Method for operating control software and arrangement with computer system

Abstract

The invention relates to a method for operating a control software and an arrangement with a computer system for operating a control software for controlling a process, in which the control software is run in a runtime environment on the computer system and a security program is loaded into a load memory for running in the control software, a checksum of the program code of the security program is saved in a network user connected to the computer system via the communication network, in which the control software generates a load memory checksum by means of the program code of the security program saved in the load memory during startup within the runtime environment, and furthermore, the load memory checksum generates a load memory checksum by means of the program code of the security program saved in the load memory during startup within the runtime environment. The previously saved checksum is queried by the network user and compared to the loaded memory checksum, and in the event of inconsistency, execution of the security program in the control software is stopped.

Description

Technical Field

[0001] The present invention relates to a method for operating a control software and an arrangement having a computer system. Background Art

[0002] Currently, common controllers are all based on a hardware platform, a special electronic sub-structure, namely a programmable logic controller (PLC). Recently, when it comes to virtual controllers or software controllers, hardware is also required for their implementation, but the hardware can now be completely abstracted. This means that the implemented Soft-PLC no longer needs to know on which device it is running.

[0003] These devices can still be dedicated control devices, such as multi-functional control platforms or industrial PCs, or can be edge computing platforms that are increasingly seen in the control networks of machine operators and facility operators, or even use cloud computing platforms. The decisive factor is the abstraction of the hardware through containers or hypervisors. For this, the Soft-PLC is "deployed" using standard tools or carefully arranged through tools, without the need for installation like software-based controllers.

[0004] The present invention belongs to the technical field of safety-related controllers, especially controllers in the form of software. Programmable logic controllers must be configured according to the requirements of standard EN 61508 to meet functional safety. In safety-related systems, such as programmable logic controllers for critical processes that include electrical, electronic, or programmable electronic components and whose shutdown poses a significant risk to humans or the environment, they must be configured to provide special guarantees for safety. Examples of applications where safety needs to be improved are as follows: nuclear power plants, scheduling technologies for systems of safety-technical significance, rail applications, telecommunication technologies, signal technologies, and data processing systems, chemical processes, but also small facilities such as stamping machines for blanking sheet metal parts.

[0005] In current safety controllers (such as SIMATIC S7-1511 F), when starting after power-off / on or stop / run, a transition phase must be ensured so that the safety controller starts with the current and valid safety program. Since for a special fault-tolerant PLC as a single device, the manufacturer is responsible for its development and hardware structure, in case of a fault, errors can be detected by correspondingly checking the firmware that can directly access the hardware and thus directly access the load memory.

[0006] Safety controllers have been discussed in EP 2 284 771 B1 and EP 2 241 953 B1. Summary of the Invention

[0007] The present invention relates to a method for operating control software to control a process, wherein the control software runs within a runtime environment on a computer system, and a safety program is loaded in a loading memory for running in the control software.

[0008] The object of the present invention is to ensure that even with a virtual controller, the correct safety program in the control software is run.

[0009] This object is achieved in that a checksum of the program code of the safety program is stored in a network user connected to the computer system via a communication network, wherein during the startup of the control software within the runtime environment, a loading memory checksum is generated from the program code of the safety program stored in the loading memory. In addition, the previously stored checksum is queried by the network user and compared with the loading memory checksum, wherein in case of inconsistency, the execution of the safety program in the control software is stopped.

[0010] In the sense of the present invention, the runtime environment is understood as an implementation environment or a running environment for other programs or applications. Thus, the runtime environment represents a platform for the corresponding program and allows the program to run on the platform, while the runtime environment is created for this platform. Moreover, this can be done anywhere, on any virtual machine.

[0011] After downloading the safety program onto a hardware-independent safety controller (i.e., for example, a virtual machine), a mechanism for saving the checksum to another network user via a communication network is triggered. The runtime environment can be regarded as the classic firmware in the previously used unique hardware, and now it is configured to request the checksum from the connected network user via a communication network. Since the checksum is obtained from a predefined location, possible errors where the current safety program cannot run on the virtual controller can now be avoided.

[0012] In this case, it is crucial that the unit for performing the subsequent comparison of the checksum knows the storage location.

[0013] In addition, in the sense of the present invention, the checksum is understood as a value generated before and after transmission based on the data itself being transmitted. They are used to detect data distortion.

[0014] For maximum flexibility, according to this method, instances are generated by a runtime environment on a computer system or on another computer system, on which control software for controlling processes is respectively run, and a safety program for running in the respective control software is respectively loaded in a loading memory assigned to the respective instance, wherein an operating utility manages the saving of the respective checksum of the respective program code of the respective safety program, wherein, during startup of the respective control software, in the respective instance, the respective checksum is requested by the utility, and in the respective instance, a loading memory checksum is generated by the program code of the respective safety program saved in the associated loading memory and compared with the checksum queried by the utility, wherein, in case of inconsistency, execution of the respective safety program in the respective control software is stopped.

[0015] Advantageously, in the utility, a unique identification number is used to manage the checksums of multiple program codes of the respective safety program for the respective control software.

[0016] The advantage of this is that if multiple safety controller instances are to be saved, in addition to the checksum, a unique ID (such as a serial number) is also saved. Equally important is that the memory of the safety controller and the memory of the utility are independent of each other.

[0017] When a safety controller instance starts up, the saved checksum (optionally including the ID) is queried in the utility. Subsequently, the firmware of the safety controller forms a checksum by the entire safety program in the loading memory and compares it with the returned checksum. Only when they are consistent does the execution of the safety program continue. Otherwise, the execution is stopped.

[0018] For further security, especially if the selected network user is not accessible, it is advantageous if the checksum of the program code of the safety program is copied, a redundant archive is set up, and the checksum (FCC-con) or the checksum copy (FCC'-con) is saved on different network users via a communication network.

[0019] Operating the computer system as a multi-functional control platform, an industrial PC, an edge computing platform or a cloud computing platform further multiplies the flexibility.

[0020] The commissioning personnel or project designers of industrial facilities can now connect to the computer system via an engineering system for downloading the safety program, whereby the checksum of the program code of the safety program can then be saved by the engineering system or by the runtime environment.

[0021] In order to ensure the safety of humans and machines, the control software operates with a safety program, thereby acting as a controller designed for functional safety to control the process, and in order to ensure the process for functional safety requirements by the control software, in the control software, a safety module is operated through the safety program.

[0022] This object is also achieved by an arrangement, which has a computer system, including: a runtime environment, which is designed to run the control software to control the process; a loading memory, which is designed to record the safety program for running in the control software; a network user connected to the computer system via a communication network, which is equipped with a storage area, in which the checksum of the program code of the safety program is stored; a program recognition tool, which is configured to, during the startup of the control software, generate a loading memory checksum through the program code of the safety program stored in the loading memory, query the previously stored checksum in the network user and compare it with the loading memory checksum, and is also configured to output an error signal in case of inconsistency to stop the execution of the safety program in the control software.

[0023] So far, it has only been possible to execute fail-safe programmable logic controllers on dedicated hardware. By introducing this solution, it is possible to ensure the execution of fail-safe PLCs on any networked hardware.

[0024] In order to automate different subtasks or subprocesses, the arrangement includes: a first instance of the runtime environment on the computer system and a second instance of the runtime environment on the computer system or another computer system, which are configured to respectively record the control software for controlling the process, and in which the safety program can also be respectively loaded; it also includes: a first loading memory and a second loading memory, in which the corresponding control software is loaded, wherein the runtime environment or its instance is configured to load the safety program into the control software during startup; it also includes: a utility program, which is configured to manage the saving of the corresponding checksum of the corresponding program code of the corresponding safety program, and is also configured to request the corresponding checksum in the corresponding instance during the startup of the corresponding control software; the corresponding instance is configured to generate a loading memory checksum through the program code of the corresponding safety program stored in the associated loading memory and compare it with the checksum queried through the utility program, and in case of inconsistency, stop the execution of the corresponding safety program in the corresponding control software.

[0025] In this arrangement, the utility program is designed to assign a unique identification number to the corresponding safety program for the corresponding control software during the management of the checksums of multiple program codes.

[0026] If a safety controller instance is to be saved, in addition to the checksum, the unique ID (e.g., serial number) must also be saved. The memory of the safety controller and the memory of the utility that can be used as a storage service must be independent of each other.

[0027] When the instance of the safety controller starts up, the saved checksum (optionally with the ID) is queried in the storage service. Subsequently, the firmware of the safety controller, in other words, the runtime environment forms a checksum by loading the entire safety program in the memory and compares it with the returned checksum. Only if they are consistent, the safety program is executed. Otherwise, the execution is stopped.

[0028] To improve availability, the arrangement also has a redundant archive, and a checksum copy of the checksum of the program code of the safety program can be saved in the redundant archive.

[0029] Advantageously, the computer system is configured as a multi-functional control platform or an industrial PC or an edge computing platform or a cloud computing platform.

[0030] The arrangement also includes an engineering system, which is configured to download the safety program and / or to create instances (A, B) in the computer system.

[0031] Taking into account the fulfillment of functional safety, the control software operates with a safety program, thus serving as a controller designed for the functional safety of the control process, and in order to ensure the process for the functional safety requirements by the control software, a safety module exists in the control software with the safety program.

[0032] Generally, the safety program is transferred to the load memory (e.g., hard disk) through the cache memory. Due to software errors or hardware errors, it may happen that the transfer only occurs in the cache memory, resulting in an old safety program possibly existing in the load memory (e.g., hard disk). However, after power-off / on, the old safety program may be loaded from the hard disk into the cache memory again and executed, and this improper handling is avoided by the present invention. Description of the Drawings

[0033] The drawings illustrate embodiments of the present invention, in which:

[0034] Figure 1 A computer system configured to control the operation of the software is shown,

[0035] Figure 2 A program recognition tool running in the firmware for the control software is shown,

[0036] Figure 3 is shown Figure 1The computer system shown, which has an instance of control software or a firmware instance for the control software, and

[0037] Figure 4 shows the generation and operation of a plurality of safety controller instances supplied through an engineering system. DETAILED DESCRIPTION

[0038] According to Figure 1 , the arrangement 100 includes a computer system 1 having a runtime environment FW and an additional operating system 6, which are both managed in the computer system 1 by a hypervisor 7. The runtime environment FW is configured to run control software Soft-PLC to control a process.

[0039] The load memory 10 is configured to record a safety program F-Prog for running in the control software Soft-PLC. Thus, the runtime environment FW emulates the firmware for a software-based programmable logic controller in the computer system. The control software Soft-PLC is embedded in the runtime environment FW, and a safety program F-Prog configured to run and control the process is embedded in the control software Soft-PLC.

[0040] The computer system 1 is connected to a network user 3 via a communication network 2. The network user 3 is equipped with a storage area 12 in which a checksum FCC-con of the program code of the safety program F-Prog can be stored.

[0041] The runtime environment FW has a program identification tool 11, which is configured to generate a load memory checksum FCC-act from the program code of the safety program F-Prog stored in the load memory 10 during startup of the control software Soft-PLC. In addition, the program identification tool 11 is configured to query the previously stored checksum FCC-con in the network user 3 and compare it with the load memory checksum FCC-act. If the comparison result is inconsistent, the program identification tool 11 is also configured to output an error signal 20, which stops the execution of the safety program F-Prog in the control software Soft-PLC.

[0042] Normally, the safety program is transferred to the load memory (e.g., hard disk) through a cache memory. Due to software errors or hardware errors, the transfer may only occur in the cache memory, resulting in an old safety program possibly existing in the load memory 10 (e.g., hard disk). Without the program identification tool 11 according to the present invention and without saving to another network user, it may not be possible to expose the error caused by the old program still being in the load memory 10 and thus having been loaded into the cache memory during startup.

[0043] Generally speaking, it can be said that after downloading the safety program F-Prog to a hardware-independent safety controller, the mechanism for saving the checksum to other network users 3 via network communication is directly triggered either through the engineering system or through the runtime environment FW configured as firmware. If the software, i.e., the runtime environment FW including the control software Soft-PLC, is subsequently started, the saved checksum is queried, and then the runtime environment FW forms a checksum by loading the entire safety program F-Prog in the memory and compares it with the returned checksum. Only when they are consistent does the execution of the safety program continue; otherwise, the execution is stopped.

[0044] With Figure 2 , it is elaborated in detail the program recognition tool 11 introduced through Figure 1 . During program startup or, for example, after power-off / on, the program recognition tool 11 loads the safety program F-Prog from the load memory 10 and forms a load memory checksum FCC-act through the entire program code of the safety program F-Prog. In addition, the program recognition tool 11 is configured to obtain the checksum FCC-con from the storage area 12 of other network users 3. Now, there are the current checksum and the configured checksum in the program recognition tool 11 for comparison. If the comparison result is positive, the process continues through the "Yes" branch Y. If the comparison result is negative, an error signal 20 is generated through the "No" branch N. The error signal 20 is used to stop the startup of the safety facility or the safety program F-Prog.

[0045] According to Figure 3 , an embodiment of the computer system 1 with formed program instances is shown. In the computer system 1, a first instance A of the runtime environment FW and a second instance B of the runtime environment FW have been installed or implemented through the engineering system 5 (see Figure 4 ). Instances A and B are configured to record the control software Soft-PLC-A and Soft-PLC-B for the control process respectively. In instances A and B, or rather in the control software Soft-PLC-A to Soft-PLC-B, safety programs F-Prog-A and F-Prog-B are respectively loaded. For this purpose, the computer system 1 has a first load memory 10A and a second load memory 10B, in which the corresponding control software Soft-PLC-A and Soft-PLC-B are loaded.

[0046] The runtime environment FW, or rather its first instance A and its second instance B, as shown through Figure 2 , each instance is respectively equipped with a program recognition tool 11.

[0047] There is a current utility FCC-Serv which is configured to manage the saving of the respective check sums FCC-con-A, FCC-con-B of the respective program codes of the respective security programs F-Prog-A, F-Prog-B. In this case, the utility FCC-Serv or the program recognition tool 11 can take over the check task. In any case, during the start-up of the respective control software Soft-PLC-A, Soft-PLC-B, the respective check sums FCC-con-A, FCC-con-B are queried in the respective instances.

[0048] Similar to the behavior according to Figure 1 , the respective instances A, B are configured to generate load memory check sums FCC-act-A, FCC-act-B by means of the program codes of the respective security programs F-Prog-A, F-Prog-B saved in the associated load memories 10A, 10B. Now, the utility FCC-serv can compare the queried check sums FCC-con-A, FCC-con-B with the current check sums FCC-act-A, FCC-act-B, however, the comparison can also be carried out in the program recognition tool 11.

[0049] When the utility FCC-serv manages multiple instances and check sums, it is recommended to assign an identification number ID to each instance.

[0050] In order to ensure possible redundancy in the event of a possible malfunction of the network user 3, a redundant archive 13 is completed in any other network user. A check sum copy FCC'-con of the check sum FCC-con of the program code of the security program F-Prog is saved to this redundant archive 13 and can be queried.

[0051] By Figure 4, illustrates how instances can be generated and programs downloaded by the engineering system 5. For example, the engineering system 5 generates a first instance A, a second instance B, and an Xth instance X. The engineering system 5 loads the security program F-Prog-A into the first instance A through download 30, loads the second security program F-Prog-B into the second instance B through download 31, and so on, until the Xth program is loaded into the Xth instance X through download 32. Now, each instance A, B, X is assigned a unique identification number ID. The utility program FCC-Serv (which can also be installed as any application) is also connected to network users 3, another network user 4, and yet another network user 4'. The corresponding checksums are saved on these network users. For example, if the first instance A wishes to start its security program, it requests the checksum in the utility program FCC-Serv by querying 40 the checksum of instance A. The utility program FCC-Serv back-transmits 41 the checksum to the first instance A, which can then perform a comparison regarding the checksum consistency.

[0052] The second instance B similarly queries 43 the checksum of instance B, makes a query in the utility program FCC-Serv through a query instruction, and receives a return value 42 with a matching checksum. Moreover, the Xth instance X also requests a matching checksum by querying 44 the checksum and receives a reply 45.

Claims

1. A method for operating control software (Soft-PLC) to control a process, wherein: The control software (Soft-PLC) is run in a runtime environment (FW) on the computer system (1), and The safety program (F-Prog) is loaded into the load memory (10) for execution in the control software (Soft-PLC). The invention is characterized in that a checksum (FCC-con) of the program code of the safety program (F-Prog) is stored in a network node (3) connected to the computer system (1) via a communication network (2), wherein the control software (Soft-PLC) generates a load memory checksum (FCC-act) during startup in the runtime environment (FW) from the program code of the safety program (F-Prog) stored in the load memory (10), Furthermore, the previously saved checksum (FCC-con) is queried by the network user (3) and compared with the load memory checksum (FCC-act), wherein in the event of a mismatch, the execution of the safety program (F-Prog) in the control software (Soft-PLC) is stopped.

2. The method according to claim 1, wherein: An instance (A, B) is generated by the runtime environment (FW) on the computer system (1) or another computer system (1'), on which control software (Soft-PLC-A, Soft-PLC-B) for controlling a process is respectively executed, and a safety program (F-Prog-A, F-Prog-B) is respectively loaded into a load memory (10A, 10B) assigned to the corresponding instance (A, B) for being executed in the corresponding control software (Soft-PLC-A, Soft-PLC-B), wherein an operating utility (FCC-Serv) is provided, said utility managing the saving of a respective checksum (FCC-con-A, FCC-con-B) of a respective program code of a respective said safety program (F-Prog-A, F-Prog-B), wherein during startup of the respective said control software (Soft-PLC-A, Soft-PLC-B), in the respective said instance (A, B), the respective said checksum (FCC-con-A, FCC-con-B) is requested by said utility (FCC-Serv) and in the respective said instance (A, B), the respective said checksum (FCC-con-A, FCC-con-B) is saved by said utility (FCC-Serv). A load memory checksum (FCC-act-A, FCC-act-B) is generated for the program code of the corresponding safety program (F-Prog-A, F-Prog-B) in the associated load memory (10A, 10B) and compared with the checksum (FCC-con-A, FCC-con-B) queried by the utility program (FCC-Serv), wherein, in the event of inconsistency, execution of the corresponding safety program (F-Prog-A, F-Prog-B) in the corresponding control software (Soft-PLC-A, Soft-PLC-B) is stopped.

3. The method according to claim 2, wherein: In the utility program (FCC-Serv), a unique identification number (ID) is used for the respective control software (Soft-PLC-A, Soft-PLC-B) when managing the checksums (FCC-con-A, FCC-con-B) of a plurality of program codes of the respective safety program (F-Prog-A, F-Prog-B).

4. The method according to any one of claims 1 to 3, wherein: A checksum (FCC-con) of the program code of the safety program (F-Prog) is copied and a redundant archive is set up and the checksum (FCC-con) or a checksum copy (FCC'-con) is saved to different network users (3, 4) via the communication network (2).

5. The method according to any one of claims 1 to 4, wherein: The computer system (1) is operated as a multifunctional control platform or as an industrial PC or as an edge computing platform or as a cloud computing platform.

6. The method according to any one of claims 1 to 5, wherein: An engineering system (5) for downloading the safety program (F-Prog) is connected to the computer system (1), and a checksum (FCC-con) of the program code of the safety program (F-Prog) is saved by the engineering system (5) or by the runtime environment (FW).

7. The method according to any one of claims 1 to 6, wherein: The control software (Soft-PLC) operates with the safety program (F-Prog) to control a process as a controller designed for functional safety, and in order to ensure the processes required by the control software (Soft-PLC) for the functional safety, a safety module is operated in the control software (Soft-PLC) with the safety program (F-Prog).

8. An arrangement (100) comprising: - a computer system (1), comprising a runtime environment (FW) configured to run a control software (Soft-PLC) for controlling a process, a load memory (10) configured to record a safety program (F-Prog) for running in the control software (Soft-PLC), a network user (3) which is connected to the computer system (1) via a communication network (2) and is provided with a memory area (12) in which a checksum (FCC-con) of the program code of the safety program (F-Prog) is stored, - a program identification tool (11), which is configured to generate a load memory checksum (FCC-act) from the program code of the safety program (F-Prog) stored in the load memory (10) during the startup of the control software (Soft-PLC), query the checksum (FCC-con) previously stored in the network user (3) and compare the checksum with the load memory checksum (FCC-act); the program identification tool is also configured to output an error signal in the event of inconsistency to stop the safety program (F-Prog) executed in the control software (Soft-PLC).

9. The arrangement (100) according to claim 8, comprising: a first instance (A) of the runtime environment (FW) on the computer system (1) and a second instance (B) of the runtime environment (FW) on the computer system (1) or on another computer system, - The examples (A, B) are configured to record control software (Soft-PLC-A, Soft-PLC-B) for controlling a process, into which safety programs (F-Prog-A, F-Prog-B) can be loaded, respectively, and the arrangement also has: - a first loading memory (10A) and a second loading memory (10B), wherein the corresponding control software (Soft-PLC-A, Soft-PLC-B) is loaded into the first loading memory and the second loading memory, wherein: The runtime environment (FW) or the instance (A, B) of the runtime environment is configured to load the safety program (F-Prog-A, F-Prog-B) into the control software (Soft-PLC-A, Soft-PLC-B) during startup, the arrangement further comprising: - Utility (FCC-Serv), the utility being configured to manage the saving of a respective checksum (FCC-con-A, FCC-con-B) of a respective program code of a respective said safety program (F-Prog-A, F-Prog-B); said utility being further configured to request the respective checksum (FCC-con-A, FCC-con-B) in a respective said instance (A, B) during startup of the respective said control software (Soft-PLC-A, Soft-PLC-B), - The respective instance (A, B) is configured to generate a load memory checksum (FCC-act-A, FCC-act-B) from the program code of the respective safety program (F-Prog-A, F-Prog-B) stored in the associated load memory (10A, 10B), and compare the load memory checksum with the checksum (FCC-con-A, FCC-con-B) queried by the utility program (FCC-Serv), wherein, in the event of inconsistency, execution of the respective safety program (F-Prog-A, F-Prog-B) in the respective control software (Soft-PLC-A, Soft-PLC-B) is stopped.

10. The arrangement (100) according to claim 9, wherein The utility program (FCC-Serv) is designed to assign a unique identification number (ID) to the respective safety program (F-Prog-A, F-Prog-B) for the respective control software (Soft-PLC-A, Soft-PLC-B) during management of checksums of a plurality of program codes (FCC-con-A, FCC-con-B).

11. The arrangement (100) according to any one of claims 8 to 10, further comprising a redundancy archive (13), in which a checksum copy (FCC'-con) of a checksum (FCC-con) of a program code of the safety program (F-Prog) can be stored.

12. The arrangement (100) according to any one of claims 8 to 11, wherein The computer system (1) is designed as a multifunctional control platform or an industrial PC or an edge computing platform or a cloud computing platform.

13. The arrangement (100) according to any one of claims 8 to 12, further comprising an engineering system (5) which is configured for downloading the safety program (F-Prog) and / or for creating the instance (A, B).

14. The arrangement (100) according to any one of claims 8 to 13, wherein: The control software (Soft-PLC) is designed with the safety program (F-Prog) so as to control a process as a controller designed for functional safety, and in order to ensure the processes required by the control software (Soft-PLC) for the functional safety, a safety module is present in the control software (Soft-PLC) with the safety program (F-Prog).

Images