Safety control for process control system

Abstract

A process control system (10) comprising an automation device (14), an automation function environment (20) comprising a process control function (22) using control signals in a control signal path (48) over a wireless network (50), a first hardware distribution unit (24), and hardware (28, 30, 32, 34) for performing functions of the automation function environment (20), and controlling the automation device (14) using the hardware (28) allocated by the first hardware allocation unit (24) in the automation function environment (20). At least one safety actuator (36, 51) and at least one safety sensor (42, 54) are placed together in the automation function environment (20) and / or in the control signal path environment (49), and a primary hardware entity (59; the security device (30) acquires security data regarding the security of the corresponding environment (20, 49) from the security sensor (42, 54), determines the security of the corresponding environment (20, 49) based on the security data, and performs a security activity using the at least one security actuator (36, 51) if the security is insufficient.

Description

Technical Field

[0001] The present disclosure relates to process control systems and methods for investigating security in process control systems. Background Art

[0002] With the introduction of cloud computing and edge computing, process control functions can be placed in the cloud or edge nodes. The process control functions can then communicate with automation equipment, where process control is performed over wireless networks. As a result, specific-purpose industrial controllers, such as programmable logic controllers (PLCs), can be replaced by process control functions on the edge or cloud.

[0003] An example of this can be seen in US2013 / 0211559, which discloses the use of cloud services in the form of control applications that generate and deliver control instructions to industrial equipment in an industrial facility based on analysis of near real-time system data.

[0004] Industrial computers (IPCs) or programmable automation controllers (PACs) can increase deployment flexibility and reduce end-user capital expenditure headcount. In addition, these advantages can be further expanded by combining edge / cloud computing with low-latency, high-reliability wireless networks such as 5G or WiFi 6 and their alternatives to replace wired networks. However, all these benefits must be achieved without compromising functional safety.

[0005] Therefore, there is a need to provide security controls with a sufficient degree of security for process control systems that are moved to the edge or cloud. Summary of the invention

[0006] Therefore, it is an object of the present invention to provide safety control as well as process control with sufficient functional safety when process control is performed from an automation functional environment via a wireless network.

[0007] According to a first aspect, there is provided a process control system comprising:

[0008] Automation equipment;

[0009] An automation function environment, comprising a process control function, a first hardware allocation unit, and hardware for the function of the automation function environment, wherein the process control function uses a control signal sent in a control signal path through a wireless network and adopts hardware in the automation function environment allocated to the process control function by the first hardware allocation unit to control an automation device; a group of safety field devices, comprising at least one safety actuator and at least one safety sensor, wherein the at least one safety actuator and the at least one safety sensor are placed together in the automation function environment and / or in a control signal path environment in the wireless network; and

[0010] Primary hardware entity, realizing security control functions,

[0011] The safety control function is configured to acquire safety data about the safety of the corresponding environment from at least one safety sensor, determine the safety of the corresponding environment based on the acquired safety data, and use at least one safety actuator to perform a safety activity if the safety of the corresponding environment is found to be insufficient.

[0012] According to a second aspect, there is provided a method for investigating security in a process control system, the process control system comprising an automation function environment in contact with automation equipment via a wireless network, wherein a process control function in the automation function environment uses a control signal transmitted in a control signal path via the wireless network and adopts hardware in the automation function environment allocated to the process control function by a first hardware allocation unit to control the automation equipment; and

[0013] A set of safety field devices, including at least one safety actuator and at least one safety sensor, the at least one safety actuator and the at least one safety sensor being placed together in an automation function environment and / or in a control signal path environment in a wireless network;

[0014] The method includes:

[0015] acquiring security data regarding security of a corresponding environment from at least one security sensor; determining security of the corresponding environment based on the acquired security data;

[0016] In the event that the safety of the corresponding environment is found to be insufficient, a safety activity is performed using at least one safety actuator.

[0017] Controlling the signal path environment may include controlling the base stations through which the signal path passes.

[0018] The security data may include data regarding abnormal consumption of process energy and / or storage resources, data regarding detected abnormally elevated temperature levels or temperature changes, data regarding detected fire or smoke in the corresponding environment, data regarding physical intrusion and / or damage to the corresponding environment, and / or data regarding virtual intrusion detected by a firewall of the corresponding environment.

[0019] Safety activities performed in an environment where a safety actuator is placed may include stopping or restarting hardware or software in the environment, sending alarm messages to maintenance personnel, and / or activating redundant / backup hardware and / or software.

[0020] The at least one safety sensor may include a first safety sensor in the automation functional environment, and the at least one safety actuator may include a first safety actuator in the automation functional environment.

[0021] In this case, obtaining safety data about the safety of the corresponding environment may include obtaining safety data from a first safety sensor, determining the safety of the corresponding environment may include determining the safety of the automation function environment, and performing safety activities using a safety actuator if the safety of the corresponding environment is found to be insufficient includes performing safety activities using the first safety actuator if the safety of the automation function environment is found to be insufficient.

[0022] A first secondary hardware entity may be provided in the automation functional environment for a sensor processing function of the first safety sensor. Furthermore, it is possible that the first secondary hardware entity is allocated to the sensor processing function by the first hardware allocation unit. A second secondary hardware entity may likewise be provided in the automation functional environment for an actuator function of the first safety actuator. In this case, it is also possible that the second secondary hardware entity is allocated to the actuator function by the first hardware allocation unit.

[0023] The at least one safety sensor may further include a second safety sensor placed in the control signal path environment, and in this case, the at least one safety actuator may include a second safety actuator placed together with the second safety sensor in the control signal path environment.

[0024] In this case, acquiring safety data regarding the safety of the corresponding environment may include acquiring safety data from a second safety sensor, determining the safety of the corresponding environment may include determining the safety of the control signal path environment, and performing safety activities using a safety actuator if the safety of the corresponding environment is found to be insufficient includes performing safety activities using a second safety actuator if the safety of the environment is found to be insufficient.

[0025] The first third-level hardware entity may be provided in the control signal path environment for a sensor processing function of the second safety sensor. Furthermore, it is possible that the first third-level hardware entity is allocated to the sensor processing function by a second hardware allocation unit of the wireless network. The second third-level hardware entity may additionally be provided in the control signal path environment for an actuator function of the second safety actuator. In this case, it is also possible that the second third-level hardware entity is allocated to the sensor processing function by the second hardware allocation unit.

[0026] Safety control functions can be operated simultaneously with process control functions.

[0027] The first hardware allocation unit may be implemented using hardware in an automated functional environment.

[0028] The process control system may include a wired safety network. In addition, it is possible that the hardware implementing the safety control function is connected to the wired safety network.

[0029] The automation device can utilize a wired network interface to a wired security network. It can also utilize a first interface to a wireless network.

[0030] The process control system may include a second interface to the wireless network for the wired safety network, which second interface may be a first type as an interface to a backbone network of the wireless network, or a second type as an air interface to the wireless network, such as an air interface to a base station of the wireless network.

[0031] The process control system may further comprise a safety controller comprising a primary hardware entity implementing the safety function. Alternatively, the primary hardware entity may be provided in an automation function environment. In this case, furthermore, it is possible that the primary hardware entity is allocated to the safety function by the first hardware allocation unit.

[0032] The automation function environment may be an automation function environment based on a virtual cloud, wherein the process control function is a virtual controller, the safety control function may also be a virtual controller, the hardware allocation unit implements the virtualization layer, and the first automation device may be a real automation device. Alternatively, the automation function environment, the process control function and possibly also the safety control function may be provided in an edge node that communicates with the automation device.

[0033] The wireless network may be part of a process control system or external to the process control system.

[0034] At least one other safety field device in the safety field device group may be a wired safety field device connected to the wired safety network.Alternatively or additionally, at least one other safety field device in the safety field device group may be a wireless safety field device.

[0035] When the primary hardware entity is provided in an automation function environment, it is furthermore possible that at least one of the further safety field devices is a safety actuator which is configured to bring the automation device into a safe state in the event of a loss of contact with the automation function environment.

[0036] In case the safety of the corresponding environment is found to be insufficient, the safety control function can additionally perform safety activities for the automation device using other safety actuators of at least one other safety field device, which safety activities may include placing the automation device in a safe state.

[0037] Automation equipment can be any type of device used to control a system, such as a robot, relay, valve, power switch, conveyor, motor, drive, I / O module, sensor, or actuator.

[0038] In general, all terms used in the claims should be interpreted according to their ordinary meaning in the technical field, unless otherwise explicitly defined in this application. All references to "a / an / the element, device, component, method, step, etc." should be publicly interpreted as referring to at least one instance of the element, device, component, means, step, etc., unless otherwise explicitly stated. Unless explicitly stated, the steps of any method disclosed in this protocol do not need to be performed in the exact order disclosed. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] Various aspects and embodiments will now be described by way of example with reference to the accompanying drawings, in which:

[0040] Figure 1 is a diagram schematically illustrating a first embodiment of a process control system including an automation function environment, an automation device environment, and a safety controller, wherein the automation function environment communicates with the automation device environment via a wireless network,

[0041] Figure 2 is a flow chart schematically illustrating a plurality of method steps for investigating safety in a process control system and performed by a safety control function of a safety controller,

[0042] Figure 3 is a diagram schematically showing a second embodiment of a process control system including an automation function environment, an automation device environment, a safety controller and a wireless network,

[0043] Figure 4 is a diagram schematically showing a third embodiment of a process control system including an automation function environment, an automation device environment, a safety controller and a wireless network, and

[0044] Figure 5 is a diagram schematically showing a fourth embodiment of a process control system including a wireless network, an automation device environment, and an automation function environment having a safety control function. DETAILED DESCRIPTION

[0045] Various aspects of the present disclosure will now be described more fully hereinafter with reference to the accompanying drawings, in which certain embodiments are shown.

[0046] However, these aspects may be embodied in many different forms and should not be construed as limiting; rather, these embodiments are provided by way of example so that this disclosure will be thorough and complete, and will fully convey the scope of all aspects of the invention to those skilled in the art.

[0047] Figure 1is a schematic diagram of a first embodiment of a process control system PCS10, which includes an automation device environment ADE 12, an automation function environment AFE 20, and a safety control system including a safety controller SAC 58. In addition, the automation function environment 20 is connected to the automation device environment 12 via a wireless network WN 50, which can be implemented by an external wireless network (such as a public wireless network) or an internal wireless network (i.e., a wireless network that is part of the process control system 10). The automation function environment 20 can be connected to the backbone network of the wireless network 50, or can be wirelessly connected to the wireless network 50. In addition, the wireless network 50 can be a deterministic network, that is, a network that limits delay or waiting time through the network to ensure that the message is transmitted within a set time period.

[0048] The automation function environment 20 includes a computing infrastructure CI 26 and a first hardware allocation unit HAU 24. As an example, the automation function environment 20 may be a cloud-based automation function environment including a virtual controller, while the automation device environment 12 is a real automation environment including an automation device 14 as a real automation device. In this case, the computing infrastructure CI 26 may be a cloud computing infrastructure, and the first hardware allocation unit HAU 24 may be a virtualization layer for virtualizing cloud functions. The computing infrastructure 26 includes a first hardware resource HWR1 28, a second hardware resource HWR2 30, a third hardware resource HWR3 32, and a fourth hardware resource HWR4 34. The hardware resources 28, 30, 32, 34 may include processing and storage resources, such as processing blades and storage blades. It may also contain more or fewer hardware resources. The automation function environment 20 also includes a process control function PCF 22. The process control function 22 may be implemented as a virtual controller implemented using the computing infrastructure 26 based on the mapping of the first hardware allocation unit 24 to the hardware of the computing infrastructure 26. The process control function 22 may be assigned to any of the hardware resources 28, 30, 32, 34. As an example, the process control function 22 may be assigned to the first hardware resource 28.

[0049] Alternatively, the automation function environment 20 and the process control function 22 may be provided in an edge node that communicates with the automation device environment 12 .

[0050] The process control function 22 may control one or more automation devices in the automation device environment 12. For example, the process control function 22 controls the automation devices 14 in the automation device environment 12 using control signals sent in the control signal path CSP 48 through the wireless network 50.

[0051] To enable the above control, the automation device environment 12 also includes a first wireless network interface WLNI1 16 for wireless communication with the wireless network 50, for example, for wireless communication with a base station of the wireless network 50. In the first embodiment of the process control system 10, the automation device environment 12 also includes a first wired network interface WNI1 18, which is a first interface to the wired safety network WSN 62 of the safety control system. The automation device 14 can communicate with the safety controller 58 using the first wired network interface 18. The first wireless network interface 16 and the first wired network interface 18 can be common interfaces for all automation devices in the automation device environment, or they can be dedicated to the automation device 14. They can even be included in the automation device 14.

[0052] The process control system 10 includes a group of safety field devices that are also part of the safety control system. The group of safety field devices includes safety field devices in the automation device environment 20 and / or the wireless network 50, and may also include a plurality of wired safety field devices and a plurality of wireless safety field devices.

[0053] In the first embodiment of the process control system 10, the safety controller 58 is implemented by a dedicated primary hardware entity PHW 59 that implements the safety control function SAF 60. In the first embodiment of the process control system, the safety controller 58 is connected to the wired safety network 62 and a plurality of wired safety field devices via the wired safety network 62, wherein the wired safety field devices include a first wired safety actuator WA1 70 and a first wired safety sensor WS1 72. The wired safety network 62 also has a first type of second wireless network interface WLNI2A 64A, which is a second interface to the wireless network 50. In this first embodiment of the process control system, the first type of second wireless network interface 64A is an interface to the backbone network of the wireless network 50.

[0054] The first type of second wireless network interface 64A can be implemented in the following ways: 1) if the wireless network 50 is based on 3GPP 4G, 5G or higher, it is implemented by the user plane function (UPF) of the base station; or 2) if the wireless network 50 is based on WiFi4, WiFi5, WiFi6 or higher, it is implemented through an Ethernet interface. As an alternative, the wired security network 62 can be connected to the wireless network 50 through a second type of interface, which can be implemented in the following ways: 1) if the wireless network 50 is based on 3GPP 4G, 5G or higher, it is implemented by a user device; or 2) if the wireless network 50 is based on WiFi4, WiFi5, WiFi6 or higher, it is implemented by a station.

[0055] The plurality of wireless safety field devices include a first wireless safety actuator WLA1 66 and a first wireless safety sensor WLS1 68. Although the wireless safety field devices 66, 68 and the wired safety field devices 70, 72 are shown as being located outside of the automation device environment 12, it should be appreciated that one or more and possibly all of these safety field devices may also be located within the automation device environment 12 in physical proximity to the automation device 14.

[0056] The automation device environment 12 can be directly connected to the wired safety network 62 through the first wired network interface 18, or it can be indirectly connected to the wired safety network 62 through the wireless network 50 using the first wireless network interface 16. In the former case, the automation device environment 12 uses the first wireless network interface 16 for process control traffic and the first wired network interface 18 for safety control traffic. In the latter case, the automation device environment 12 uses the first wireless network interface 16 for both safety and process control traffic.

[0057] from Figure 1 As can be seen in FIG. 1 , the automation functional environment 20 comprises a first safety sensor S1 42 and a first safety actuator A1 36, which are therefore placed together in the automation functional environment 20. The first safety sensor 42 is intended to be used together with the first safety actuator 36. The first safety sensor 42 comprises a first secondary hardware entity SHWS1 46 and a first sensor function SF1 47 implemented using the first secondary hardware entity 46. The first sensor function 47 provides a sensor function for the first safety sensor 42. The first safety sensor 42 may also optionally comprise a first detector D1 44, such as a temperature and / or fire detector, from which the first sensor function 47 may collect sensor data, such as data of physical properties measured in the automation functional environment 20. In this case, the first secondary hardware entity 46 dedicated to the first sensor function 47 may be provided in the computing infrastructure 26, while the first detector 44 may be provided outside thereof. The first safety actuator 36 may be provided in a similar manner by a second secondary hardware entity SHWA1 38 for a first actuator function AF1 40, which provides the actuator functionality for the first safety actuator 36. It should be appreciated that, as an alternative to using dedicated hardware, the first actuator function 40 and the first sensor function 47 may be allocated to hardware resources by the first hardware allocation unit 24.

[0058] In addition, the wireless network also includes a safety field device, which includes a second safety sensor S2 54 and a second safety actuator A2 51, wherein the second safety sensor 54 is intended to be used with the second safety actuator 51. The second safety sensor 54 and the second safety actuator 51 can be placed together in an environment 49 of the control signal path 48 in the wireless network, such as a base station through which the control signal path 48 passes. The environment 49 will be referred to as the control signal path environment CSPE hereinafter. The second safety sensor 54 can include a first third-level hardware entity THWS2 56 and a second sensor function SF2 57 implemented using the first third-level hardware entity 56 and an optional second detector D2 55 in a similar manner, wherein the second sensor function 57 provides a sensor function for the second safety sensor 54. The second safety actuator 51 can be provided in a similar manner by a second third-level hardware entity THWA2 52, in which a second actuator function AF2 53 is implemented, wherein the second actuator function 53 provides an actuator function for the second safety actuator 51. The first tertiary hardware entity 56 and the second tertiary hardware entity 52 for the second safety sensor 54 and the second safety actuator 51 may be provided as dedicated processors and memories in a device of the wireless network 50, such as a base station of the wireless network. Alternatively, the second actuator function 53 and the second sensor function 57 may be allocated by a second hardware allocation unit of the wireless network 50 to a hardware resource, which may be located in the base station through which the control signal path 48 passes between the automation device environment 12 and the automation function environment 20.

[0059] It should be appreciated that it is possible for the process control system 10 to include the first safety sensor 42 and the first safety actuator 36, but not the second safety sensor 54 and the second safety actuator 51. Alternatively, the process control system 10 may include the second safety sensor 54 and the second safety actuator 51, but not the first safety sensor 42 and the first safety actuator 36.

[0060] The first safety sensor 42 and the second safety sensor 54 can monitor the corresponding environment for unexpected damage, destruction or abnormality, such as abnormal consumption of CPU / memory / storage, abnormal temperature rise detected, environmental fire or smoke, physical intrusion / destruction of the environment, virtual intrusion detected by the firewall, etc. The first safety actuator 36 and the second safety actuator 51 can respond to commands from the safety control function, such as stopping or restarting the corresponding hardware and / or software modules, sending alarm messages to maintenance personnel, activating redundant / backup hardware and / or software modules, etc. Wherein, in the case of the automation function environment, the software module is a software module that implements the process control function, and in the case of the control signal path environment, the software module is a software module that includes software involved in routing signals through the wireless network.

[0061] For example, the communication protocol used between the safety controller 58 and the safety sensors and actuators may follow one of the standards defined in IEC61784-3, including but not limited to PROFIsafe, openSAFETY, CIP Safety, FSoE, CC-Link IE Safety, OPC UA Safety, etc.

[0062] In operation, the process control function 22 is assigned hardware, such as the first hardware resource 28. Thus, the process control function 22 runs in a virtual machine on the assigned hardware 28, for example as a virtual safety controller, and then controls the automation device 14 in the process control loop PCL via control signals in a control signal path 48 of the wireless network 50. This may involve the process control function 22 receiving control signals in the form of sensor measurements from sensors in or at the automation device environment 12 via the control signal path 48, determining control commands for the automation device 14, and sending the control commands in the control signal path 48 as control signals for controlling the automation device 14. In this control, these control signals may additionally pass through a control signal path environment 49, which may include a node of the wireless network 50, such as a base station, in which a second safety actuator 51 and a second safety sensor 54 are provided.

[0063] In the automation equipment environment 12, the traditional hardware controller on site is deleted. Instead, the control logic is executed by the automation function (e.g., soft controller) hosted by the processing and storage hardware in the computing infrastructure 26, which can be implemented by ABB Ability, GE Predix, Siemens MindSphere, Microsoft Azure, Amazon Web Services, Alibaba Cloud, Huawei Mobile Cloud, etc. The control logic of the automation function can be programmed in a PLC-specific language (such as IEC61131-3 and IEC61499) or a general programming language (such as C / C++). The computing infrastructure 26 can also be shared with other applications. Therefore, the process control function 22 is not executed by any hardware controller close to the automation equipment 14, but by a soft controller implemented by the hardware resources 28 allocated by the first hardware allocation unit 24. Therefore, the process control function 22 can be hardware agnostic, that is, it can be implemented in a virtualized computing infrastructure 26 by the first hardware allocation unit 24, such as a virtual machine using a Docker container and / or Linux, Windows, VxWorks, etc.

[0064] While process control is performed by the process control function, the safety controller 58 performs safety control in the safety control loop SCL.

[0065] In this first embodiment, the safety control loop is controlled by a field-specific hardware safety controller 58, which includes a primary hardware entity 59 with a safety control function 60. The safety controller 58 communicates with wired safety field devices 70 and 72 using a wired safety network 62. However, it can also communicate with wireless safety field devices 66, 68 through a wireless network 50, where the wireless network 50 can be qualified to design a black channel for the safety communication layer according to IEC61508. The two control loops merge at the automation device 14 in the automation device environment 12, which can be any type of device used in a process control system, such as a robot, relay, valve, power switch, conveyor, motor, drive, I / O module and any other sensor or actuator.

[0066] Safety control involves the safety controller 58 receiving sensor measurements from safety sensors (such as the first wireless and wired safety sensors 68 and 72), determining whether there is a fault and / or danger in the automation device 14 or the automation device environment 12 based on these sensor measurements, and if safety is considered to be compromised, performing safety activities, wherein the safety activities may involve placing the automation device in a safe state. Such conventional safety control is based on monitoring the automation device environment. However, since control is performed from the automation function environment 20 via the control signal path 48 through the wireless network 50, the automation function environment and the control signal path environment 49 may also cause safety issues.

[0067] Various aspects of the present disclosure are directed to addressing this problem.

[0068] Compared with the traditional closed dedicated computing infrastructure and wired or wireless network, the automation function environment 20 and the wireless network 50 have higher uncertainty due to their open and shared nature. In order to check the security integrity of the automation function environment 20 and the wireless network 50, a first security sensor 42 and a first security actuator 36 are added in the computing infrastructure 26, and / or a second security sensor 54 and a second security actuator 51 are added in the control signal path environment 49.

[0069] Therefore, the safety logic executed by the safety control function 60 can not only periodically scan the wireless safety sensor 68 and / or the wired safety sensor 72 and the wireless safety actuator 66 and / or the wired safety actuator 70, but also periodically scan the first safety sensor 42 and the first safety actuator 36 in the automation function environment and / or the second safety sensor 54 and the second safety actuator 51 in the control signal path environment 49.

[0070] Now refer to Figure 2 Describe how to use first and second safety sensors and first and second safety actuators to increase safety, Figure 2 Several steps of a method of security investigation in a process control system performed by the security control function 60 are shown.

[0071] The security investigation may include executing two parallel security control loops, wherein a first security control loop is executed for the automation function environment 20 and a second security control loop is executed for the control signal path environment 49. The first security sensor 42 may continuously provide security data to the security control function 60, such as a measured physical property such as temperature or smoke or fire detected by the first detector 44. The security data may also include security data about the operation of the hardware and software operating the process control function 22. The security data may also include data about physical intrusion and / or damage to the automation function environment 20 and / or virtual intrusion detected by the firewall of the automation function environment 20. Therefore, the security control function 60 obtains security data related to the security of the automation function environment 20 from the first security sensor 42. The security control function 60 then determines whether the corresponding automation function environment 20 is secure, S210A. The security of the automation function environment is thereby determined based on the acquired security data. This may be achieved by comparing the sensor data with a corresponding threshold value, and if the threshold value is reached or exceeded, the corresponding environment is deemed unsafe. If the automation function environment 20 is deemed to be unsafe, ie if the safety is deemed to be insufficient, the safety control function 60 then performs the safety function using the first safety actuator 36 , S220A.

[0072] In the second safety control loop, the second safety sensor 54 can continuously provide safety data, such as measured physical properties, such as temperature, to the safety control function 60. Here, the safety data can also include data about temperature levels or temperature changes detected in the control signal path environment 49. The safety data can also or alternatively include data about smoke or fire detected in the environment 49, data about physical intrusion and / or environmental damage, and / or data about virtual intrusion detected by the environmental firewall. The safety data can also include safety data about the operation of the wireless network 50, such as the operation of devices in the wireless network that transmit control signals between the automation function environment 20 and the automation device 14 in the control signal path 48, such as devices in the base station through which the control signal passes. The safety data about the operation of the device can more specifically include data about abnormal consumption of processing permissions and / or storage resources. Therefore, the safety control function 60 obtains safety data from the second safety sensor 54, S200B, which safety data relates to the safety of the environment 49 of at least a part of the control signal path 48. Then, the safety control function determines whether the corresponding control signal path environment 49 is safe, S210B. Therefore, it determines the safety of the control signal path environment 49 based on the acquired safety data. Here, the determination can also be made by comparing the sensor data with a corresponding threshold value, if the threshold value is reached or exceeded, the environment is considered unsafe. If the environment 49 is considered unsafe, that is, the safety is considered insufficient, the safety control function 60 then uses the second safety actuator 51 to perform the safety function, S220B. As long as neither environment 20, 49 is considered unsafe, this operation can be repeated continuously.

[0073] If there is an abnormal consumption of process energy and / or storage resources, the execution of the safety activity may involve stopping or restarting the hardware or software in the automation function environment 20 that implements the process control function and / or the hardware or software in the control signal path environment 49. Abnormal consumption of process energy and / or storage resources may also result in the activation of redundant / backup hardware and / or software. If the safety data involves excessively high temperatures or significantly elevated temperatures, the safety activity may involve increasing ventilation or cooling the environment. Alternatively, the safety activity may involve sending an alarm message to maintenance personnel. In addition, the detection of smoke, fire, physical intrusion and / or virtual intrusion may result in the generation of an alarm message.

[0074] In the event that the safety of the corresponding environment is found to be insufficient, the safety control function may also use other safety actuators to perform safety activities for the automation device 14. The latter safety activities may include placing the automation device 14 in a safe state, which may be achieved by the wireless safety actuator 66 or the wired safety actuator 70.

[0075] It can be seen that, through the implementation of the safety control system, even if the process control is transferred to the automation function environment 20 , the functional safety is good.

[0076] It can also be seen that this good functional safety is obtained while the safety control system is based on traditional computing and communication technologies. Therefore, when the process control system is updated by placing the process control in the automation function environment of controlling the automation equipment through a wireless network, the traditional safety control system can be maintained.

[0077] Incorporating safety sensors and actuators in the automation function environment and control signal path environment into the safety control loop ensures the safety integrity of these open and shared automation function environments and wireless networks in safety-critical industrial process control systems.

[0078] When the wired safety network 62 is connected to the wireless network 50 through the first type of second wireless network interface 64A, and the automation equipment environment has two independent interfaces 16 and 18 for safety and process control traffic, respectively, it can be seen that the safety control network formed by the wireless network 50 and the wired safety network 62 is a hybrid (wired + single-hop wireless), which emphasizes the flexibility and reusability of existing safety field devices. If the second type of second wireless network interface is used, the safety control network is a hybrid network (wired + two-hop wireless).

[0079] If the wired safety network 62 is connected to the backbone of the wireless network 50, the communication with the second safety sensor 54 and the second safety actuator 51 is fast. The communication speed with the first safety sensor 42 and the first safety actuator 36 can also be fast, and the speed can be even faster if the automation function environment 20 is also connected to the backbone network.

[0080] The first embodiment may have a variety of variations. For example, it should be appreciated that it is possible to execute only one safety control loop. Thus, it is possible to execute only the first safety control loop or only the second safety control loop.

[0081] Figure 3 A second embodiment of the process control system 10 is schematically shown. In this variant, there are no wired safety field devices, only wireless safety field devices 66, 68. Therefore, the automation device environment 12 also lacks a first wired network interface. In addition, in this case, the wired safety network 62 is connected to the wireless network 50 via a second wireless network interface WLNI2B 64B of a second type, which in this case is an air interface to the wireless network 50. The air interface can be implemented by a radio circuit and an antenna that communicates wirelessly with a base station of the wireless network.

[0082] In addition, the automation device environment 12 has a single interface for safety and process control traffic in the form of a first wireless network interface 16. In this embodiment, the network for safety control is almost entirely wireless, which can minimize field wiring.

[0083] Figure 4 A third embodiment of the process control system 10 is schematically shown. In this embodiment, there are no wireless safety field devices, only wired safety field devices 70 and 72. Likewise, the wired safety network 62 is connected to the wireless network 50 using a second wireless network interface 64A of the first type, and the automation device environment 12 includes a first wireless network interface 16 and a first wired network interface 18. In this embodiment, the network for safety control is almost completely wired, which can maximize the reliability of the safety control network and minimize its delay.

[0084] In the automated functional environment, the overall architecture that combines traditional safety control with process control ensures functional safety while enjoying the advantages of edge and cloud computing combined with wireless communications in industrial process control systems.

[0085] In addition, by implementing a safety control system, established functional safety technologies and practices can be reused, such as safety controller software and hardware, safety logic design methods, safety sensors / actuators, and safety communication protocols. At the same time, the capital expenditure barriers and technical barriers for customers to establish and operate automation and safety systems are reduced. In addition, new services (such as data analysis) can be introduced / integrated.

[0086] In the embodiments of the process control system described thus far, the safety control function 60 is provided in the physical safety controller 58 near the automation device 14. However, it should be appreciated that the safety control function 60 can also be placed in the automation function environment 20. An example of this is shown in FIG. Figure 5 .

[0087] It can be seen here that the safety control function 60 is placed in the automation function environment 20. In addition, the first hardware allocation unit 24 also allocates hardware resources to it. Therefore, the allocated hardware resources are also the main hardware entities for running the safety control function. Therefore, the safety control function 60 is also implemented on a separate virtual machine, for example as a virtual safety controller. It can also be seen that the first actuator function 40 and the first sensor function 47 are provided as functions running in the virtual machine allocated to the hardware resources by the first hardware allocation unit 24. In this case, they are also implemented on a separate virtual machine. For example, the first hardware resource 28 is allocated to the process control function 22, the second hardware resource 30 is allocated to the safety control function 60, the third hardware resource 32 is allocated to the first actuator function 40, and the fourth hardware resource 34 is allocated to the first sensor function 47. Therefore, the second hardware resource 30 forms the main hardware entity provided for the safety control function 60, the fourth hardware resource 34 forms the first auxiliary hardware entity provided for the first sensor function 47, and the third hardware resource 32 forms the second auxiliary hardware entity provided for the first actuator function 36. Alternatively, the first sensor function and the first actuator function may be combined with the safety control function and executed on the first hardware resource 28 .

[0088] To meet the stringent reliability requirements of security applications, dedicated security-certified hypervisors, such as GOSYS’s PikeOS, can be deployed on top of infrastructure hardware. Security logic is executed in a virtual security controller deployed on top of the virtual machine.

[0089] It should be appreciated here that, as an alternative, the safety control function, the first actuator function and the first sensor function may be provided using dedicated hardware.

[0090] In the wireless network 50, the second safety actuator 51 and the second safety sensor 54 can be implemented as a second actuator function in dedicated hardware and a second sensor function in dedicated hardware and communicate with the detector. These functions may also be distributed to hardware by a second hardware distribution unit in the wireless network, such as hardware in a base station of the wireless network in the same manner as in the automation function environment.

[0091] For example, the communication protocol between the virtual safety controller and all safety sensors and actuators may follow one of the standards defined in IEC61784-3, including but not limited to PROFIsafe, openSAFETY, CIP Safety, FSoE, CC-Link IE Safety, OPC UA Safety, etc.

[0092] like Figure 3As shown, there are no wired safety field devices. There is also no wired safety network, only a set of wireless safety field devices 66, 68. Therefore, the automation device environment 12 does not have any first wired network interface. It only has a first wireless network interface 16. The wireless safety field devices including the wireless safety sensor 68 and the wireless safety actuator 66 are connected to and controlled by the safety control function 60 via the wireless network 50, which qualifies as a black channel that specifies the safety communication layer according to IEC61508.

[0093] As can be seen from the last example, the hardware safety controller has been eliminated, which is essential to fully realize the promised benefits of control as a service provided by cloud computing. The capital expenditure barrier and technical barriers for customers to establish and operate automation and safety systems are also further reduced. At the same time, established functional safety technologies and practices, such as safety controller software, safety logic design methods, safety sensors / actuators, and safety communication protocols, can be reused to a large extent.

[0094] Since there is no on-site safety controller, the wireless safety actuator 66 may be triggered to the safe state if it does not receive an appropriate request and / or response from the safety control function 60 within a certain time (also referred to as a monitoring time), which means that some interruption or congestion has occurred in the computing infrastructure 26 and / or the wireless network 50. Therefore, if it cannot communicate with the safety control function 60, the wireless safety actuator 66 can put the automation device 14 into the safe state.

[0095] Aspects of the disclosure have been described above mainly with reference to a few embodiments and examples thereof. However, as readily appreciated by a person skilled in the art, other embodiments than the ones disclosed above are equally possible within the scope of the invention, as defined by the appended patent claims.

Claims

1. A process control system (10), comprising: Automation equipment (14); An automation function environment (20) comprising a process control function (22), a first hardware allocation unit (24) and hardware (28, 30, 32, 34) for the function of the automation function environment (20), wherein the process control function (22) uses a control signal transmitted in a control signal path (48) via a wireless network (50) and uses hardware (28) in the automation function environment (20) allocated to the process control function (22) by the first hardware allocation unit (24) to control the automation device (14); A set of safety field devices (36, 42, 51, 54, 66, 68, 70, 72), comprising at least one safety actuator (36, 51) and at least one safety sensor (42, 54), the at least one safety actuator and the at least one safety sensor being placed together in the automation function environment (20) and / or in a control signal path environment (49) in the wireless network (50); as well as A primary hardware entity (59; 30) implements a safety control function (60), the safety control function (60) being configured to acquire safety data about the safety of a corresponding environment (20, 49) from the at least one safety sensor (42, 54), determine the safety of the corresponding environment (20, 49) based on the acquired safety data, and, if the safety of the corresponding environment (20, 49) is found to be insufficient, use the at least one safety actuator (36, 51) to perform a safety activity.

2. The process control system (10) of claim 1, wherein the at least one safety sensor comprises a first safety sensor (42) in the automation functional environment (20), and the at least one safety actuator comprises a first safety actuator (36) in the automation functional environment (20).

3. The process control system (10) according to claim 2, wherein a first secondary hardware entity (46; 34) is provided in the automation functional environment (20) for a sensor processing function (47) of the first safety sensor (42).

4. The process control system (10) according to claim 2 or 3, wherein a second secondary hardware entity (38; 32) is provided in the automation function environment (20) for an actuator function (40) of the first safety actuator (36).

5. The process control system (10) of claim 4, wherein each secondary hardware entity (32, 34) is allocated by the first hardware allocation unit (24) to the sensor processing function (47) or the actuator function (40).

6. According to the process control system (10) described in any one of the preceding claims, the at least one safety sensor includes a second safety sensor (54), which is placed in the control signal path environment (49), and the at least one safety actuator includes a second safety actuator (51), which is placed in the control signal path environment (49) together with the second safety sensor (54).

7. The process control system (10) of claim 6, wherein a first tertiary hardware entity (56) is provided in the control signal path environment (49) for sensor processing functionality of the second safety sensor (54).

8. The process control system (10) according to claim 6 or 7, wherein a second tertiary hardware entity (52) is provided in the control signal path environment (49) for an actuator function of the second safety actuator (51).

9. The process control system (10) of any preceding claim, further comprising a wired safety network (62).

10. The process control system (10) of claim 9, wherein at least one other safety field device in the set of safety field devices (36, 42, 51, 54, 66, 68, 70, 72) is a wired safety field device (70, 72) connected to the wired safety network (62).

11. The process control system (10) of any one of the preceding claims, wherein at least one other safety field device in the set of safety field devices (36, 42, 51, 54, 66, 68, 70, 72) is a wireless safety field device (66, 68).

12. The process control system (10) according to any one of the preceding claims, further comprising a safety controller (58) comprising the primary hardware entity (59) implementing the safety function (60).

13. The process control system (10) according to any one of claims 1 to 11, wherein the primary hardware entity (30) is provided in the automation function environment (20).

14. The process control system (10) of claim 13, wherein the primary hardware entity (30) is assigned to the safety function (60) by the first hardware assignment unit (24).

15. A method for investigating security in a process control system (10), the process control system comprising An automation function environment (20) is connected to an automation device (14) via a wireless network (50), wherein a process control function (22) in the automation function environment (20) uses a control signal sent in a control signal path (48) via the wireless network (50) and adopts hardware (28) in the automation function environment (20) allocated to the process control function (22) by a first hardware allocation unit (24) to control the automation device (14); as well as A set of safety field devices (36, 42, 51, 54, 66, 68, 70, 72), comprising at least one safety actuator (36, 51) and at least one safety sensor (42, 54), the at least one safety actuator and the at least one safety sensor being placed together in the automation function environment (20) and / or in a control signal path environment (49) in the wireless network (50); The method comprises: - acquiring (S200A; S200B) safety data about the safety of the corresponding environment (20, 49) from the at least one safety sensor (42, 54); - determining (S210A; S210B) the security of the corresponding environment (20, 49) based on the acquired security data; and - in case the safety of the corresponding environment (20, 49) is found to be insufficient, performing (S220A; S220B) a safety activity using the at least one safety actuator (36, 51).

Images