Method and system for operating automation technology field device via machine-to-machine communication between operating unit and field device

Abstract

The invention relates to a method and a system for operating an automation technology field device via machine-to-machine communication between an operating unit and the field device. The invention comprises a method for operating an automation technology field device via machine-to-machine communication between an operating unit and the field device, comprising:-creating an order ticket using a ticket server, wherein the order ticket contains authorization of the operation unit to perform the defined task on the field device and information about time validity; -transmitting the order ticket from the ticket server to the operating unit; -sending the order ticket from the operating unit to the field device; registering an operating unit with the field device if the field device can verify that the order ticket is valid; -if the field device can successfully verify the order ticket, authorizing execution of a task defined in the order ticket on the field device for a predetermined time period having an end point determined by the information about the time validity contained in the order ticket; and-automatically terminating the authorization by the field device after the predetermined time period has elapsed, and comprising a system for carrying out the method according to the invention.

Description

Technical Field

[0001] The invention relates to a method for operating an automation technology field device via machine-to-machine communication between an operating unit and the field device. The invention also relates to a system configured to carry out the method according to the invention. Background Art

[0002] Field devices used in industrial equipment are known from the prior art. Field devices are usually used in process automation engineering and in manufacturing automation engineering. In principle, all process-oriented devices that supply or process process-related information are called field devices. Therefore, field devices are used to detect and / or influence process variables. Measuring devices or sensors are used to detect process variables. These are used, for example, for pressure and temperature measurement, conductivity measurement, flow measurement, pH value measurement, material level measurement, etc., and detect corresponding process variables of pressure, temperature, conductivity, pH value, material level, flow, etc. Actuators are used to influence process variables. For example, these are pumps or valves that can affect the flow of fluids in pipelines or the material level in tanks. In addition to the above-mentioned measuring devices and actuators, field devices are also understood to include remote I / O, radio adapters or devices that are usually arranged at the field level.

[0003] A large number of these field devices are produced and sold by the Endress+Hauser Group.

[0004] In modern industrial plants, field devices are usually connected to a superordinate unit via a communication network such as a fieldbus (Profibus®, Foundation® Fieldbus, HART®, etc.). Typically, the superordinate unit is a control system (DCS) or a control unit such as a PLC (Programmable Logic Controller). The superordinate unit is used for process control, process visualization and process monitoring as well as for commissioning of field devices. The measured values ​​recorded by the field devices (especially by sensors) are sent to one (or in some cases multiple) superordinate units via the corresponding bus system. In addition, data transmission from the superordinate unit to the field device via the bus system is also required, especially for configuration and parameterization of the field device and for controlling actuators.

[0005] The mobile operating unit can also be used to operate field devices that have implemented the FDT frame application. For example, there are operating units connected to a fieldbus network. However, the operating unit can also communicate with the field device via a wireless communication connection, in particular based on the Bluetooth standard. The applicant produces and sells a device that allows the operating unit to be coupled to the field device as a so-called Bluetooth gateway. The field device is connected to the Bluetooth gateway via a wired connection, in particular using the HART or CDI communication standard. Alternatively, the field device itself has its own Bluetooth interface.

[0006] If a mobile device such as a smartphone or tablet is used as an operating unit for wireless communication with the field device, applications—so-called apps—are available which make operating functions of the field device available to the mobile device.

[0007] In industrial environments, most installed field devices have no or only very basic protection against unauthorized access. In these field devices, all device parameters can usually be accessed directly or, for example, after entering an unlock code. Due to the German federal security law, more and more field devices with individual user accounts and role-based authorization are entering the market. For access via the user interface or machine interface, an authorization that is "permanent" in a sense is required, which is usually granted by prior authentication. The authorization must be selected so that the accessing users (permanently) have all the authorizations they need to perform their tasks.

[0008] In order to reduce the administrative workload for the management of individual field devices to an acceptable level, there are isolated efforts towards centralized management, as has been common practice in the IT field for many years with regard to IT devices such as printers, workstations, etc. An example of such a concept is disclosed in DE 10 2018 1026 08 A1, in which a transmission device is provided, to which user data are transferred from a user database, wherein access to the field device is granted after checking the user data.

[0009] There are also ideas for limiting the access rights required by people to a minimum. For example, DE102019131860 A1 discloses providing a digital order ticket that is sent from a server to a mobile device, the order ticket containing the access rights and authorized tasks of a field device. When a connection is established with a field device, the order ticket is sent. If authorization is available, the task contained in the order ticket, such as parameterizing an action or performing a functional test, can be processed using the field device.

[0010] The disadvantage of this practice is that the persons or machines that need access to the field device in question have permanent access rights, even if they only rarely and for specific tasks. In principle, this also carries the risk of access outside of a specific order, which could lead to changes in the configuration or parameterization of the field device, which can not only have a negative impact on the quality of the process, but can also lead to a lack of transparency about the status of the individual field devices. Another aspect in this context is that the highest authorization must be granted in each case, even if such authorization is rarely needed and, in normal cases, a role with a lower authorization would be sufficient. This increases the risk of changing sensitive parameters outside of the current task during normal work on the device.

[0011] This is important because current practice still treats authorization to machine interfaces very loosely. However, since user actions are often tunneled through such connections, or the user triggers the corresponding machine access, this carries the same risk of human error as direct user interfaces. Summary of the invention

[0012] In view of this, it is an object of the present invention to improve the needs-based allocation of access authorizations to field devices.

[0013] This object is achieved by a method according to claim 1 and a system according to claim 15 .

[0014] With regard to the method according to the invention, a method is provided for operating an automation technology field device via machine-to-machine communication between an operating unit and the field device and comprises the following method steps:

[0015] - creating an order ticket using the ticket server, wherein the order ticket contains the authorization for the operating unit to perform a defined task on the field device and information about the time validity;

[0016] -Transferring the order ticket from the ticket server to the operating unit;

[0017] - Sending the order ticket from the operating unit to the field device;

[0018] - if the field device is able to verify that the order ticket is valid, registering the operating unit with the field device;

[0019] - if the field device is able to successfully validate the order ticket, authorizing the execution of the task defined in the order ticket on the field device for a predetermined time period having an end point determined by the information on time validity contained in the order ticket; and

[0020] - After the predetermined period of time has elapsed, the authorization is automatically terminated by the field device.

[0021] The method according to the invention makes it possible to grant access authorization to field devices to operating units on demand and temporarily, wherein only the authorization required for the execution of the current task is granted. In contrast to the concepts known from the prior art, the order ticket contains information about the validity, thereby determining and specifying a time period, wherein the authorization is only valid for this time period. After this time period has ended, the authorization ends, so that access to the functions of the field device required for the execution of the task is no longer possible. Generally, it is not intended that the order ticket only authorizes certain operating units to perform a task. Instead, the order ticket is intended to activate the function for a certain time period, so that the operating unit can then perform the task regardless of its identity.

[0022] In one embodiment of the method, it is provided that the operating unit registers with the field device if the field device is able to verify that the order ticket is valid, wherein in the case of successful registration the operating unit is authorized for a predetermined time period, and wherein after the predetermined time period has elapsed, the operating unit is automatically deregistered by the field device. Thus, the access authorization to the operating unit is only valid for this time period. After the end of this time period, the validity ends and the operating unit is deregistered. The operating unit is only authorized to perform exactly these defined tasks. Other different tasks cannot be performed.

[0023] A first variant of the method provides that the end point is a fixed date. The term "date" also includes the time of day. Thus, the time period is predetermined so that its length is independent of the arrival of the order ticket at the field device. This also enables the order ticket to arrive at the field device only after the time period has elapsed. The field device can then no longer be operated for this order ticket.

[0024] A first variant of the method provides that the end point is the completion of a defined task at the field device.

[0025] A third variant of the method provides for the end point to have a fixed time interval with respect to the start point, wherein the predetermined time period is defined by the start point and the end point. In particular, it is provided that the start point is the point in time immediately after the order ticket has been positively validated by the field device. The validity information comprises a request to the field device to determine the arrival date and / or time of the order ticket and to calculate the end point based thereon. Alternatively, it can also be provided that the field device determines the start point when an event occurs, for example when a new device state (e.g., "maintenance required") occurs.

[0026] The operating unit can be a random or a specific operating unit. If the order ticket and the associated task are linked to a specific operating unit, a further development of the method provides that authorization only takes place if the operating unit successfully authenticates itself to the field device.

[0027] To this end, the order ticket may list one or more operating units that are authorized to perform operating actions on the field device to complete the task.

[0028] Authentication means that the operating unit must prove its identity to the field device after the order ticket has been transmitted. This can be done, for example, by the operating unit claiming that it is the owner of a certain key pair, where the public key of the operating unit is sent to the field device. Using a challenge-response procedure, the operating unit must prove to the field device that it owns the associated private key.

[0029] Alternatively, the operating unit sends a signed message with the identification of the operating unit. The field device verifies the signature and, if the signature is successfully verified, trusts that the identity is correct.

[0030] Alternatively, the operating unit sends a message with the identification of the operating unit to the field device, wherein the operating unit encrypts the message. If the message can be decrypted by the field device, the field device trusts the content of the message, ie, trusts the identity of the operating unit.

[0031] In the latter two alternatives, trust is based on signatures or encryption, where keys are pre-exchanged ("pre-shared keys").

[0032] One embodiment of the method provides that an industrial control unit, in particular a programmable logic controller PLC, is used as an operating unit and is connected to the field device via an industrial network, in particular a fieldbus network. This establishes so-called "machine-to-machine" communication, i.e., communication in which no human communication participants are involved (e.g., via a mobile operating unit such as a smartphone). This type of order-related access authorization can also be used to ensure that access only occurs at the scheduled time or when required in "machine-to-machine" communication. This increases the transparency of changes to the configuration of field devices, since access can be controlled not only in terms of time, but also in terms of the access entity and possibly also in terms of the plausibility or validity when writing data. In addition, unwanted access or changes due to technical errors are almost eliminated.

[0033] An “industrial network” is in particular an automation technology fieldbus. Such a fieldbus is based, for example (non-exhaustive list) on the protocols HART, FOUNDATION Fieldbus, Profibus PA / DP, Modbus, CAN bus etc. An “industrial network” can also be Ethernet-based or wireless (for example, based on standards such as WirelessHART, ZigBee etc.).

[0034] Machine-to-machine communication (and the application of the method) can also be established with network components other than the control unit. For example, a gateway or an edge device or similar can be used. Communication with another field device is also possible.

[0035] An advantageous embodiment provides that the communications between the control unit and the field devices, which are necessary for sending the order ticket and for executing the steps of the defined tasks on the field devices, are performed in the asynchronous or acyclic communication phase of the industrial network. These tasks are thus focused on "special access" to the field devices, and not on cyclic data communication, as is common, for example, with Profibus PA / DP. However, a corresponding protocol is required which also allows acyclic access (e.g. Profibus PA / DP, Foundation Fieldbus, etc.).

[0036] When an industrial control unit or another (fieldbus) network participant is used as an operating unit, provision is made for the operating unit to check the parameterization data of the field devices as a defined task.

[0037] Alternatively or additionally, when using an industrial control unit or another (fieldbus) network participant as operating unit, provision is made for parameterization of the field device to be provided as an (additionally) defined task, wherein the order ticket comprises at least one permitted value range for a parameter change.

[0038] Alternatively or additionally, when an industrial control unit or another (fieldbus) network participant is used as an operating unit, provision is made for the operating unit to read out the logbook of the field device as an (additionally) defined task.

[0039] One embodiment of the method provides that a time server is used as operating unit, wherein synchronization of the system time of the field device with the system time of the time server is provided as a defined task.

[0040] According to the development of the method, it is provided that the order ticket contains encrypted data, which is used to establish a secure communication connection after the operating unit has been registered with the field device. The operating unit has its own fixed key pair. However, these keys are usually not used directly, but only indirectly. This means that the key is calculated using a key derivation function (scrypt, PBKDF2, etc.) and then actually used. A random number (NONCE) is usually used for this derivation. In this case, a secret can be used instead. The two communication partners then calculate the derived key independently of each other and use it to encrypt their messages from then on. If both come to the same conclusion, they can decrypt each other's messages.

[0041] The order ticket can also be cryptographically signed by the ticket server. The tamper-proof ticket can then be transmitted over an unsecured connection as proof of authorization.

[0042] One embodiment of the method provides that the order ticket is sent from the ticket server to the operating unit via a network connection. The network connection is (in the case of a remotely located ticket server) the Internet. If the ticket server is located within or close to the facility, it is an (Ethernet-based) IT network.

[0043] For the system according to the invention, it is provided that the system is provided for carrying out the method according to the invention and comprises an automation technology field device, a ticket server and an operating unit.

[0044] The field devices mentioned in connection with the invention have already been given as examples in the introductory part of the description.

[0045] As already described above, the operating unit may be a control unit according to a programmable logic controller (PLC), another network component according to a gateway, an edge device or the like, or another field device. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] The present invention will be explained in more detail below with reference to the following drawings. In the drawings:

[0047] Figure 1 shows an exemplary embodiment of a system according to the present invention; and

[0048] Figure 2 An exemplary embodiment of a method according to the invention is shown. DETAILED DESCRIPTION

[0049] exist Figure 1 Components of an automation technology system A are depicted in FIG. In particular, these are two measuring points MS1, MS2, each of which has several field devices FG1, FG2, FG3, FG4, FG5. These measuring points each consist of a tank and a pipe discharging from the tank. In order to measure the fill level of the tank as a process variable, field devices FG1, FG4 (e.g. with radar as sensor unit) are attached to the tank. In order to measure the flow rate in the pipe, field devices FG3, FG5 are attached, whose respective sensor units determine the flow rate of the medium flowing through the pipe as the main process variable according to the Coriolis principle. In addition, a field device FG2 is attached at the measuring point MS1, which determines the temperature of the measuring medium flowing through the pipe by means of a high-precision temperature sensor as sensor unit.

[0050] The field devices FG1, ..., FG5 are interconnected and communicate with each other via an industrial network OT (OT=operation technology). The industrial network OT is in particular a fieldbus according to one of the known fieldbus standards, such as Profibus, Foundation Fieldbus or HART. Alternatively, the industrial network OT is an Ethernet network.

[0051] The industrial network OT comprises a superordinate unit PLC, such as a programmable logic controller, which transmits commands to the field devices FG1, ..., FG5, which then transmit process values, diagnostic data and status information to the superordinate unit PLC. These process values, diagnostic data and status information are forwarded by the superordinate unit PLC via the IT network IT to the workstation PC WS in the control station of system A. The workstation PC is also used for process visualization, process monitoring and engineering as well as for operating evaluation and monitoring of the field devices FG1, ..., FG5, or it can act as a planning tool ("Enterprise Resource Planning" (ERP), "Enterprise Management System" (EMS) etc.).

[0052] In addition, the industrial network OT is assigned an edge device ED, which monitors the process values, diagnostic data and status information sent by the field devices FG1, ..., FG5 contained in the corresponding measuring points MS1, MS2 to the superordinate unit PLC and, if necessary, queries further data from the field devices FG1, ..., FG5.

[0053] The edge device ED may establish a communication connection via the Internet to a service platform SP which is configured to execute applications. For example, one such application is a plant asset management system for managing field devices FG1 , ..., FG5.

[0054] In the following, it is assumed that the control unit PLC operates the field device FG3. Operation means changing the parameter values ​​of the current operating parameter set of the field device FG3. It is assumed that the control unit PLC has only limited access with regard to the operating time and operating scope, or that the access is part of a higher-level plan and represents a temporary event according to a work order from the perspective of the PLC.

[0055] In this context, Figure 2 The process flow of an embodiment of the method according to the invention is shown, which has method steps 1) to 7). The core of the method according to the invention is based on the fact that special accesses to field devices, in particular including write accesses, such as in the present case the operation of the field device FG3 via the control unit PLC via the industrial network OT, should not be permanently possible.

[0056] For this purpose, in a first method step 1), an order ticket AT is centrally created by a ticket server TS as part of global task planning. The ticket server TS is a server that can be reached via the Internet. However, the ticket server can also be located close to the system and can be formed, for example, by a workstation PC WS of the control system of system A. The order ticket AT is a digital, tamper-proof data packet which, in addition to the signature of the ticket server TS, also includes the authorization for the operating unit BE to perform a defined task on the field devices FG1, FG2, ..., FG5 and information about the time validity. In addition to the authorization for the task, the order ticket also contains, for example, the valid value ranges for the parameters to be written.

[0057] In method step 2), the order ticket AT is transmitted from the ticket server TS to the access initiation location, in this case the control unit PLC. The transmission takes place via the Internet to an access point of the communication network IT, which forwards the order ticket AT to the control unit PLC. Alternatively, the control unit PLC according to the IIoT device has its own Internet access and is registered with the ticket server TS, so that the latter sends the order ticket AT directly to the control unit PLC.

[0058] In method step 3), the control unit PLC sends the order ticket AT to the field device FG3 via the industrial network OT. When a fieldbus is used as the industrial network OT, the order ticket AT is sent in an acyclic communication phase. It is also provided that all subsequent communications or data exchanges between the field device FG3 and the operating unit BE take place in the acyclic communication phase.

[0059] In method step 4), the field device FG3 checks the incoming order ticket AT. In the simplest case, such an order ticket contains only a verifiable authorization for the execution of the task by the operating unit BE, i.e. the control unit PLC. In order to increase security, the order ticket AT contains the requirement that the executing entity, i.e. the control unit PLC, is named and that it must authenticate itself. The authentication of the operating unit BE to the field device FG3 takes place in the optional method step 4.1), which is part of the authentication performed by the field device FG3. For example, the field device FG3 requests the operating unit BE to authenticate after receiving and checking the ticket to verify the correct identity of the operating unit BE. In this context, a challenge-response procedure would be suitable. For this purpose, the field device FG3 sends an arbitrary (random) phrase, and the operating unit BE signs it and sends it back to the field device FG3. The field device FG3 then verifies the signature using a public key. In this case, the public key of the operating unit BE is part of the order ticket.

[0060] If the operating unit BE cannot successfully authenticate itself to the field device FG, or if the authentication otherwise fails, the field device FG3 denies access to the operating unit BE in method step 5 . a), which terminates the method.

[0061] However, if the verification has a positive result, the field device FG3 allows access to the operating unit BE in method step 5b.) and enables the operating unit BE to operate exclusively within the scope of the task or operating action specified in the order ticket AT. In addition, the field device FG specifies the time period in which such access is allowed based on the validity information contained in the order ticket AT. A specific date and / or a specific time can be defined in the order ticket AT, which determines the expiration of the time period in which the operation is allowed. Alternatively, the validity period is formed by a starting point and an end point. Here, it can be specified that the starting point is the time point immediately after the order ticket has been positively verified by the field device FG3. The validity information in the order ticket AT includes a request to the field device FG3 to determine the arrival date and / or time of the order ticket and calculate the end point based on it. Alternatively, it can be specified that the field device FG3 determines the starting point when an event occurs, for example, when a new device state (for example, "maintenance required") occurs.

[0062] Furthermore, the field device FG3 limits the order to, for example, a one-time complete execution. This results in a second (dynamic) criterion for the end of validity. The time by which the task must be completed can also be determined by a higher-level management tool.

[0063] Optionally, the field device FG3 and the operating unit BE establish a secure communication connection in method step 5 b . 1 ) using the encrypted data contained in the order ticket AT.

[0064] The field device FG then operates for the task defined in the order ticket within a defined time period in method step 6. In the present case, certain parameter values ​​are changed within a value range defined in the order ticket AT.

[0065] In the last method step 7), the operating unit BE is logged off from the field device FG3; no further operations are possible. The logout takes place automatically. For this purpose, the following two options are conceivable: automatic logout after successful completion of all tasks defined in the order ticket AT and / or automatic logout after expiration of a predetermined time period.

[0066] Since at least special access to field devices is only possible with a special order ticket AT, it can only be performed after prior planning. This ensures that the entire parameterization of the system A remains unchanged as long as no tasks are planned and executed. This greatly increases and improves the transparency and controllability of the system status. In addition, for example, boundaries in the order ticket can be used to limit the results of tasks and prevent unreasonable write access or the execution of unwanted parts of the task. Since proof of authorization is required, accidental manipulation or attacks are no longer possible.

[0067] As an alternative to the control unit PLC, other network components can also be used as operating unit BE. For example, the edge device ED can operate one of the field devices FG1, ..., FG5. In this case, the ticket server TS will send the order ticket AT to the edge device ED.

[0068] In the course of the method, further tasks can also be defined in the order ticket AT. For example, once a day, each component of the industrial network (field device FG1, ..., FG5), control unit PLC, edge device ED, etc.) can be given the task of synchronizing the time server with the system time. Another task can be to read the logbook for central backup or to regularly check changes in the parameterization of the field device FG1, ..., FG5 by reading the hash.

[0069] It can be stipulated that certain task categories and / or operating units (or a certain combination of task and operating unit) do not require an order ticket AT (so-called "wildcard"). This will be recorded accordingly in the field devices FG1, ..., FG5. In addition, groups of field devices can be named in the order ticket to reduce the effort required for ticket creation. In addition, with regard to the operating units BE, n-out-of-1 relationships can be used in order to achieve flexibility in technical redundancy systems.

[0070] Reference numerals list

[0071] 1.), 2.), …, 7.) Method steps

[0072] A System

[0073] AT Order Ticket

[0074] BE operating unit

[0075] ED Edge Devices

[0076] FG1, FG2, …, FG5 field devices

[0077] IT IT Network

[0078] OT Industrial Network

[0079] PLC Industrial Control Unit

[0080] TS Ticket Server

[0081] Workstation PC in the control station of WS system

Claims

1. A method for operating an automation technology field device (FG1, FG2, ..., FG5) via machine-to-machine communication between an operating unit (BE) and the field device (FG1, FG2, ..., FG5), comprising: - creating an order ticket (AT) using a ticket server (TS), wherein the order ticket (AT) contains authorization for the operating unit (BE) to perform a defined task on the field device (FG1, FG2, . . . , FG5) and information about the time validity; - transmitting the order ticket (AT) from the ticket server (TS) to an operating unit (BE); - sending the order ticket (AT) from the operating unit (BE) to the field device (FG1, FG2, ..., FG5); - registering the operating unit (BE) with the field device (FG1, FG2, ..., FG5) if the field device (FG1, FG2, ..., FG5) is able to verify that the order ticket (AT) is valid; - authorizing the execution of the task defined in the order ticket (AT) on the field device (FG1, FG2, ..., FG5) for a predetermined time period, the predetermined time period having an end point determined by the information on time validity contained in the order ticket (AT), if the field device is able to successfully validate the order ticket; as well as - the authorization is automatically terminated by the field device (FG1 , FG2 , . . . , FG5 ) after the predetermined time period has elapsed.

2. The method according to claim 1, wherein: If the field device (FG1, FG2, ..., FG5) is able to verify that the order ticket (AT) is valid, the operating unit (BE) registers with the field device (FG1, FG2, ..., FG5), wherein, in the case of successful registration, the operating unit (BE) is authorized for the predetermined time period, and wherein, after the predetermined time period has elapsed, the operating unit (BE) is automatically deregistered by the field device (FG1, FG2, ..., FG5). The method according to claim 1 , wherein the end point is a fixed date. 4 . The method according to claim 1 , wherein the end point is the completion of the defined task on the field device ( FG1 , FG2 , . . . , FG5 ).

5. The method according to claim 1 or 2, wherein the end point has a fixed time interval with the start point, and wherein the predetermined time period is defined by the start point and the end point. 6 . The method according to claim 5 , wherein the starting point is a point in time immediately after the order ticket (AT) has been positively authenticated by the field device ( FG1 , FG2 , . . . , FG5 ).

7. The method according to any of the preceding claims, wherein authorization takes place only if the operating unit (BE) successfully authenticates itself to the field device (FG1, FG2, . . . , FG5).

8. The method according to any of the preceding claims, wherein an industrial control unit (PLC), in particular a programmable logic controller, is used as the operating unit (BE) and is connected to the field devices (FG1, FG2, ..., FG5) via an industrial network (OT), in particular a fieldbus network.

9. A method according to claim 8, wherein the communication between the control unit and the field device (FG1, FG2, ..., FG5) is performed in an asynchronous or acyclic communication phase of the industrial network (OT), the communication being necessary for the steps of sending the order ticket (AT) and executing the defined task on the field device (FG1, FG2, ..., FG5). 10 . The method according to claim 1 , wherein checking parameterization data of the field devices ( FG1 , FG2 , . . . , FG5 ) by the operating unit (BE) is provided as a defined task. 11 . The method according to claim 1 , wherein the parameterization of the field device ( FG1 , FG2 , . . . , FG5 ) is provided as a defined task and wherein the order ticket (AT) comprises at least one permitted value range for a parameter change. 12 . The method according to claim 1 , wherein reading out of a logbook of the field device (FG1 , FG2 , . . . , FG5 ) by the operating unit (BE) is provided as a defined task.

13. The method according to claim 1, wherein a time server is used as an operating unit (BE), wherein synchronization of the system time of the field devices (FG1, FG2, . . . , FG5) with the system time of the time server is provided as a defined task.

14. The method according to any of the preceding claims, wherein the order ticket (AT) contains encrypted data, wherein the encrypted data is used to establish a secure communication connection after the operating unit (BE) has been registered with the field device (FG1, FG2, ..., FG5).

15. The method according to any of the preceding claims, wherein the order ticket (AT) is sent from the ticket server (TS) to the operating unit (BE) via a network connection.

16. A system configured to carry out the method according to any one of claims 1 to 15, wherein the system comprises an automation technology field device (FG1, FG2, ..., FG5), a ticket server (TS) and an operating unit (BE).

Images