the exchange of control variables and measurement variables with a machine or device controlled by the server devices 101-103. To this end, the server devices 101-103 can determine appropriate manipulated variables for the machine or device based on the acquired measurement variables and / or observed state variables.

[0029] Alternatively or additionally, the server devices 101-103 can realize the functions of an operating station and an observation station by means of a control application and can therefore be used to visualize process data or measured variables and control variables processed or acquired by the automation device. In particular, the server devices 101-103 can be used to display the values ​​of the control circuits and to change the control parameters or control programs.

[0030] A control application is provided in the server devices 101-103 by means of a sequence control component 113, 123, 133, which can be loaded into a sequence control environment 112, 122, 132 formed by the corresponding server devices 101-103 and can be executed there. The sequence control environment 112, 122, 132 is installed as an application on the host operating system 111, 121, 131 of the corresponding server device 101-103. In addition, sequence control components 114, 124 for non-time-critical applications can also be executed within the sequence control environment.

[0031] In the present embodiment, the sequence control components 113-114, 123-124, 133 are software containers or include software containers, which are respectively isolated from other software containers, container groups or container sets (Pods) in the sequence control environment 112, 122, 132 on the corresponding host operating system 111, 121, 131. To this end, these software containers, together with other software containers 121, 131 running on the corresponding server devices 101-103, use the kernel of the corresponding host operating system 111. The sequence control environment 112, 122, 132 is preferably a container runtime environment or a container engine. According to an alternative embodiment, the sequence control components 113-114, 123-124, 133 can include Java bytecode or an application running on an operating system, and the sequence control environment 112, 122, 132 is in this case a Java virtual machine or an operating system without real-time extensions.

[0032] The isolation of sequence control components or selected operating system devices from one another can be achieved in particular by means of control groups and namespaces. Process groups can be defined by means of control groups in order to limit the resources available to the selected groups. Individual processes or control groups can be isolated or hidden from other processes or control groups by namespaces.

[0033] The control application periodically determines the manipulated variables 11 of the process to be controlled or regulated as a function of the periodically acquired measured variables and / or state variables 12. For this purpose, a plurality of mutually redundant sequence control components 113, 123, 133 are executed in parallel with one another. In the present exemplary embodiment, the mutually redundant sequence control components 113, 123, 133 subscribe to a data stream for the periodically acquired measured variables and / or state variables 12, which can in particular come from the camera system 310. The data stream comprising the periodically acquired measured variables and / or state variables is published by the corresponding data source and / or sensor 310 by means of a data stream announcement, for example a talker announcement, and the data stream is transmitted to a multicast address, which is assigned to the sequence control components 113, 123, 133 that subscribe to the corresponding data stream.

[0034] For the transmission of data streams, in particular, it is possible to specify a quality of service requirement at the talker end or the listener end, so that resources are reserved for the transmission of the data stream according to the quality of service requirement in the communication device forwarding the data stream, such as the switch 201-203. This is based on the premise that sufficient resources are available in the communication device forwarding the data stream. For this purpose, the above-mentioned resources include, for example, available transmission time windows, bandwidth, guaranteed maximum delay, number of queues, queue buffers or address buffers included in the switch or bridge.

[0035] As soon as the majority of mutually redundant sequence control components signal that a measured and / or state variable 12 is correctly present for the respective acquisition time, the mutually redundant sequence control components 113, 123, 133 determine the manipulated variable 11 for the respective process cycle that follows the respective acquisition time of the measured and / or state variable 12. In the present exemplary embodiment, the mutually redundant sequence control components 113, 123, 133 each signal that a measured and / or state variable 12 is correctly present for the respective acquisition time by means of a confirmation message 10 sent to the other redundant sequence control components.

[0036] If the measured variable and / or state variable 12 is present in a delayed and / or erroneous manner in the majority of mutually redundant sequence control components 113, 123, 133, an error signal is emitted and / or the last determined manipulated variable 11 is transmitted again. If the sequence control component does not receive the measured variable and / or state variable within the permissible delay of the corresponding acquisition time, the measured variable and / or state variable occurs in a delayed manner.

[0037] Alternatively or additionally, the mutually redundant sequence control components 113, 123, 133 transmit the determined manipulated variable 11 together with the sequence number assigned to the corresponding process cycle to the actuator 320 or the control unit 31-32. In particular, this can be achieved independently of whether or when the measured variable and / or state variable 12 is correctly present in the majority of the mutually redundant sequence control components 113, 123, 133 for the corresponding acquisition time. The actuator 320 or the control unit 31-32 can identify and filter the transmitted copies of the manipulated variable 11 based on the sequence number. This copy filtering can also be achieved by the switches 201-203 after the manipulated variable 11 is forwarded via partially disjoint paths.

[0038] Preferably, the measured variables and / or state variables 12 are transmitted to the mutually redundant sequence control components 113, 123, 133 together with the sequence numbers assigned to the respective acquisition times by means of the subscribed data stream. Accordingly, the mutually redundant sequence control components 113, 123, 133 transmit the determined manipulated variables 11 to the actuators 320 or the control units 31-32 by means of the data stream. Therefore, for transmitting the measured variables and / or state variables 12 for the respective acquisition times, the same sequence numbers are used as for transmitting the determined manipulated variables 11 for the respective process cycles that follow the respective acquisition times of the measured variables and / or state variables 12.

[0039] For duplicate filtering, the size or depth of duplicate filtering can be set based on the maximum change in the frame runtime or packet runtime when transmitting the manipulated variable 11. In addition, it is possible to consider the minimum interval length with which the measured variable and / or state variable 12 is periodically transmitted via the corresponding data source or sensor 310. The changes in the minimum and maximum runtime of the copies of the manipulated variable 11 generated by the mutually redundant sequence control components 113, 123, 133 can be determined relatively easily at the connection point, for example at the switch 201-203. In particular, in a deterministic communication network, the function of reducing jitter can be used at the connection point merging point. In the transmission of the manipulated variable 11 or the measured variable and / or state variable 12, reduced jitter can be obtained by targeted delays.

[0040] According to a particularly preferred embodiment variant, a supervisor 100 is provided for using redundant data transmission, asynchronous communication, diagnosis of distributed systems and for coordination of mutually redundant sequence control components 113, 123, 133. With the help of the supervisor, for example, redundant sequence control components can be added or removed. It is particularly suitable to remove sequence control components from a redundant sequence control component cluster when the sequence control components delay the acceptance or delay the processing of required measurement variables and / or state variables. In this way, delays and jitters can be reduced.

Claims

1. A method for providing a time-critical control application, wherein: - providing the control application by means of a sequence control component (113, 123, 133), which can be loaded into a sequence control environment (112, 122, 132) formed by means of a server device (101-103) and executed in the sequence control environment, the control application uses the periodically acquired measured variables and / or state variables (12) to periodically determine manipulated variables (11) for the process to be controlled or regulated, a plurality of mutually redundant sequence control components (113, 123, 133) are executed in parallel with one another, each of which uniformly subscribes to a data stream containing the periodically acquired measured variables and / or the state variables (12) and transmits the determined manipulated variables to the actuators and / or control units with the aid of the data stream, - specifying quality of service requirements for the transmission of said data flow, the measured variables and / or the state variables are transmitted together with the sequence numbers assigned to the respective acquisition times to the mutually redundant sequence control components, the mutually redundant sequence control components (113, 123, 133) transmit the determined manipulated variable (11) together with the sequence number assigned to the corresponding process cycle to the actuator (320) and / or the control unit (31-32), - the actuator (320) and / or the control unit (31-32) identifies and filters the transmitted copies of the manipulated variable (11) according to the sequence number, - for the transmission of the measured variable and / or the state variable for the respective acquisition time, using the same sequence number as used for the transmission of the determined manipulated variable for the respective process cycle following the respective acquisition time of the measured variable and / or the state variable, - Based on the quality of service requirements, resources for transmitting the data flow are reserved in the communication device forwarding the data flow with sufficient availability, wherein the resources include available transmission time windows, bandwidth, guaranteed maximum delay, number of queues, queue buffers and / or address buffers in switches or bridges.

2. The method according to claim 1, wherein: The data stream comprising the periodically acquired measured variables and / or the state variables (12) is published by the corresponding data source and / or sensor (310) by means of a data stream announcement and is transmitted to a multicast address which is assigned to sequence control components subscribing to the corresponding data stream.

3. The method according to any one of claims 1 and 2, wherein: The communication devices (201-202) forwarding the data streams are connected to one another via a time-sensitive network, in particular according to IEEE 802.3, IEEE 802.1Q, IEEE 802.1AB, IEEE 802.1AS, IEEE 802.1BA and / or IEEE 802.1CB.

4. The method according to claim 3, wherein: The forwarding of the data flow is controlled, in particular according to IEEE 802.1Q, by means of frame preemption, in particular according to IEEE 802.1Q, by means of a time-aware shaper, in particular according to IEEE 802.1Q, by means of a credit-based shaper, by means of a burst limiting shaper, a creeping shaper and / or a priority-based shaper.

5. The method according to claim 1 or 2, wherein: The sequence control component is a software container, a Java bytecode, or an application running on an operating system, and wherein the sequence control environment is a container runtime environment, a Java virtual machine, or an operating system without real-time extensions.

6. The method according to claim 1 or 2, wherein: The mutually redundant sequence control components transmit the manipulated variables via decentralized paths to the actuators and / or the control unit.

7. The method according to claim 1 or 2, wherein: The manipulated variables are each transmitted to mutually redundant control units.

8. The method according to claim 1 or 2, wherein: The mutually redundant sequence control components (113, 123, 133) each signal, by means of a confirmation message (10) sent to the other redundant sequence control components, that the measured variable and / or the state variable is correctly present for the respective acquisition time.

9. The method according to claim 1 or 2, wherein: If the measured variable and / or the state variable is present in a delayed and / or erroneous manner in the majority of the mutually redundant sequence control components, an error signal is emitted and / or the last determined manipulated variable is transmitted again.

10. The method according to claim 9, wherein: If the sequence control component does not receive the measured variable and / or the state variable within a permissible delay of the corresponding acquisition time, the measured variable and / or the state variable occurs in a delayed manner.

11. A system for providing a time-critical control application, the system comprising - a plurality of server devices (101-103), - a plurality of sequence control environments (112, 122, 132) formed by means of the server devices (101-103), - a plurality of sequence control components (113, 123, 133) for providing said control application, wherein: The sequence control components can be loaded into the sequence control environment (112, 122, 132) formed by the server devices (101-103) and executed in the sequence control environment. wherein the control application is configured and designed to periodically determine a manipulated variable (11) for a process to be controlled or regulated, using periodically acquired measured variables and / or state variables (12), wherein the sequence control components are arranged and designed to be executed in parallel with one another as mutually redundant sequence control components, which in each case subscribe to a data stream containing the periodically acquired measured variables and / or the state variables (12) and transmit the determined manipulated variables to the actuators and / or control units using the data stream, wherein the system is configured and designed to specify quality of service requirements for the transmission of the data stream and to transmit the measured variables and / or the state variables together with the sequence numbers assigned to the respective acquisition times to the mutually redundant sequence control components, wherein the sequence control component is arranged and designed to transmit the determined manipulated variable together with a sequence number assigned to the respective process cycle to the actuator and / or the control unit, wherein the actuator (320) and / or the control unit (31-32) is configured and designed to identify and filter the transmitted copies of the manipulated variable (11) according to the sequence number, wherein the system is further configured and designed to use, for the transmission of the measured variables and / or the state variables for the respective acquisition time, the same sequence number as used for the transmission of the determined manipulated variables for the respective process cycle following the respective acquisition time of the measured variables and / or the state variables, -Wherein, the system is also configured and designed to reserve resources for transmitting the data flow in the communication device forwarding the data flow, based on the quality of service requirements and with sufficient availability, wherein the resources include available transmission time windows, bandwidth, guaranteed maximum delay, number of queues, queue buffers and / or address buffers in switches or bridges.

Images