Method for operating cycle-oriented control software

Abstract

The invention relates to a method for operating cycle-oriented control software, in order to check the operation of a cold-start mechanism in a virtual controller, it is proposed that a random number is generated at the start-up of a runtime environment, the random number is stored in a memory area and added to a security time each time a security time is further requested, a deviation of the time difference is calculated in the control software in the control unit at the beginning of a new cycle, and wherein the memory area is accessed by the control unit in each cycle and the random number is re-extracted from the secure time in the control unit before the calculation of the time difference, in the event of a restart of the runtime environment, the random number is re-extracted from the secure time. The restart can be diagnosed by exceeding the tolerance since the second time difference at this time has an offset derived from the safety time with the new random number of the current cycle and the safety time with the old random number of the previous cycle.

Description

Technical Field

[0001] The invention relates to a method for running cycle-oriented control software. Background Art

[0002] Common controllers today are based on a hardware platform, a specific electronic substructure, the Programmable Logic Controller (SPS). More recently, if we talk about virtual controllers or software controllers, the concept also requires hardware to be implemented, although the hardware can now be completely abstracted. This means that the implemented Soft-PLC no longer has to know which device it is running on.

[0003] As before, these devices can still be dedicated control devices, such as multifunctional control platforms or industrial PCs, or even edge computing platforms, which are always increasingly present in the control grid of machinery and facility operators, or even using cloud computing platforms. Crucially, the hardware is abstracted by containers or hypervisors. Then, the Soft-PLC is "deployed" by standard means or orchestrated by tools or - that is, the installation in software-based controllers is cancelled.

[0004] The invention is based on the field of safety-oriented control, in particular as software. Programmable logic controllers must be configured according to the requirements of the EN 61508 standard so that they meet functional safety. In safety-related systems, such as programmable logic controllers for critical processes that contain electrical, electronic or programmable electronic components and whose failures represent significant risks for people and the environment, safety-related systems must be configured to ensure a certain degree of safety. As examples for the need for increased safety, the following are listed: nuclear power plants, control technology for systems that are important in terms of safety, railway applications, telecommunications technology, signal technology and data processing systems, chemical processes, but also small facilities, such as punching machines for punching sheet metal parts.

[0005] In current fail-safe control systems (e.g. SIMATIC S7-1511F), it must be ensured that during the startup process after a grid disconnection / connection or a stop / operation transition, the system always starts with the initial values ​​and not with the current values ​​of the last safety program cycle (e.g. before grid disconnection) (hereinafter referred to as cold restart).

[0006] EP 2 284 771 B1 and EP 2 241 953 B1 describe that in each cycle of a fail-safe control system, a safety time is formed by two timers (a standard timer and a fail-safe timer or F-timer). This is achieved by forming the time difference between the two cycles (S-Diff and F-Diff) and then comparing the time difference with a preset tolerance. Summary of the invention

[0007] The invention relates to a method for running cycle-oriented control software for controlling a process, wherein the control software is executed in a runtime environment on a computer system, wherein, in order to ensure the system time of the computer system, an additional safety time independent of the system time is requested in each cycle, wherein a first time difference is formed from the system time of the current cycle and the system time of the previous cycle and a second time difference is formed from the safety time of the current cycle and the safety time of the previous cycle, and a comparison of the time difference with a preset tolerance is performed, and an error signal is generated if the deviation of the time difference exceeds the tolerance.

[0008] Therefore, the time elapsed between the current cycle and the last cycle is obtained by the time difference between the two timers.

[0009] The difference of the standard timer is obtained from SDIFF = S_TIM - S_TIM_ALT and

[0010] The difference of the F timer is obtained from FDIFF=F_TIM_ALT-F_TIM and is preferably operated by means of a down counter.

[0011] When using an incrementing counter, it is also possible to extract the old time from the new time.

[0012] It is then checked whether the determined difference lies within the permissible tolerance range.

[0013] In previous fail-safe control systems, the behavior of two timers in the “grid disconnected” state is known, since both timers are located on one device and are defined by the manufacturer of the fail-safe control system.

[0014] With the introduction of virtual software controllers (Soft-PLC), the second time is obtained from an external time source, which in turn has undefined behavior in "grid disconnection".

[0015] It is an object of the invention to ensure safety also by means of a virtual controller.

[0016] This object is achieved in that a random number is generated when the runtime environment is started, the random number is stored in a memory area and is added to the secure time at each further request for the secure time, wherein the deviation between the time differences is calculated when a new cycle is started in the control software in the control component, wherein the memory area is accessed by the control component in each cycle and the random number is again extracted from the secure time in the control component before the time difference is calculated, and in the event of a restart of the runtime environment, the restart can be diagnosed by a tolerance violation because the second time difference now has an offset, which is derived from the secure time with the new random number of the current cycle and the secure time with the old random number of the previous cycle.

[0017] Now, there is a method for identifying that during the startup process after a power outage / power-on, it is ensured that the startup is always carried out with the initial values ​​and not with the current values ​​of the last safety program cycle (e.g. before the power outage). Because when the power grid fails, the computer system also fails, and when the power grid is restored, the operating environment is restarted, although the control software is also restarted, but now it is ensured that the cold start mechanism is also executed in the safety program.

[0018] If the cold start mechanism works, random numbers are extracted during the difference calculation starting from the second cycle.

[0019] If the cold start mechanism fails, then in the first cycle two different random numbers are used (eg once with the random number before "grid off" and once with the new random number after "grid on"), thus stopping the execution of the safety program.

[0020] The control software operates as a fail-safe control system with a safety program and a standard application program and is able to reveal undesired influences on the safety program.

[0021] During startup of the fail-safe control system after a power failure, a cold start mechanism is executed on the computer system and ensures by the cold start mechanism that startup always takes place with initial values ​​and not with current values ​​from the last cycle, wherein, in the event of a failure of the cold start mechanism, this is identified during the difference calculation in the control component by exceeding the tolerance, thereby identifying a failure of the cold start mechanism.

[0022] The security time is read from a hardware component installed in the computer system, in particular a network card. After the security time is requested, the security time is converted into an integer value in a manner that simulates a standard frequency of 32.768 kHz.

[0023] The process of establishing the standard time is not interfered with in any way. Two independent timers operate, each generated by a different quartz crystal.

[0024]

[0025] The object is also achieved by a computer system, which includes: a runtime environment configured to run cycle-oriented control software for controlling a process; a random number generator; a processor with a system time; a hardware component with an external time source, the external time source being used to provide a secure time; and a storage area configured to execute the method according to the present invention.

[0026] The computer system is advantageously designed as a multifunctional control platform or as an industrial PC or as an edge computing platform or as a cloud computing platform.

[0027] On the computer system, the control software is configured as a fail-safe control system with safety programs and standard application programs.

[0028] The fail-safe control system has a cold start mechanism, which is configured to perform a startup of the fail-safe control system after a power failure on a computer system, wherein the cold start mechanism is configured to pre-assign initial values ​​to the fail-safe control system and not pre-assign current values ​​of the last cycle, and the computer system also has a control component, which is configured to identify a failure of the cold start mechanism by calculating based on a difference value exceeding a tolerance. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The drawings show an embodiment, in which:

[0030] Figure 1 A computer system is shown on which a runtime environment for controlling software is provided,

[0031] Figure 2 Shows a safety procedure with a cold start mechanism,

[0032] Figure 3 The control components for calculating the time difference are shown.

[0033] Figure 4 shows the principle of accessing two different times through the runtime environment,

[0034] Figure 5 A graph is shown for showing the time trend of system time and security time;

[0035] Figure 6 The principle of a fail-safe control system with possible retrieval sequences is shown. DETAILED DESCRIPTION

[0036] according to Figure 1A computer system 1 is shown, which can be, for example, an industrial PC or an edge computing platform. A hypervisor 7 is installed in the computer system 1, which enables an operating system 8 (for example, a Windows operating system) to run in parallel with the runtime environment FW. The runtime environment FW is configured to run the cycle-oriented control software SOFT-PLC for controlling processes as a fail-safe control system. The control software SOFT-PLC is configured with a safety program F-PROG and a standard application S-PROG. For the fail-safe control system F-CPU, in order to ensure the system time SZ of the computer system 1, it is necessary to request an additional safety time eZQ independent of the system time SZ in each cycle Z.

[0037] The processor 5 of the computer system provides the system time SZ. The security time eZQ is read from the hardware component 4 embedded in the computer system 1, in particular the network card NIC. The request mechanism 9 in the runtime environment FW ensures that the security time eZQ is continuously requested. In order to ensure the system time SZ, a first time difference S-Diff is formed from the system time SZ of the previous cycle Zn-1, and a second time difference F-Diff is formed from the security time eZQ of the current cycle and the security time eZQ of the previous cycle Zn-1. The time differences S-Diff and F-Diff are compared with a preset tolerance TOL, and an error signal is generated if the deviation of the time differences S-Diff and F-Diff exceeds the tolerance TOL.

[0038] The time elapsed between the current cycle and the last cycle has therefore now been determined via the time difference of the two timers. In order to now identify whether it is ensured that the startup is always carried out with the initial value IW and not with the current value AW of the last safety program cycle (e.g. before the grid disconnection) during the startup process after the grid disconnection / connection, a random number ZZ is generated when the runtime environment FW is started. The random number ZZ is stored in the storage area 2 and is added to the safety time eZQ at each further request for the safety time eZQ. When a new cycle Zn is started in the control software Soft-PLC, the storage area 2 is accessed in the control component F-CRT and the random number ZZ is extracted again from the safety time eZQ in the control component F-CRT before the time differences S-Diff, F-Diff are calculated. The random number ZZ is generated by means of a random number generator 3. The conversion mechanism 10 ensures that the random number ZZ is added to the externally requested safety time eZQ.

[0039] In the case of fail-safe control systems according to the prior art, it has always been possible to ensure that the two timers behave differently in the “grid disconnected” state, since both are already present in one device and the timers have been defined by the manufacturer.

[0040] However, if you now want to implement control on any platform with the help of controller software Soft-PLC, then the network card NIC has undefined behavior during "grid disconnection", even if the second time is obtained from the network card NIC, for example. In order to further ensure that a failure of the cold start mechanism KM is detected, the random number ZZ is added to the value of the safety time eZQ by this approach. The random number ZZ is generated once at each startup, for example after a power failure.

[0041] If the cold start mechanism KM works, a random number ZZ is extracted during the time difference calculation. If the cold start mechanism KM should fail, two different random numbers ZZ are considered in cycle Z, one before the "grid disconnection" and one after the "grid disconnection". The processing of the safety program F-PROG can be stopped because this is an indication that the cold start mechanism KM fails and the current value AW has not yet been reset to the initial value IW.

[0042] The computer system 1 also has additional reserved hardware 6 specifically for the fail-safe control system F-CPU.

[0043] With the help of Figure 2 Note: At the start of the safety program F-PROG, the cold start mechanism KM is executed, which resets the current value AW to the initial value IW. With each cycle Z in the safety program F-PROG, the time is recalculated by the control unit F-CRT.

[0044] Figure 3 The time calculation algorithm implemented in the control component F-CRT is shown. The control component F-CRT obtains the system time SZ, the random number ZZ from the storage area 2 and the safe time eZQ converted by the conversion mechanism 10 and added with the random number ZZ as input variables. However, in the control component F-CRT, the random number ZZ is extracted from the safe time eZQ' again, and the safe time eZQ (Zn) is obtained. At this time, the difference S-Diff and F-Diff of the corresponding old time and new time are formed. If the difference exceeds the tolerance TOL, an error signal is generated.

[0045] Figure 4The explanation of different time formation is shown as a block diagram. In the runtime environment FW, a system call 13, such as Linux-SysCall, is implemented on the network card register of the network card NIC. The system call 13 continuously obtains the secure time eZQ from the network card NIC. The network card NIC provides a time base via the local time 11, wherein the time base is normalized to a normalized 64-bit counter by a normalization device 12. The 64-bit counter is in nanoseconds. The random number generator 3 is also implemented in the FW runtime environment. The conversion mechanism 10 receives the random number ZZ generated by the random number generator 3, and calculates the random number ZZ as time with the help of the time converter 14, and at the same time converts the calculated time into a standard time of 32.768kHz. Therefore, the secure time eZQ' for loading the random number ZZ is obtained. The system time SZ of the processor 5 is available to the runtime environment FW via the basic timer access 16 in a conventional manner and method. The system time SZ can be adapted via the frequency divider 15 according to the preset. Finally, the safety program F-PROG and the user program S-PROG are provided with the time required for controlling the processes via the standard basic timer 17 .

[0046] With the help of Figure 5 A diagram 50 shows the time course of the system time SZ and the safety time eZQ. At the start time, the system time SZ represented by the time course 51 and the safety time eZQ' represented by the time course 52 start. At the time NA (grid disconnection), the electrical power fails. Usually, the processor or its system time SZ is configured so that the system time is residual. This means that after the voltage is restored or after the end of the current fault at the time NE (grid connection), the time continues with the last value. Since the behavior of the additionally acquired safety time eZQ is unknown or usually not residual, a defined behavior cannot be obtained and a response in a safety-compliant manner cannot be made. If a cold start of the computer system 1 is now performed at the time NF (grid connection), and the cold start mechanism KM in the safety program F-PROG is not executed by chance, this is revealed by the offset V in the time difference F-Diff of the safety time eZQ. The offset V is derived from the difference between the new random number ZZ-new and the old random number ZZ-old.

[0047] Figure 6 The basic sequence when starting up a fail-safe control system F-CPU is shown. First, the cold start mechanism KM is executed. The cold start mechanism KM includes, but is not limited to, deleting user data and deleting the current process image of the inputs and the current process image of the outputs. Residual and non-residual flags are deleted. Times and counters are deleted. All DBs are initialized with initial values. During this phase, the external device outputs are switched to a safe state.

[0048] During a cold start, it is necessary, in particular for a fail-safe control system F-CPU, to start with the initial value IW. Then, the actual safety program F-PROG starts from the safety OB F-OB and gradually calls different safety modules F1, F2, F-CRT... until Fn. All safety modules ensure the functional safety required by the fail-safe control system F-CPU. In the control component F-CRT, a random number ZZ is added to the safety time eZQ to ensure the system time SZ, so if the cold start mechanism KM should fail, the old value in the storage area 2 is then considered, and the failure of the cold start mechanism KM is revealed. In the safety program F-PROG, the standard basic timer time 17 for calling OB1 is provided in the standard application S-PROG.

Claims

1. A method for operating cycle-oriented control software (Soft-PLC) for controlling a process, wherein: The control software (Soft-PLC) is executed in a runtime environment (FW) on a computer system (1), wherein, in order to ensure a system time (SZ) of the computer system (1), an additional safety time (eZQ) is requested in each cycle (Z) that is independent of the system time (SZ), wherein a first time difference (S-Diff) is formed from the system time (SZ) of a current cycle (Zn) and the system time (SZ) of a previous cycle (Zn-1) and a second time difference (F-Diff) is formed from the safety time (eZQ) of the current cycle (Zn) and the safety time (eZQ) of the previous cycle (Zn-1), and a comparison of the time differences (S-Diff, F-Diff) with a preset tolerance (TOL) is performed, and an error signal is generated if the deviation of the time differences (S-Diff, F-Diff) exceeds the tolerance (TOL), The invention is characterized in that a random number (ZZ) is generated when the runtime environment (FW) is started, the random number (ZZ) is stored in a memory area (2) and is added to the security time (eZQ) at each further request for the security time, wherein in a control component (F-CRT) the deviation between the time differences (S-Diff, F-Diff) is calculated when a new cycle (Zn) is started in the control software (Soft-PLC), and wherein in each cycle (Zn) the memory area (2) is accessed by the control component (F-CRT) and when calculating the time difference (S-Diff) In the control component (F-CRT), the random number (ZZ) is extracted again from the secure time (eZQ) before the second time difference (F-Diff, F-Diff), in the event of a restart of the runtime environment (FW), the restart can be diagnosed by exceeding the tolerance (TOL), because the second time difference (F-Diff) now has an offset (V), which is obtained from the secure time (eZQ) with the new random number (ZZ) of the current cycle (Zn) and the secure time (eZQ) with the old random number (ZZ) of the previous cycle (Zn-1).

2. The method according to claim 1, wherein: The control software (Soft PLC) operates as a fail-safe control system having a safety program (F-Prog) and a standard application program (S-Prog) and is able to detect undesired influences on the safety program (F-Prog).

3. The method according to claim 2, wherein: During startup of the fail-safe control system after a power failure, a cold start mechanism (KM) is executed on the computer system (1), and the cold start mechanism (KM) ensures that startup always takes place with initial values ​​(IW) and not with current values ​​(AW) of the last cycle, wherein in the event of a malfunction of the cold start mechanism (KM), this is detected during the difference calculation in the control component (F-CRT) by exceeding the tolerance (TOL), thereby detecting a malfunction of the cold start mechanism (KM).

4. The method according to any one of claims 1 to 3, wherein: The secure time (eZQ) is read by a hardware component installed in the computer system (1), in particular a network card (NIC).

5. The method according to any one of claims 1 to 4, wherein: After the safety time (eZQ) is requested, the safety time is converted into an integer value in a manner that simulates the standard frequency of 32.768 kHz.

6. A computer system (1), comprising Runtime environment (FW), configured to enable the cycle-oriented control software (Soft-PLC) to run to control the process, Random number generator (3), Processor with system time (SZ) (5), a hardware component (4) having an external time source for providing secure time (eZQ), A storage area (2) configured to execute the method according to any one of claims 1 to 5.

7. The computer system (1) according to claim 6 is configured as a multi-functional control platform or as an industrial PC or as an edge computing platform or as a cloud computing platform.

8. The computer system (1) according to claim 6 or 7, wherein: The control software (Soft-PLC) has a fail-safe control system with a safety program (F-Prog) and a standard application program (S-Prog).

9. The computer system (1) according to any one of claims 6 to 8, wherein: The fail-safe control system has a cold start mechanism (KM), which is configured to perform a startup of the fail-safe control system after a power failure on the computer system (1), wherein the cold start mechanism (KM) is configured to preconfigure the fail-safe control system with initial values ​​(IW) instead of current values ​​(AW) of the last cycle, and the computer system also has a control component (F-CRT), which is configured to identify a failure of the cold start mechanism (KM) by calculating the difference value exceeding the tolerance (TOL).

Images