PLC online upgrading method, system and equipment

Abstract

The invention relates to a PLC online upgrading method, system and device based on an industrial operating system and a virtualization technology. The method comprises the steps that an upgrading agent obtains a to-be-upgraded target mirror image file; the upgrading agent requests the virtual machine management module to create a new virtual machine instance, and the new virtual machine instance corresponds to the real-time domain to be upgraded; the virtual machine management module creates and starts a new virtual machine instance in a memory based on the target mirror image file; synchronizing the key running state data of the currently running old virtual machine instance to the new virtual machine instance; and the virtual machine management module executes atomic context switching processing to switch the control right from the old virtual machine instance to the new virtual machine instance, so that the new virtual machine instance takes over the PLC control task. Thus, on the premise that the real-time control task of the PLC is not interrupted, the upgrading task is completed, shutdown operation needed by traditional upgrading is avoided, and continuous operation of a production line is guaranteed.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial control, and particularly relates to a PLC online upgrading method, system and equipment based on an industrial operating system and virtualization technology. BACKGROUND

[0002] As the core equipment of industrial automation control systems, programmable logic controllers (PLC) are widely used in manufacturing, energy, rail transportation and other fields. With the development of intelligent manufacturing and industrial internet, the demand for remote maintenance, function iteration and security reinforcement of PLC systems is increasingly urgent, and an efficient and reliable over-the-air (OTA) mechanism is urgently needed.

[0003] However, the traditional PLC upgrading method has significant drawbacks. First, the upgrading process usually requires technicians to go to the site, connect the device through a physical interface (such as an Ethernet port, a serial port), and forcibly stop the operation of the PLC to load new firmware or control programs. This downtime operation directly leads to the interruption of the production line, which will cause huge economic losses for high-continuity production scenarios (such as automobile assembly, semiconductor manufacturing). Second, for PLC devices deployed in remote areas, high altitudes, underground or dangerous environments, on-site upgrading not only consumes time and effort, but also has high operation and maintenance costs. Third, if power failure, communication interruption or data transmission error occurs during the upgrading process, it is easy to cause system damage or "brick", making recovery difficult and further amplifying the upgrading risk. In addition, in the face of large-scale distributed deployment of PLC networks, the traditional method is difficult to implement unified version management and batch upgrading strategy, which is easy to cause version fragmentation and increase system maintenance complexity.

[0004] To address the above problems, the industry has tried to introduce OTA upgrading solutions for general embedded devices, but existing industrial OTA technologies still have obvious limitations. Most solutions follow the upgrading architecture of consumer or general Internet of Things devices, without fully considering the stringent requirements of real-time, determinism and high reliability in industrial control scenarios. For example, during the upgrading process, the device often needs to restart or suspend critical services, causing control function interruption, which cannot meet the production requirements of 7x24 hours uninterrupted operation.

[0005] Moreover, with the popularity of virtualization technology in industrial edge computing, new virtual PLCs generally adopt a heterogeneous architecture of "real-time domain + non-real-time domain", such as based on Intewell and other hard real-time operating systems, separating and deploying high-deterministic control tasks and non-real-time tasks such as HMI, communication and data analysis. However, existing OTA solutions lack a special upgrading mechanism for such virtualization environments, and cannot perform online updates on different virtual domains without interfering with real-time control tasks. SUMMARY

[0006] In view of the above problems of the prior art, the present application provides a PLC online upgrading method, system and device based on an industrial operating system and virtualization technology, which completes the upgrading task without interrupting the real-time control task of the PLC.

[0007] To achieve the above object, the first aspect of the present application provides a PLC online upgrading method based on an industrial operating system and virtualization technology, wherein the industrial operating system comprises a virtual machine management module, a real-time domain and a non-real-time domain managed by the virtual machine management module, the real-time domain is used to run PLC control logic, and the non-real-time domain is deployed with an upgrading agent, and the method comprises the following steps: The upgrading agent acquires a target image file to be upgraded; The upgrading agent requests the virtual machine management module to create a new virtual machine instance, wherein the new virtual machine instance corresponds to the real-time domain to be upgraded; The virtual machine management module creates and starts the new virtual machine instance in the memory based on the target image file; The key running state data of the currently running old virtual machine instance is synchronized to the new virtual machine instance; The virtual machine management module performs atomic context switching processing to switch the control right from the old virtual machine instance to the new virtual machine instance, so that the new virtual machine instance takes over the PLC control task.

[0008] Thus, in the present application, after the upgrading agent acquires the target image file in the non-real-time domain, the virtual machine management module creates and starts a new virtual machine instance corresponding to the target domain (real-time domain or non-real-time domain) in the memory in parallel, while the old instance continues to run during this period, ensuring that the control task is not interrupted; then, the key running state data is synchronized from the old virtual machine instance to the new virtual machine instance, so that it has the ability to continue to execute; finally, the virtual machine management module performs atomic context switching to seamlessly transfer the control right to the new virtual machine instance within microseconds, realizing smooth takeover of the control logic. Thus, the upgrading task is completed without interrupting the real-time control task of the PLC, avoiding the shutdown operation required by traditional upgrading and ensuring continuous operation of the production line. At the same time, the upgrading process does not need to rely on manual on-site intervention, but is automatically completed by the system; the upgrading task of a large number of devices can also be configured with unified strategies, batched and issued, and monitored through a cloud management platform, so as to realize highly automated and centralized management of the upgrading process. At the same time, the present application can also use the same method to upgrade the application programs in the non-real-time domain and the non-real-time domain.

[0009] Also, the application takes full advantage of the virtualization capability of the industrial operation system, supports independent upgrade of a single virtual machine in the real-time domain, the non-real-time domain, etc., and also supports joint update of the entire system, so as to realize fine and differentiated upgrade strategies, avoid redundant operations caused by one-size-fits-all whole-machine upgrade, and improve the flexibility of upgrade.

[0010] As a possible implementation manner of the first aspect, the new virtual machine instance initializes its I / O driver to an inactivated state in a starting process, and enables I / O control after completion of the context switching.

[0011] In this way, concurrent access conflicts of the new and old virtual machine instances to the physical I / O device are effectively prevented, and the exclusivity and safety of the control right handover are ensured.

[0012] As a possible implementation manner of the first aspect, the performing the atomic context switching process comprises: revoking the access right of the old virtual machine instance to the I / O device, instantaneously granting the control right of the physical I / O to the new virtual machine instance, and redirecting the interrupt routing table and the event distribution channel to the new virtual machine instance.

[0013] In this way, since the atomic context switching process can be completed in a very short time of microseconds, instantaneous and exclusive handover of the control right is realized, and the real-time and continuity of the PLC task in the upgrade process are ensured.

[0014] As a possible implementation manner of the first aspect, the method further comprises: The upgrade agent performs digital signature verification and / or integrity check on the obtained target image file.

[0015] In this way, the above security mechanism can effectively prevent unauthorized or tampered target image files from being loaded into the PLC system, and eliminate upgrade failures caused by malicious code injection, man-in-the-middle attacks or transmission damage from the source, thereby improving the security and reliability of the online upgrade process to a certain extent.

[0016] As a possible implementation manner of the first aspect, the system resources allocated to the new virtual machine instance are independent and isolated from the system resources used by the old virtual machine, so that the new virtual machine instance and the old virtual machine instance can run in parallel.

[0017] Therefore, the new virtual machine instance and the old virtual machine instance do not interfere with each other during the upgrading process, because the new virtual machine instance and the old virtual machine instance run in resource spaces strictly isolated by the virtual machine management module. The old virtual machine instance can continuously and stably run the PLC real-time control task without being affected by loading, initialization or potential exceptions of the new virtual machine instance, and the new virtual machine instance can safely complete startup and state preparation in the isolated environment. The mechanism effectively guarantees continuity and determinacy of the control logic during the upgrading, and also provides a reliable running basis for subsequent atomic context switching and rollback operations.

[0018] As a possible implementation manner of the first aspect, after the atomic context switching processing is performed, the method further includes: the old virtual machine instance is reserved in the memory as a hot backup; a preset observation period is started, and a running state of the new virtual machine instance is monitored; if an exception is detected within the preset observation period, a rollback operation is performed; if no exception is detected within the preset observation period, resources of the old virtual machine instance are released.

[0019] In this way, by reserving the old virtual machine instance in the memory as a hot backup, the system still has a complete and immediately recoverable running environment after switching. Once the new virtual machine instance has an exception due to compatibility problems, logic errors or failure to meet real-time requirements, the system can seamlessly switch back to the old version within milliseconds, ensuring continuous and stable running of the PLC control task and reducing the impact of online upgrading on industrial production. At the same time, the old virtual machine instance only occupies memory and a small amount of scheduling resources for a preset short observation period, and the system automatically releases the resources occupied by the old virtual machine instance after confirming that the new virtual machine instance runs stably, thereby avoiding long-term redundant overhead and effectively optimizing the utilization efficiency of the memory, especially in the resource-constrained embedded industrial controller scenario.

[0020] As a possible implementation manner of the first aspect, the running state of the new virtual machine instance is monitored, and monitored indexes include at least one of the following: whether a watchdog timer is refreshed on time, whether a key task is completed within a specified real-time period, whether CPU load is normal, and whether a serious error or exception is thrown.

[0021] In this way, by comprehensively monitoring the above key indexes, the health status of the system after upgrading can be objectively and timely evaluated, a reliable decision basis is provided for automatic rollback under the premise of ensuring correctness and real-time of the control logic, and implicit faults introduced by upgrading are effectively prevented from causing production line downtime or equipment out of control, thereby significantly improving the engineering practicability, safety and intelligent level of the online upgrading scheme.

[0022] As a possible implementation manner of the first aspect, the manner in which the critical running state data is synchronized to the new virtual machine instance comprises: The synchronization is implemented by a shared memory region or a low-latency inter-process communication mechanism provided by the virtual machine management module.

[0023] In this way, the critical running state data is synchronized in the above manner, so that the state migration between the old and new virtual machine instances can be completed with microsecond-level latency, high reliability and strong consistency, atomic context switching is ensured to be successfully performed, the seamless continuation of the PLC control task is effectively supported, and the real-time performance and reliability of the online upgrade process are significantly improved.

[0024] To achieve the above object, the second aspect of the present application provides a PLC online upgrade system based on an industrial operating system and virtualization technology, comprising: a cloud management platform configured to generate a target image file, digitally sign and encrypt the target image file, and then deliver the target image file to a non-real-time domain through a secure network channel; The industrial operating system comprises a virtual machine management module, a real-time domain and a non-real-time domain managed by the virtual machine management module, the real-time domain is configured to run PLC control logic, and the non-real-time domain is configured to deploy an upgrade agent; The upgrade agent is configured to receive and verify the target image file, and after verification, request the virtual machine management module to create a new virtual machine instance, the new virtual machine instance corresponding to a target domain to be upgraded, the target domain being the real-time domain or the non-real-time domain. The virtual machine management module is configured to create and start the new virtual machine instance in memory based on the target image file, and synchronize critical running state data of an old virtual machine instance currently running to the new virtual machine instance; the virtual machine management module performs atomic context switching processing to switch control from the old virtual machine instance to the new virtual machine instance, so that the new virtual machine instance takes over the PLC control task.

[0025] To achieve the above object, the third aspect of the present application provides a computing device, comprising: a processor, and a memory having program instructions stored thereon, the program instructions causing the processor to execute the method of any one of the first aspect when executed by the processor.

[0026] To achieve the above object, the fourth aspect of the present application provides a computer-readable storage medium having program instructions stored thereon, the program instructions causing the computer to implement the method of any one of the first aspect when executed by the computer. BRIEF DESCRIPTION OF DRAWINGS

[0027] Figure 1is a structural block diagram of an industrial operating system provided by the present application; Figure 2 is a main step flow chart of a PLC online upgrade method based on an industrial operating system and virtualization technology provided by the present application; Figure 3 is a flow schematic diagram of an embodiment provided by the present application; Figure 4 is a state transition diagram of atomic context switching processing and rollback operation provided by the present application; Figure 5 is a structural schematic diagram of a PLC online upgrade system based on an industrial operating system and virtualization technology provided by the present application; Figure 6 is a structural schematic diagram of a computing device provided by the present application.

[0028] It should be understood that in the above structural schematic diagram, the size and shape of each block diagram are only for reference and should not constitute an exclusive interpretation of the embodiments of the present application. The relative position and inclusion relationship between each block diagram presented by the structural schematic diagram are only used to represent the structural association between each block diagram, and not to limit the physical connection mode of the embodiments of the present application. DETAILED DESCRIPTION

[0029] The technical solutions provided by the present application will be further described below in combination with the drawings and embodiments. It should be understood that the system structure and business scenarios provided in the embodiments of the present application are mainly used to illustrate possible implementation modes of the technical solutions of the present application, and should not be interpreted as the only limitation of the technical solutions of the present application. Those skilled in the art can know that the technical solutions provided by the present application are also applicable to similar technical problems as the system structure evolves and new business scenarios appear.

[0030] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs. If there is any inconsistency, the meaning explained in the specification or derived from the content described in the specification shall prevail. In addition, the terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0031] Before introducing the embodiments of the present application, the following contents are introduced: 1) Intewell is an industrial real-time operating system for industrial automation and mission-critical control field, which adopts micro-kernel architecture design and has high reliability, strong real-time and deterministic scheduling capability. Its most prominent technical feature is the native support of hard real-time virtualization technology, which can run multiple heterogeneous operating system instances simultaneously, in parallel and isolated on a single general-purpose hardware platform (such as multi-core x86 or ARM processor). Each instance is strictly isolated in terms of time, memory, interrupts and I / O resources, and does not interfere with each other.

[0032] 2) Relationship between PLC and industrial operating system, virtual machine management module, real-time domain and non-real-time domain: In this application, an industrial operating system (such as Intewell) can be run on the PLC, and a virtual machine management module runs in the industrial operating system. The virtual machine management module can be used to create / destroy real-time domains and non-real-time domains (i.e. virtual machines), allocate hardware resources for real-time domains and non-real-time domains, realize domain isolation and communication, and perform atomic context switching to support online upgrade of PLC.

[0033] The real-time domain is a running container for PLC control logic, which can deploy real-time operating system (RTOS) and run PLC control logic, etc. The running PLC control logic includes, for example: cyclic scanning logic of programmable logic controller (PLC), high-speed I / O processing, motion control algorithm (such as robot trajectory planning), safety interlocking logic, etc.

[0034] The non-real-time domain is a running container for management and communication functions, which can deploy general Linux and run function modules that do not have strict requirements for real-time performance but require rich software ecosystem support, such as: human-machine interface (HMI), web server, OPCUA communication service, MQTT data upload, edge data analysis, remote diagnosis tool, and running upgrade agent, etc., which do not participate in real-time control.

[0035] 3) Atomic context switching operation: In this application, it refers to the operation of completely "freezing" all running contexts of a virtual machine (old instance) in one non-interruptable and time-determined operation, and instantly and consistently transferring system control (including CPU, memory, I / O, interrupts, etc.) to another virtual machine (new instance), ensuring that the switching process appears to the external control system as instantaneous and conflict-free.

[0036] The embodiment of the present application provides a PLC online upgrading method based on an industrial operating system and a virtualization technology, wherein the industrial operating system comprises a virtual machine management module, a real-time domain and a non-real-time domain managed by the virtual machine management module, the real-time domain is used for running PLC control logic, and an upgrading agent is deployed in the non-real-time domain. Figure 2 As shown in the figure, the method comprises the following steps. S201, the upgrading agent acquires a target image file to be upgraded. Wherein, when upgrading the real-time domain or PLC related content on the real-time domain, such as PLC control logic and PLC runtime system, the target image file comprises but is not limited to: a PLC runtime system image for updating the real-time domain, an operating system image for updating the real-time domain, and PLC control logic.

[0037] S202, the upgrading agent requests the virtual machine management module to create a new virtual machine instance, wherein the new virtual machine instance corresponds to the real-time domain to be upgraded. S203, the virtual machine management module creates and starts the new virtual machine instance in the memory based on the target image file. S204, synchronizing the key running state data of the currently running old virtual machine instance to the new virtual machine instance. And in this step S204, the key running state data of the old virtual machine instance is synchronized to the new virtual machine instance, so that the new virtual machine instance does not start running from the initial state after completing the initialization, but continues to execute the PLC control logic immediately based on the latest running state of the old virtual machine instance, and realizes smooth succession. This mechanism ensures the continuity of the control task behavior and the timing consistency in the upgrading process.

[0038] S205, the virtual machine management module performs atomic context switching processing to switch the control right from the old virtual machine instance to the new virtual machine instance, so that the new virtual machine instance takes over the PLC control task.

[0039] The non-real-time domain can also be upgraded by the same method of the present application. When upgrading the non-real-time domain, the target image file comprises but is not limited to: an operating system image for updating the non-real-time domain and an application package or a container image which can be independently deployed.

[0040] Thus, in the present application, after the target image file is obtained in the non-real-time domain, the upgrade agent creates and starts a new virtual machine instance corresponding to the target domain (real-time domain or non-real-time domain) in memory in parallel by the virtual machine management module, while the old instance continues to run during this period, ensuring that the control task is not interrupted; then, the key running state data is synchronized from the old virtual machine instance to the new virtual machine instance, so that it has the ability to continue to execute; finally, the virtual machine management module performs an atomic context switch, seamlessly transferring control to the new virtual machine instance within microseconds, realizing smooth takeover of the control logic. Thus, under the premise of not interrupting the PLC real-time control task, the upgrade task is completed, avoiding the shutdown operation required by traditional upgrades, and ensuring continuous operation of the production line. At the same time, the upgrade process does not require manual on-site intervention, but is automatically completed by the system; a large number of device upgrade tasks can also be configured, issued in batches, and monitored through a cloud management platform, thereby realizing highly automated and centralized management of the upgrade process.

[0041] Furthermore, the present application makes full use of the virtualization capabilities of the industrial operating system, supports independent upgrade of individual virtual machines such as real-time domains and non-real-time domains, and can also perform joint updates on the entire system, realizing fine differentiated upgrade strategies and avoiding redundant operations caused by one-size-fits-all machine upgrades, and also improving the flexibility of upgrades.

[0042] It is worth mentioning that, instead of simply replacing programs at the application layer, the hard real-time virtualization capabilities provided by the Intewell operating system are fully utilized, including the strong isolation multi-domain architecture supported by the virtual machine management module, to sink the entire upgrade process from the traditional application layer to the system kernel layer for unified scheduling and execution. Thus, the upgrade process can strictly guarantee the real-time and continuity of the PLC control task, realizing deep adaptation to the requirements of high availability, high reliability, and functional safety in industrial automation scenarios, and forming a system-level innovative solution that meets the essential needs of industrial control.

[0043] In some embodiments, the new virtual machine instance initializes its I / O driver to an inactive state during the startup process, and enables I / O control after the context switch is completed.

[0044] Thus, concurrent access conflicts of the new and old virtual machine instances to the physical I / O device are effectively prevented, ensuring the exclusivity and security of the control handover.

[0045] In some embodiments, the execution of the atomic context switch process includes: revoking the access rights of the old virtual machine instance to the I / O device, instantaneously granting control of the physical I / O to the new virtual machine instance, and redirecting the interrupt routing table and event distribution channel to the new virtual machine instance.

[0046] Thus, since the atomic context switching process can be completed in a very short time of microseconds, the instantaneous and exclusive handover of control right is achieved, and the real-time and continuity of the PLC task during the upgrading process are guaranteed.

[0047] In some embodiments, further comprising: The upgrading agent performs digital signature verification and / or integrity check on the acquired target image file.

[0048] Specifically, the digital signature verification ensures that the target image file indeed comes from a legitimate publisher (such as a vendor server), preventing forgery by malicious third parties; at the same time, the upgrading agent can use a hash check (such as SHA-256) to ensure that the target image file has not been tampered with or damaged during transmission or storage, ensuring the integrity and consistency of its content.

[0049] Thus, the above security mechanism can effectively prevent unauthorized or tampered target image files from being loaded into the PLC system, eliminating upgrade failures caused by malicious code injection, man-in-the-middle attacks, or transmission damage from the source, and to some extent improving the security and reliability of the online upgrading process.

[0050] In some embodiments, the system resources allocated to the new virtual machine instance are independent and isolated from the system resources used by the old virtual machine, allowing the new virtual machine instance and the old virtual machine instance to run in parallel.

[0051] Thus, since the new virtual machine instance and the old virtual machine instance run in resource spaces strictly isolated by the virtual machine management module, during the upgrading process, the new virtual machine instance and the old virtual machine instance do not interfere with each other. The old virtual machine instance can continue to run the PLC real-time control task stably without being affected by the loading, initialization or potential exceptions of the new virtual machine instance; the new virtual machine instance completes the startup and state preparation in a safe isolated environment. This mechanism effectively guarantees the continuity and determinacy of the control logic during the upgrading process, and also provides a reliable running basis for subsequent atomic context switching and rollback operations.

[0052] In some embodiments, after the execution of the atomic context switching process, further comprising: The old virtual machine instance is retained in memory as a hot backup; Starting a preset observation period to monitor the running state of the new virtual machine instance; If an exception is detected within the preset observation period, a rollback operation is performed; If no exception is detected within the preset observation period, the resources of the old virtual machine instance are released.

[0053] Notably, the rollback operation can be understood as a recovery mechanism triggered automatically by the system when detecting that the new virtual machine instance is running abnormally or fails to pass the preset observation period, i.e., the virtual machine management module re-switches the control right back to the old virtual machine instance still retained in the memory, so that the old virtual machine instance immediately resumes the takeover of the PLC control task, thereby ensuring that the industrial control logic is uninterrupted, the device state is not lost, and the production process is not disturbed.

[0054] In this way, by retaining the old virtual machine instance in the memory as a hot backup, the system still has a complete and immediately recoverable running environment after the switching. Once the new virtual machine instance appears abnormal due to compatibility problems, logic errors, or real-time performance not meeting the standards, etc., it can be seamlessly switched back to the old version within milliseconds, ensuring the continuous and stable operation of the PLC control task and reducing the impact of online upgrading on industrial production. At the same time, the old virtual machine instance only occupies the memory and a small amount of scheduling resources for a preset short observation period. After confirming that the new virtual machine instance is running stably, the system automatically releases the resources occupied by the old virtual machine instance, avoiding long-term redundant overhead, effectively optimizing the utilization efficiency of the memory, and being particularly suitable for resource-constrained embedded industrial controller scenarios.

[0055] In some embodiments, the monitoring of the running state of the new virtual machine instance includes at least one of the following: whether the watchdog timer is refreshed on time, whether the key task is completed within the specified real-time period, whether the CPU load is normal, and whether there are serious errors or exceptions thrown.

[0056] In this way, by comprehensively monitoring the above-mentioned key indicators, the health status of the system after upgrading can be objectively and timely evaluated, providing a reliable decision basis for automatic rollback under the premise of ensuring the correctness and real-time performance of the control logic, effectively preventing the production line from being shut down or the device from being out of control due to hidden faults introduced by upgrading, and significantly improving the engineering practicability, safety, and intelligent level of the online upgrading scheme.

[0057] In some embodiments, the way of synchronizing the key running state data to the new virtual machine instance includes: The synchronization is achieved through a shared memory area or a low-latency inter-process communication mechanism provided by the virtual machine management module.

[0058] In this way, by synchronizing the key running state data in the above-mentioned manner, the state migration between the new and old virtual machine instances can be completed with microsecond-level delay, high reliability, and strong consistency, ensuring the smooth execution of atomic context switching and effectively supporting the seamless continuation of the PLC control task, thereby significantly improving the real-time performance and reliability of the online upgrading process.

[0059] In order to more clearly illustrate the above-mentioned PLC online upgrading method based on an industrial operating system and virtualization technology, the present application provides the following specific embodiments.

[0060] First embodiment: Take the example of fixing a security vulnerability in the non-real-time domain (running Linux operating system) of a certain type of virtual PLC.

[0061] The following process is combined with Figure 3 and Figure 4 .

[0062] Step 1: The cloud management platform detects a security vulnerability in the Linux domain of a certain type of virtual PLC through regular security scanning. In order to fix the vulnerability, the cloud management platform automatically or manually generates a Linux image file containing the necessary security patches.

[0063] Step 2: The cloud management platform digitally signs and encrypts the Linux image file, and pushes it to the upgrade agent of the target virtual PLC's non-real-time domain through a secure network channel (such as HTTPS, VPN).

[0064] Step 3: The upgrade agent verifies the received Linux image file. The verification process includes verifying whether the digital signature of the image file is valid, and whether the Linux image file has been tampered with during transmission.

[0065] Step 4: After the upgrade agent verifies that the Linux image file is passed, it calls the special management interface provided by the virtual machine management module (Hypervisor) and issues a "create new Linux instance" request.

[0066] Step 5: After the Hypervisor receives the request, it allocates independent and isolated address space in physical memory for the new Linux instance and reserves specified CPU core resources for it. Then, the Hypervisor loads the Linux image file and starts the new Linux instance. In this process, the old Linux instance continues to run normally.

[0067] Step 6: After the new Linux instance is successfully started, the old Linux instance copies the current key running state to the new Linux instance for synchronization.

[0068] Step 7: After the state synchronization is completed, the Hypervisor performs an atomic context switch operation in the next scheduling period to switch control from the old instance to the new instance.

[0069] Step 8: After the switch is completed, the old Linux instance is frozen and remains in memory as a rollback backup.

[0070] Step 9: The upgrade agent starts an observation timer to closely monitor the running state of the new instance.

[0071] Specifically, if the new Linux instance runs stably and no abnormality occurs within the preset observation period, it is determined that the upgrade is successful. The hypervisor releases the frozen state of the old Linux instance, recovers the physical memory, CPU core and other system resources occupied by it, and completely removes the instance from the memory.

[0072] If the new Linux instance runs abnormally (for example, the key service is unresponsive, consecutive heartbeat loss, abnormal system load surge or kernel error) within the preset observation period, it is determined that the upgrade fails. The upgrade agent immediately triggers the automatic rollback mechanism: sends a rollback instruction to the hypervisor, and the hypervisor immediately performs a reverse atomic switch to return network access, IPC communication and system control to the old Linux instance still retained in memory.

[0073] Second embodiment: Taking the version upgrade of the real-time domain control program of a virtual PLC on an automatic production line as an example.

[0074] Before introducing the specific steps, the specific application scenario of this embodiment will be introduced.

[0075] The virtual PLC on the automatic production line needs to optimize its control logic, for example, modify the motion trajectory algorithm of a robot to improve production efficiency or product quality. The control program runs in the real-time domain (RTOS) of the Intewell operating system, which has very high real-time requirements. The production line requires that the upgrade process cannot be stopped to ensure the continuity and stability of production.

[0076] The virtual PLC is based on the Intewell hard real-time operating system, and the system architecture is as follows: Real-time domain A: running a programmable logic controller (PLC) program with version number v1.0, responsible for managing I / O modules and precisely controlling the motion of the robot.

[0077] Non-real-time domain: provides HMI monitoring interface, OPC UA communication service and local upgrade agent; Storage medium: adopts a dual-partition structure, where the Active partition stores the currently running real-time domain image v1.0, and the Backup partition is in an idle state or stores the old version of the image.

[0078] The following process combines Figure 3 and Figure 4 as shown.

[0079] Step 1: The engineer packs the new PLC control program v2.0 and the corresponding real-time domain system image on the cloud management platform to form a complete real-time domain upgrade image file; Step 2, the cloud management platform digitally signs and encrypts the image file and pushes it to the target virtual PLC's upgrade agent in the non-real-time domain through a secure network channel (such as HTTPS, VPN); Step 3, the upgrade agent checks the received image file. The verification process includes verifying whether the digital signature of the image file is valid and whether the image file has been tampered with during transmission.

[0080] Step 4, after the upgrade agent verifies the image file, it calls the dedicated management interface provided by the virtual machine management module (Hypervisor) and issues a "create new Linux instance" request.

[0081] Step 5, after receiving the request, the Hypervisor reserves an independent and isolated address space in the physical memory for the new virtual machine instance (denoted as real-time domain B), ensuring no resource contention with real-time domain A. The Hypervisor loads the image file and starts the new Linux instance.

[0082] Specifically, during the startup process, real-time domain B initializes its running environment, but sets its I / O driver to "emulation mode" or "inactive state" to prevent it from immediately controlling physical devices. That is, although real-time domain B has loaded and run the PLC control program v2.0, it will not produce any actual control actions on the field devices, avoiding conflicts with real-time domain A which is still running. At this time, real-time domain A can still accurately control the robot motion, and the production line has no abnormalities.

[0083] Step 6, through the shared memory or ultra-high-speed IPC (inter-process communication) mechanism provided by the Hypervisor, real-time domain A copies all its current key running state data to real-time domain B.

[0084] Among them, the key running state data includes: the current values of all holding registers (such as counter values, timer current values, device running modes), the current state of input / output image area, the values of global variables and key data blocks, and the current position, speed and other state information of the motion controller. Key running state data is used to represent the real-time running state of the current industrial control process.

[0085] Therefore, after real-time domain B receives the above data, it immediately overwrites its corresponding memory area, allowing the v2.0 program to continue running from the exact state point where the v1.0 program just executed, rather than restarting from the initial state.

[0086] Step 7, after the state synchronization is completed, the Hypervisor performs an atomic context switch operation in the next scheduling period, switching control from the old instance to the new instance.

[0087] wherein the atomic context switching operation is performed, specifically comprising: (1) immediately revoke the access permission of real-time domain A to physical I / O; (2) transfer the control permission of physical I / O to real-time domain B; (3) transfer the processing right of hardware interrupt signals (such as encoder feedback, emergency stop trigger) and system internal events (such as timer expiration) to the new instance.

[0088] Step 8, after the switching is completed, real-time domain A is not immediately destroyed, but is placed in a "hot backup" state. The upgrade agent starts an observation timer (for example, 5-10 PLC scanning periods) to closely monitor the running status of real-time domain B.

[0089] wherein the monitoring indicators include but are not limited to the following aspects: (1) whether the watchdog timer is refreshed on time (i.e., "feed the dog") to determine whether the main control task of real-time domain B is continuously executed normally; (2) whether the key control tasks (such as I / O scanning, motion interpolation, logic operation) are completed within the specified real-time period to ensure that they meet the hard real-time requirements; (3) whether the CPU resource occupation rate is within the preset normal threshold range to avoid scheduling delay or task loss due to high load; (4) whether the system reports serious runtime errors or abnormal events, including but not limited to memory access violations, communication timeouts, instruction execution failures, or motion controller failures.

[0090] Specifically, during the observation period, if the detected real-time domain B runs stably without any abnormality, the upgrade agent then notifies the Hypervisor to release the resources occupied by real-time domain A, and permanently writes the new image into the Backup partition, marking the end of the successful upgrade.

[0091] During the observation period, if the detected real-time domain B runs abnormally (such as heartbeat loss, key process crash, etc.), the upgrade agent immediately triggers the automatic rollback mechanism. The Hypervisor again performs the atomic switching to return the control right to the real-time domain A in the hot backup state. Real-time domain A quickly recovers control from the vicinity of the suspension point, and since the state data is basically unchanged, the business impact is minimal. After the rollback is completed, the upgrade agent reports the upgrade failure, and the system returns to the stable state before the upgrade.

[0092] The embodiment of the application also provides a PLC online upgrade system based on an industrial operating system and virtualization technology, as shown in Figure 5 , comprising: The cloud management platform is configured to generate a target image file, and after the target image file is digitally signed and encrypted, the target image file is delivered to the non-real-time domain through a secure network channel. The industrial operating system comprises a virtual machine management module, a real-time domain and a non-real-time domain managed by the virtual machine management module, the real-time domain is configured to run PLC control logic, and the non-real-time domain is configured to deploy an upgrade agent. The upgrade agent is configured to receive and verify the target image file, and after verification, request the virtual machine management module to create a new virtual machine instance corresponding to a target domain to be upgraded, the target domain being the real-time domain or the non-real-time domain. The virtual machine management module is configured to create and start the new virtual machine instance in the memory based on the target image file, and synchronize key running state data of an old virtual machine instance currently running to the new virtual machine instance; the virtual machine management module performs atomic context switching processing to switch control from the old virtual machine instance to the new virtual machine instance, so that the new virtual machine instance takes over the PLC control task.

[0093] Figure 6 is a structural schematic diagram of a computing device 600 provided by an embodiment of the present application. The computing device performs the method described above, as shown in the figure, the computing device 600 comprises a processor 610, a memory 620, and a communication interface 630. Figure 6

[0094] It should be understood that Figure 6 The communication interface 630 in the computing device 600 shown in the figure can be used for communication with other devices, and can specifically include one or more transceiver circuits or interface circuits.

[0095] The processor 610 can be connected with the memory 620. The memory 620 can be used to store program codes and data. Therefore, the memory 620 can be a storage unit inside the processor 610, can be an external storage unit independent of the processor 610, or can be a component including the storage unit inside the processor 610 and the external storage unit independent of the processor 610.

[0096] Optionally, the computing device 600 can further comprise a bus. The memory 620 and the communication interface 630 can be connected with the processor 610 through the bus. The bus can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation,​Figure 6 A single bus or a single type of bus can be used. However, the bus 620 is the bus that is connected with the processor 610, the main memory 620 and the graphics interface 630.

[0097] It should be appreciated that in the embodiments of the present application, the processor 610 can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic components, discrete hardware components, etc. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. Alternatively, the processor 610 can be one or more integrated circuits for performing related programs to implement the technical solutions provided by the embodiments of the present application.

[0098] The memory 620 can include read-only memory and random access memory, and provide instructions and data to the processor 610. A portion of the processor 610 can also include non-volatile random access memory. For example, the processor 610 can also store device type information.

[0099] When the computing device 600 is running, the processor 610 executes computer-executable instructions in the memory 620 to perform any of the operation steps of the above method and any optional embodiments thereof.

[0100] It should be appreciated that the computing device 600 according to the embodiments of the present application can correspond to the execution of the corresponding subject in the method according to the embodiments of the present application, and the above and other operations and / or functions of each module in the computing device 600 are respectively for implementing the corresponding flow of each method of the embodiments, and for brevity, will not be repeated here.

[0101] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized in electronic hardware, or a combination of computer software and electronic hardware. Whether the functions are performed in hardware or software depends on the specific application and design constraints of the technical solutions. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0102] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the above-described system, device and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

[0103] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the described device embodiments are merely schematic, and the division of the units is merely a logical function division, and there can be another division manner in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be electrical, mechanical or in other forms.

[0104] The units described as separate components can or can not be physically separate, and the components displayed as units can or can not be physical units, i.e., can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purposes of the embodiments.

[0105] In addition, each functional unit in the embodiments of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit.

[0106] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the parts that make contributions to the prior art or parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0107] The embodiments of the present application also provide a computer readable storage medium, which stores a computer program. The program is executed by a processor to execute the above method, and the method includes at least one of the schemes described in the embodiments.

[0108] The computer storage medium of the embodiments of the present application can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or apparatus, or any combination thereof. More specific examples (non-exhaustive list) of the computer-readable storage medium include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, the computer-readable storage medium can be any tangible medium that contains or stores a program that can be used by or in connection with an instruction execution system, apparatus, or device.

[0109] The computer-readable signal medium can include a data signal propagated in baseband or propagated as a carrier wave, in which computer-readable program code is embodied. Such propagated data signals can take a wide variety of forms, including but not limited to electro-magnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium that is not a storage medium, that is, that is not a tangible medium, and that can communicate, propagate or transport programming for use by or in connection with an instruction execution system, apparatus, or device.

[0110] The program code embodied on the computer-readable media can be transmitted using any appropriate medium, including but not limited to wireless, wired, optical fiber cable, RF, etc., or any suitable combination of the above.

[0111] Computer program code for carrying out operations of the present application can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, application specific circuitry, or field programmable gate array (FPGA) circuitry can execute the computer program code.

[0112] In addition, the words "first", "second", "third", etc., or "module A", "module B", "module C" and the like in the description and claims are used only to distinguish similar objects, and do not represent a specific order or sequence of the objects, and it is understood that the specific order or sequence can be interchanged, if permitted, so that the embodiments of the present application described herein can be implemented in other than the order or sequence described herein.

[0113] In the above description, the reference signs indicating the steps, such as S110, S120, etc., do not necessarily mean that the steps are executed in the order, and the order of the steps can be interchanged, or the steps can be executed simultaneously, if permitted.

[0114] The term "comprising" used in the description and claims should not be interpreted as limiting to the listed steps; it does not exclude other elements or steps. It means that the specifying features, integers, steps or components mentioned are included, but other features, integers, steps or components are not excluded or added. Therefore, the expression "a device comprising means A and B" should not be limited to a device consisting only of the means A and B.

[0115] The phrase "one embodiment" or "an embodiment" appearing in the present specification means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. Therefore, the appearances of the phrase "in one embodiment" or "in an embodiment" throughout the present specification are not necessarily all referring to the same embodiment, but can refer to different embodiments. Furthermore, the various specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments, as would be apparent to one of ordinary skill in the art upon reviewing the present disclosure.

[0116] Note that the above only describes the preferred embodiments of the present application and the principles of the technology applied. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and that various obvious changes, readjustments and substitutions can be made without departing from the scope of the present application. Therefore, although the present application has been described in detail through the above embodiments, the present application is not limited to the above embodiments, and can include more other equivalent embodiments without departing from the concept of the present application, and all fall within the scope of the present application.

Claims

1. A PLC online upgrade method based on industrial operating system and virtualization technology, characterized in that, The industrial operating system includes a virtual machine management module, a real-time domain managed by the virtual machine management module, and a non-real-time domain. The real-time domain is used to run PLC control logic, and an upgrade agent is deployed in the non-real-time domain. The method includes: The upgrade agent obtains the target image file to be upgraded; The upgrade agent requests the virtual machine management module to create a new virtual machine instance, wherein the new virtual machine instance corresponds to the real-time domain to be upgraded; The virtual machine management module creates and starts the new virtual machine instance in memory based on the target image file; Synchronize the critical runtime status data of the currently running old virtual machine instance to the new virtual machine instance; The virtual machine management module performs an atomic context switch to transfer control from the old virtual machine instance to the new virtual machine instance, allowing the new virtual machine instance to take over the PLC control tasks.

2. The method according to claim 1, characterized in that, Also includes: The new virtual machine instance initializes its I / O driver to an inactive state during startup, and then enables I / O control after the context switch is completed.

3. The method according to claim 1, characterized in that, The atomic context switching process includes: Revoke the old virtual machine instance's access rights to I / O devices, instantly grant control of physical I / O to the new virtual machine instance, and redirect the interrupt routing table and event distribution channel to the new virtual machine instance.

4. The method according to claim 1, characterized in that, Also includes: The upgrade agent performs digital signature verification and / or integrity verification on the acquired target image file.

5. The method according to claim 1, characterized in that, The system resources allocated to the new virtual machine instance are independent and isolated from the system resources used by the old virtual machine, enabling the new virtual machine instance and the old virtual machine instance to run in parallel.

6. The method according to claim 1, characterized in that, After performing the atomic context switching process, the method further includes: The old virtual machine instance is kept in memory as a hot backup; A preset observation period is initiated to monitor the running status of the new virtual machine instance; If an anomaly is detected within the preset observation period, a rollback operation will be performed. If no anomalies are detected within the preset observation period, the resources of the old virtual machine instance will be released.

7. The method according to claim 6, characterized in that, The monitoring of the running status of the new virtual machine instance includes at least one of the following indicators: whether the watchdog timer refreshes on time, whether critical tasks are completed within the specified real-time period, whether the CPU load is normal, and whether any serious errors or exceptions are thrown.

8. The method according to claim 1, characterized in that, The methods for synchronizing the critical operational status data to the new virtual machine instance include: The synchronization is achieved through a shared memory region or a low-latency inter-process communication mechanism provided by the virtual machine management module.

9. A PLC online upgrade system based on industrial operating system and virtualization technology, characterized in that, include: A cloud management platform is used to generate target image files, and after digitally signing and encrypting the target image files, it is distributed to a non-real-time domain through a secure network channel; The industrial operating system includes a virtual machine management module, a real-time domain and a non-real-time domain managed by the virtual machine management module. The real-time domain is used to run PLC control logic, and an upgrade agent is deployed in the non-real-time domain. The upgrade agent is used to receive and verify the target image file. After the verification is successful, it requests the virtual machine management module to create a new virtual machine instance. The new virtual machine instance corresponds to the target domain to be upgraded. The target domain can be a real-time domain or a non-real-time domain. The virtual machine management module is used to create and start the new virtual machine instance in memory based on the target image file, and synchronize the key running status data of the currently running old virtual machine instance to the new virtual machine instance; the virtual machine management module performs atomic context switching processing to switch control from the old virtual machine instance to the new virtual machine instance, so that the new virtual machine instance can take over the PLC control tasks.

10. A computing device, characterized in that, include: processor, and A memory storing program instructions that, when executed by the processor, cause the processor to perform the PLC online upgrade method according to any one of claims 1 to 8.

Images