Method and programmable logic device for industrial system safety function maintenance work
By providing auxiliary channels in programmable logic devices and utilizing time delays, switching function blocks, or runtime environment tools, the operational problem of not affecting other safety functions during maintenance is solved, ensuring the safety of the system during maintenance.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SCHNEIDER ELECTRIC IND SAS
- Filing Date
- 2025-11-17
- Publication Date
- 2026-05-22
AI Technical Summary
In the maintenance of industrial systems, existing technologies cannot maintain individual safety functions without affecting the normal operation of other safety functions, resulting in a decline in the overall safety level of the system and an inability to maintain a high level of safety integrity.
By providing an auxiliary channel in the programmable logic device, the security functions that need to be maintained are copied to the auxiliary channel, and data exchange between the auxiliary channel and the main channel is achieved through time delay, switching function blocks, or runtime environment tools, ensuring that maintenance work does not affect the normal operation of the main channel.
This approach allows for a reduction in the security level of individual security functions during maintenance, while maintaining the security levels of other security functions, ensuring that the overall security of the system remains at an acceptable level and preventing an overall decline in the system's security level.
Smart Images
Figure CN122072467A_ABST
Abstract
Description
Technical Field
[0001] This disclosure relates to the maintenance of security applications implemented in PLDev programmable logic devices for industrial systems. Background Technology
[0002] In industrial systems, safety applications are implemented for various safety purposes to ensure the safe operation of the industrial system. For example, safety purposes include preventing potential injuries to workers from cutting machines on the production line, and detecting potential hazards caused by sparks or fumes generated by machines on the production line or by overheating from chemical processes in a chemical plant.
[0003] Industrial systems can include one or more security applications, establishing one or more security functions, each responsible for a different security purpose. One or more security functions can be implemented in a single PLDev (e.g., a programmable logic controller (PLC) or intelligent I / O) as a channel of the control module in the industrial system, while the PLDev can also include multiple channels, depending on the chosen security architecture.
[0004] Each security feature may need to be performed in conjunction with maintenance work, such as testing a security feature, debugging a security feature, modifying a security feature or its parameterization / configuration, and then testing and debugging the modified security feature.
[0005] Typically, in order to perform maintenance work on one of several security functions implemented in the same channel on a single PLDev, all security functions in the channel are affected. This is because the typical implementation characteristics of security functions and their associated diagnostics in a channel on a PLDev do not allow changes to the configuration / parameterization / logic or test / debug channel without affecting the normal security-related operation of other security functions in the channel. Therefore, during maintenance work, the Security Integrity Level (SIL) associated with each security function in the channel must be reduced from SIL3 to SIL0, i.e., from a very secure level to a substantially insecure level.
[0006] If the entire industrial system must remain operational during maintenance work, the operators of the industrial system must define special measures, such as external manual safety operating rules, for all safety functions affected by maintenance work on the safety PLDev in order to limit the hazards to an acceptable level.
[0007] However, because the safety level associated with each of the affected safety functions is reduced to SIL0, the overall safety level of the industrial system cannot be very high during maintenance work. Summary of the Invention
[0008] This invention provides a solution for performing maintenance work on a security function without affecting the normal operation of any other security functions implemented in the same channel of PLDev. Attached Figure Description
[0009] Figure 1 It is a programmable logic device according to Example A.
[0010] Figure 2 It is a programmable logic device according to Example A.
[0011] Figure 3 It is a programmable logic device according to Example A.
[0012] Figure 4 It is a programmable logic device according to Example B.
[0013] Figure 5 It is a programmable logic device according to Example B.
[0014] Figure 6 It is a programmable logic device according to Example B.
[0015] Figure 7 It is a programmable logic device according to Example C. Detailed Implementation
[0016] Example A:
[0017] Figure 1 PLDev 10 is shown as an example, where a first channel 100 is implemented with a first safety function 101 and a second safety function 102 for an industrial system, each safety function serving a different safety purpose for the industrial system. The first channel 100 may include one or more additional safety functions for one or more other additional safety purposes for the industrial system, but not specified in the provided text. Figure 1 As shown in the diagram. Furthermore, for the first channel 100, a diagnostic function 210 can be provided to detect faults in the first channel 100, such as random hardware failures. If any fault is detected, the diagnostic function 210 can shut down all outputs of all safety functions in the first channel, for example, by using control signals to instruct each safety function in the first channel 100 to stop outputting, and the diagnostic function 210 can output an alarm signal to indicate that a fault has occurred.
[0018] The entire first channel 100, including all safety functions and corresponding diagnostic functions 210 implemented therein, operates during operation for the purpose of ensuring that the industrial system is at the expected safety level (e.g., SIL3) for the corresponding safety purposes.
[0019] As an example, if maintenance is required for the first safety function 101 during operation, but the industrial system cannot be stopped, it is impossible to perform maintenance on the first safety function 101 without affecting the normal operation of other safety functions in the same channel. In other words, if maintenance is performed on the first safety function 101 in the first channel 100, not only the safety level of the first safety function 101 but also the safety level of the second safety function 102 and all other safety functions in the first channel 100 must be reduced, for example, to SIL0. As a result, the safety level of the entire industrial system becomes very low, i.e., unsafe.
[0020] Therefore, it is desirable to be able to perform maintenance work on the first safety function 101 without affecting any other safety functions in the first channel 100, such that only the safety level corresponding to the first safety function 101 is reduced during operation, which can be compensated for by, for example, external manual safety adjustment to an acceptable safety level, so that the safety of the entire industrial system can still be maintained at an acceptable level during maintenance work.
[0021] Therefore, for example, in relation to Figure 1 A secondary channel 100a is provided in the same PLDev 10 shown, which is capable of containing all the safety functions of the first channel 100. A secondary channel 100a can also be provided in different PLDevs. This secondary channel 100a does not require any safety integrity level because the relevant logic in maintenance is executed in a non-safe mode anyway. In this respect, diagnostic functionality 210 is not required for this secondary channel 100a.
[0022] Before performing maintenance during operation, the first channel 100 can be copied as a whole to the auxiliary channel 100a, such as... Figure 2 As shown, this can be accomplished very quickly, for example, through block memory copy operations.
[0023] Then, the first safety function 101a, which is copied in the auxiliary channel 100a, needs to be connected to the industrial system in order to obtain the input data of the first safety function 101 in the first channel 100 and send the output data to the industrial system to replace the output data of the first safety function 101 in the first channel 100.
[0024] As an example, input data to the first safety function 101 in the first channel 100 is written to a first memory segment in PLDev 10, allowing the first safety function 101 to read the input data from the first memory segment. The input data is then processed by one or more functional blocks within the first safety function 101, and the processed result is output as output data. The functional blocks in the safety function can be chained together to form a safety chain, or they can be connected in any kind of topology that achieves the safety purpose of the safety function. Output data can be written to a second memory segment and then sent to the industrial system for safety purposes, for example, read by or sent to another device in the industrial system if the output data indicates that a worker is in a hazardous area around the cutting machine, which in turn can stop the cutting machine. Whenever the second memory segment used for output data is updated or modified, the read or send operation of the output data can be activated by an activation signal.
[0025] To connect the first security function 101a, which is replicated in auxiliary channel 100a, to the industrial system, the first security function 101a replicated in auxiliary channel 100a can read a first memory segment for input data. In this regard, preferably, the first memory segment is provided in a memory region of PLDev 10 that can be directly addressed by any security function in the first channel 100 and any security function in the auxiliary channel 100a, thus eliminating the need for additional operations to enable the first security function 101a replicated in auxiliary channel 100a to read input data from the first memory segment.
[0026] Furthermore, the first safety function 101a, which is replicated in the auxiliary channel 100a, can send output data to the industrial system to replace the output data of the first safety function 101 in the first channel 100. This can be achieved in one of at least three ways.
[0027] In the first approach, the first safety function 101 in the first channel 100 still sends output data to the second memory segment as usual. However, the first safety function 101a copied in the auxiliary channel 100a can write output data to the second memory segment with a time delay relative to the time point at which the first safety function 101 in the first channel 100 writes output data to the second memory segment. This delayed memory write operation overwrites the contents written to the second memory segment before the delay. Thus, the output data from the first safety function 101 in the first channel 100 is replaced, ensuring that only the output data from the first safety function 101a in the auxiliary channel 100a is sent to the industrial system during maintenance. The time delay can be set as short as possible to avoid the situation where the output data from the first safety function 101 in the first channel 100 is still sent to the industrial system before it is overwritten. For example, if the first safety function 101 in the first channel 100 starts writing output data to the second memory segment at time point T, and the write operation requires a duration of t, then the first safety function 101a copied in the auxiliary channel 100a can start writing output data to the second memory segment at time point T+t.
[0028] In the second approach, copying the first security function 101a in the auxiliary channel 100a does not require a time delay, but by setting a switching function block before the second memory segment, the first security function 101 in the first channel 100 can be stopped from writing output data to the second memory segment, thereby disabling the data path from the first security function 101 in the first channel 100 to the second memory segment.
[0029] In the third approach, copying the first security function 101a in auxiliary channel 100a requires no time delay. However, the writing of output data from the first security function 101a in the first channel 100 to the second memory segment can be stopped by modifying the corresponding code of the write operation in the runtime environment. This code is part of the runtime code outside the application code executing the first security function 101a in the first channel 100. In this regard, runtime environment tools (such as the T3 tool) can be used to trigger the execution of the modified code of the corresponding write operation in the runtime environment to start or stop during maintenance work.
[0030] After the first safety function 101a, which is copied in auxiliary channel 100a, is connected to the industrial system, maintenance work can be performed on the first safety function 101a (e.g., testing the first safety function 101a, debugging the first safety function 101a, modifying the first safety function 101a and / or its configuration / parameterization, and then testing and debugging the modified first safety function 101a), but using the first safety application 101a copied in auxiliary channel 100a. During maintenance work, the safety level of the first safety function is reduced, for example, to SIL0, and the safety purpose corresponding to the first safety function can be compensated by external manual safety regulations, such as specific rules for collaboration between the worker of the cutting machine and the technician of the maintenance work.
[0031] Meanwhile, the second safety function 102 in the first channel 100, as well as any other safety functions in the first channel 100, continue to operate normally, allowing the safety level of other safety functions to be maintained, for example, using SIL3. In this regard, the second safety function 102a, which is copied in the auxiliary channel 100a, can be modified to stop issuing any output data in order to avoid any potential impact on the normal operation of the second safety function 102 in the first channel 100.
[0032] After maintenance is completed, if the first safety function 101a in auxiliary channel 100a has been modified, and the modified version is needed for industrial systems, the entire auxiliary channel 100a can be copied back to the first channel 100, so that the modified version can override the original first safety function 101a in the first channel 100. Figure 3 As shown. This copy operation can be completed very quickly at the beginning or end of the operating cycle of the first channel 100, for example, through a block memory copy operation, without affecting the normal operation of the functional blocks in each security function of the first channel. The operating cycle can refer to the time period of the channel during which each of the security functions (101, 102) in the first channel 100 can complete its work from obtaining input data, processing input data to outputting output data. The operating cycle can be configured with time redundancy to ensure that the above copy operation can be completed at the beginning or end of the operating cycle without affecting the normal operation of the functional blocks in each security function of the first channel.
[0033] If the first security function 101a copied in auxiliary channel 100a has been modified to introduce a time delay for writing output data to the second memory segment, i.e., in the first manner as described above, the time delay can be removed from it before the first function 101a copied in auxiliary channel 100a is copied back to the first channel 100.
[0034] If the second approach described above has already been adopted by setting a switching function block before the second memory segment used for output data, the switching function block can be configured to enable the data path from the first security function 101 in the first channel 100 to the second memory segment. This can be done immediately before or after the modified first function 101a is copied back to the first channel 100. Furthermore, the copying of the first security function 101a in the auxiliary channel 100a to write its output data to the second memory segment can be stopped. This can be done by modifying the write operation or by removing the entire first security function 101a copied in the auxiliary channel 100a.
[0035] If the third approach has already been adopted, the runtime environment tools can stop the execution of the modified code corresponding to the write operation in the runtime environment. Furthermore, the copying of the first security function 101a in the secondary channel 100a to write its output data to the second memory segment can be stopped, either by modifying the write operation or by removing the entire first security function 101a copied in the secondary channel 100a.
[0036] However, after maintenance is completed, if the first security function 101 in the first channel 100 does not need to be updated, the contents of the auxiliary channel 100a can be removed entirely, for example, by a block memory clearing operation, or can be retained but along with an operation to stop the copying of the output of the first security application 101a in the auxiliary channel 100a. The retained contents can be overwritten in the next maintenance operation by copying the first channel 100 or any other channel in PLDev 10. Nevertheless, the output of the first security application 101 in the first channel 100 needs to be restored. In this regard, if the first method with time delay described above has already been used, no operation is required. For the second method as described above, the swap function block can be configured to enable the data path from the first security function 101 in the first channel 100 to the second memory segment. This can be done immediately before or after the modified first function 101a is copied back to the first channel 100. And for the third method as described above, the runtime environment tool can stop the execution of the modified code for the corresponding write operation in the runtime environment.
[0037] Example B:
[0038] In another example, such as Figure 4The illustrated PLDev 20 may include a first channel 100 having a first security function 101 and a second security function 102 implemented therein. Furthermore, the first channel 100 may include one or more other security functions. The PLDev 20 may include a second channel 200, which is a copy of the first channel. That is, the first security function 201 in the second channel 200 is the same as the first security function 101 in the second channel 100, and the second security function 202 in the second channel 200 is the same as the second security function 102 in the second channel 100. If the first channel 100 also includes one or more security functions, then the second channel 200 also includes one or more of the same security functions.
[0039] In this dual configuration, input data for safety functions is fed into the same safety function in each of the first channel 100 and the second channel 200, and each of the same safety functions processes the input data in the same way, thus outputting the same output data. The two output data from the two identical safety functions are cross-compared by a diagnostic function block 210 to check if they are identical. If they are identical, the diagnostic function block 210 allows the output data to be sent to the industrial system for the corresponding safety purpose, for example, by sending control signals to the corresponding safety function in the first channel 100 or the second channel 200 to indicate its output data. However, if the two output data are not identical, the diagnostic function block 210 can generate an alarm signal to indicate that at least one of the two identical safety functions has a fault, which could be caused, for example, by aging of the hardware circuitry in the PLDev used to implement the safety function. This dual configuration for safety functions avoids the risks caused by faults. In this respect, with Figures 1 to 3 Compared to the diagnostic function in the first channel 100 and the second channel 200, the diagnostic function 210 is responsible for fault detection of the first channel 100 and the second channel 200, and has the additional function of cross-comparing the output data of the same safety function from the first channel 100 and the second channel 200.
[0040] If maintenance work is required, for example, for the first safety functions 101 and 201, an auxiliary channel 100a can be provided, for example, within the same PLDev 20. During operation, it can be done as follows: Figure 5 The diagram shows the copying of the first channel 100 to the auxiliary channel 100a, which is consistent with... Figure 2 The copying operation shown is essentially the same. Then, the auxiliary channel 100a needs to be connected to the industrial system to acquire the input data of the first safety functions 101 and 201, and to send output data to the industrial system to replace the output data of the first safety functions 101 and 201.
[0041] Regarding the input data, the principle is... Figure 2The example shown is the same. That is, the first security function 101a, which is copied in auxiliary channel 100a, can read input data from the first memory segment.
[0042] For the output data, the principle is similar to the first to third methods described above. The difference is that each of the first safety functions 101 and 201 can have an output memory segment, and the diagnostic function block 210 reads the output data from each output memory segment for inspection. If the inspection confirms the same output data, the diagnostic function block 210 can allow the output data in one of the output memory segments to be sent to the industrial system or read by the industrial system for safety purposes.
[0043] Therefore, in the first approach, the output data from the first security function 101a copied in the auxiliary channel 100a can be written to each output memory segment with a time delay.
[0044] In the second approach, output from each of the first safety functions 101 and 201 can be stopped by setting a switching function block before each output memory segment, while output data from the first safety function 101a copied in the auxiliary channel 100a can be written to each output memory segment without any time delay.
[0045] In the third approach, output from each of the first security features 101 and 201 can be stopped by modifying the corresponding code of the write operation in the runtime environment.
[0046] After the first safety function 101a, which is replicated in auxiliary channel 100, is connected to the industrial system, maintenance work can be performed on the first safety functions 101 and 201. However, this maintenance work involves using the first safety function 101a replicated in auxiliary channel 100a, for example, testing the first safety function, debugging the first safety function, modifying the first safety function, and then testing and debugging the modified first safety function. During maintenance work, the safety level of the first safety function is reduced, for example, to SIL0, and the corresponding safety level can be compensated for by external manual safety regulations, such as specific rules for collaboration between the worker operating the cutting machine and the technician performing the maintenance work.
[0047] Meanwhile, the second safety functions 102 and 202 in the first channel 100 and the second channel 200, as well as any other safety functions therein, continue to operate normally, allowing the safety level of other safety functions to be maintained, for example, using SIL3. In this regard, the second safety function 102a, which is replicated in the auxiliary channel 100a, can be modified to stop issuing any output data in order to avoid any potential impact on the normal operation of the second safety functions 102 and 202.
[0048] After maintenance is completed, if the first safety function 101a in auxiliary channel 100a has been modified, and the modified version is needed for industrial systems, the entire auxiliary channel 100a can be copied back to the first channel 100 and then back to the second channel 200. This allows the modified version to be copied back to both channels to overwrite the original first safety functions 101 and 201. Figure 6 As shown. This copy operation can be completed very quickly at the beginning or end of the operating cycle of the first channel 100 and the second channel 200, for example, through a block memory copy operation, without affecting the normal operation of the functional blocks in the first channel 100 and the second channel 200.
[0049] If the first security function 101a copied in auxiliary channel 100a has been modified to introduce a time delay, i.e., in the first manner as described above, then the time delay should be removed from the first application 101a copied in auxiliary channel 100a before copying back to the first channel 100 and the second channel 200.
[0050] If the second approach is adopted by setting a swap function block before each output memory segment, the swap function block can be configured to enable the data path to the output memory segment, which can be done immediately before or after the modified first function 101a is copied back. Furthermore, the copying of the first security function 101a in the auxiliary channel 100a to each output memory segment can be stopped, either by modifying the write operation or by removing the entire first security function 101a copied in the auxiliary channel 100a.
[0051] If a third approach has already been adopted, the runtime environment tools can stop the execution of the modified code corresponding to the write operation in the runtime environment.
[0052] However, after maintenance is completed, if the first security function 101 in the first channel 100 does not need to be updated, the contents of the auxiliary channel 100a can be removed entirely, for example, by a block memory clearing operation, or can be retained but along with an operation to stop the copying of the output of the first security function 101a in the auxiliary channel 100a. The retained contents can be overwritten in the next maintenance operation by copying the first channel 100 or any other channel in PLDev 20. However, it is necessary to restore the outputs of the first security functions 101 and 201 in the first channel 100 and the second channel 200. In this regard, if the first method with a time delay has already been used, no operation is required. For the second method as described above, the corresponding switching function block can be set to enable the data path to each output memory segment. This can be done immediately before or after the modified first function 101a is copied back to the first channel 100 and the second channel 200. And for the third method as described above, the runtime environment tool can stop the execution of the modified code for the corresponding write operation in the runtime environment.
[0053] Example C:
[0054] like Figure 7 As shown, auxiliary channel 100a can be provided in a separate PLDev 40, PLDev 40 and as... Figure 1 The PLDev 10 shown is different. In this example, a communication path 400 can be provided for communication between PLDev 10 and PLDev 40 to enable all the necessary communication required in the above steps, including copying the first channel 101 to the auxiliary channel 100a, connecting the first safety function 101a copied in the auxiliary channel 100a to the industrial system, performing maintenance work using the first safety function 101a copied in the auxiliary channel 100a, disconnecting the first safety function 101a copied in the auxiliary channel 100a from the industrial system, and overwriting the first channel 100 by copying the auxiliary channel 100a to the first channel 100.
[0055] Similarly, such as Figure 4As shown, a separate PLDev with an auxiliary channel 100a can also be provided for the first channel 100 and the second channel 200 in PLDev 20. For this purpose, a communication path is provided for communication between PLDev 10 and the separate PLDev to enable all the necessary communication required in the steps discussed above, including copying the first channel 100 to the auxiliary channel 100a, connecting the first safety function 101a copied in the auxiliary channel 100a to the industrial system, performing maintenance work using the first safety function 101a copied in the auxiliary channel 100a, disconnecting the first safety function 101a copied in the auxiliary channel 100a from the industrial system, and overwriting the first channel 100 by copying the auxiliary channel 100a to the first channel 100.
[0056] Providing an auxiliary channel 100a in a separate PLDev can save hardware resources because there is no need to reserve an auxiliary channel in a PLDev that includes safety functions 101 that will be performed using maintenance work.
[0057] Although the invention has been described with reference to the foregoing examples, it should be understood that this description is for illustrative purposes only. Therefore, the invention is intended to be limited only by the scope of the appended claims.
[0058] Further examples:
[0059] Example 1. A method for maintaining a first safety function (101) implemented in a first channel (100) of a first programmable logic device (10, 20) PLDev for an industrial system, wherein a second safety function (102) is implemented in the first channel (100), and the first safety function (101) is applied to a first safety purpose of the industrial system, and the second safety function (102) is applied to a second safety purpose of the industrial system, the method comprising:
[0060] An auxiliary channel (100a) is provided in the second PLDev, wherein the auxiliary channel (100a) is capable of including a copy of the first channel, and the first PLDev (10, 20) and the second PLDev are either the same single PLDev or two separate PLDevs;
[0061] When the first safety function (101) and the second safety function (102) in the first channel (100) are in operation, the first channel is copied to the auxiliary channel (100a).
[0062] The first safety function (101) replicated in the auxiliary channel (100a) is connected to the industrial system;
[0063] Maintenance work is performed using the first security function (101a) copied in the auxiliary channel (100a);
[0064] The first safety function (101a) copied in the auxiliary channel (100a) is disconnected from the industrial system.
[0065] Example 2. The method described in Example 1 further includes:
[0066] If the first safety function (101a) copied in the auxiliary channel (100a) is modified during maintenance work, and the modified first safety function will be implemented as a new version of the first safety function for industrial systems, then the first channel (100) is overwritten by copying the auxiliary channel (100a) to the first channel (100).
[0067] Example 3. According to the method described in Example 1, the step of connecting the first safety function (101a) replicated in the auxiliary channel (100a) to the industrial system includes:
[0068] Enable the first security function (101a) copied in the auxiliary channel (100a) to obtain input data to the first security function (101) in the first channel (100); and
[0069] Enable the first safety function (101a) copied in the auxiliary channel (100a) to send output data to the industrial system to replace the output data of the first safety function (101) in the first channel (100).
[0070] Example 4. According to the method described in Example 3, the step of connecting the first safety function (101a) replicated in the auxiliary channel (100a) to the industrial system further includes:
[0071] Disable the second safety function (102a) that copies output data in the auxiliary channel (100a) to the industrial system.
[0072] Example 5. According to the method described in Example 3, wherein the input data to the first security function (101) in the first channel (100) is written to the first memory segment in the first PLDev (100), and the first security function (101a) copied in the auxiliary channel (100a) is enabled to obtain the input data to the first security function (101) in the first channel (100) includes the following steps:
[0073] Enable the first security function (101a) that is copied in the auxiliary channel (100a) to read input data from the first memory segment.
[0074] Example 6. According to the method described in Example 3, wherein the output data of the first safety function (101) in the first channel (100) is written to a second memory segment in the first PLDev (10, 20), and the first safety function (101a) copied in the auxiliary channel (100a) is enabled to send output data to the industrial system to replace the output data of the first safety function (101) in the first channel (100), the steps include:
[0075] Enable the first security function (101a) in the auxiliary channel (100a) to write the output data to the second memory segment with a time delay relative to the time point at which the first security function (101) in the first channel (100) writes the output data to the second memory segment.
[0076] Example 7. According to the method described in Example 6, the step of disconnecting the first safety function (101a) replicated in the auxiliary channel (100a) from the industrial system includes:
[0077] Stop writing output data to the second memory segment by copying the first security function (101a) in the auxiliary channel (100a).
[0078] Example 8. According to the method described in Example 3, wherein the output data of the first safety function (101) in the first channel (100) is written to a second memory segment in the first PLDev (10, 20), and the first safety function (101a) copied in the auxiliary channel (100a) is enabled to send output data to the industrial system to replace the output data of the first safety function (101) in the first channel (100), the steps include:
[0079] Enable the first security function (101a) for copying in the auxiliary channel (100a) to write the output data to the second memory segment;
[0080] Disable the first security function (101) that writes output data to the first channel (100) in the second memory segment.
[0081] Example 9. According to the method described in Example 8, the step of disconnecting the first safety function (101a) replicated in the auxiliary channel (100a) from the industrial system includes:
[0082] Stop writing output data to the second memory segment via the first security function (101a) that replicates in the auxiliary channel (100a); and
[0083] Enable the first security function (101) in the first channel (100) to write the output data into the second memory segment.
[0084] Example 10. According to the method described in Example 2, wherein the first PLDev (1) further includes a second channel (200) as a copy of the first channel (100) and a diagnostic function block (210), wherein each safety function in the first channel (100) and the corresponding safety function in the second channel (200) processes the same input data in the same manner, and if the diagnostic function block (210) determines that the output data from the two copies of the same safety function are identical, then the diagnostic function block allows the output data to be sent to the industrial system.
[0085] The overwriting step also includes overwriting the second channel (100) by copying the auxiliary channel (100a) to the second channel (200).
[0086] Example 11. According to the method described in any of the preceding examples, wherein,
[0087] When the first PLDev (10, 20) and the second PLDev are the same single PLDev, the step of providing an auxiliary channel (100a) in the second PLDev includes: reserving the auxiliary channel (100a) in the first PLDev (10, 20).
[0088] When the first PLDev (10) and the second PLDev (40) are two separate PLDevs, the step of providing an auxiliary channel (100a) in the second PLDev (40) includes: providing a separate PLDev (40) as a second PLDev (40) for reserving the auxiliary channel (100a); and providing a communication path (400) between the second PLDev (40) and the first PLDev (10) that supports the communication required for the copy step, the join step, the perform step, the disconnect step and the overwrite step.
[0089] Example 12. According to the method described in any of the foregoing examples, the maintenance work of the first security function includes at least one of the following:
[0090] The function of testing security features;
[0091] Debug the primary safety function;
[0092] Modify the primary security features, and test and debug the modified primary security features.
[0093] Example 13. A programmable logic device PLDev suitable for industrial systems, comprising:
[0094] The first channel (100) includes a first security function (101) for a first security purpose of the industrial system and a second security function (102) for a second security purpose of the industrial system; and
[0095] Auxiliary channel (100a) is adapted to include a copy of the first channel (100);
[0096] PLDev is suitable for copying the entire first channel (100) into the auxiliary channel (100a).
[0097] Example 14. PLDev according to Example 13 includes:
[0098] The first memory segment is adapted to store the input data of the first security function (101).
[0099] The first memory segment is adapted to be readable by a first security function (101) in the first channel (100), and is adapted to be readable by a first security function (101a) copied in the auxiliary channel (100a) after the entire first channel (100) has been copied into the auxiliary channel (100a).
[0100] Example 15. PLDev according to Example 13 includes:
[0101] The second memory segment is adapted to store the output data of the first security function (101).
[0102] The second memory segment is writable by a first security function (101) in the first channel (100) and is writable by a first security function (101a) copied in the auxiliary channel (100a) after the entire first channel (100) has been copied into the auxiliary channel (100a).
[0103] Example 16. PLDev, as described in Example 15, also includes:
[0104] The switching function block is adapted to enable or disable the first security function (101) that writes the output data of the first security function (101) into the first channel (100) of the second memory segment.
Claims
1. A method for maintaining a first safety function implemented in a first channel of a first programmable logic device (PLDev) in an industrial system, wherein, The second safety function is implemented in the first channel, and the first safety function is applied to a first safety purpose of the industrial system, and the second safety function is applied to a second safety purpose of the industrial system, the method comprising: An auxiliary channel is provided in the second PLDev, wherein the auxiliary channel is capable of including a copy of the first channel, and the first PLDev and the second PLDev are either the same single PLDev or two separate PLDevs; When the first and second safety functions in the first channel are in operation, the first channel is copied to the auxiliary channel; The first safety function, replicated in the auxiliary channel, will be connected to the industrial system; Maintenance work is performed using the first security function copied in the auxiliary channel; The first safety function, which is copied in the auxiliary channel, is disconnected from the industrial system.
2. The method according to claim 1, further comprising: If the first safety function copied in the auxiliary channel during maintenance is modified, and the modified first safety function will be implemented as a new version of the first safety function for industrial systems, then the first channel is overwritten by copying it from the auxiliary channel.
3. The method according to claim 1, wherein, The steps for connecting the first safety function, replicated in the auxiliary channel, to the industrial system include: Enable the first safety function copied in the auxiliary channel to obtain input data for the first safety function in the first channel; and Enable the first safety function replicated in the auxiliary channel to send output data to the industrial system to replace the output data of the first safety function in the first channel.
4. The method according to claim 3, wherein, The steps of connecting the first safety function, which is replicated in the auxiliary channel, to the industrial system also include: Disable the second safety feature that copies output data to the industrial system in the auxiliary channel.
5. The method according to claim 3, wherein, The steps of writing the input data of the first safety function in the first channel to the first memory segment in the first PLDev and enabling the first safety function copied in the auxiliary channel to obtain the input data of the first safety function in the first channel include: Enable the first security feature for copying in the secondary channel to read input data from the first memory segment.
6. The method according to claim 3, wherein, The steps of writing the output data of the first safety function in the first channel to the second memory segment in the first PLDev, and enabling the first safety function copied in the auxiliary channel to send output data to the industrial system to replace the output data of the first safety function in the first channel, include: Enable the first security function for copying in the auxiliary channel, and write the output data to the second memory segment with a time delay relative to the time point at which the first security function in the first channel writes the output data to the second memory segment.
7. The method according to claim 6, wherein, The steps to disconnect the first safety function replicated in the auxiliary channel from the industrial system include: Stop writing output data to the second memory segment by copying the first safety function in the auxiliary channel.
8. The method according to claim 3, wherein, The steps of writing the output data of the first safety function in the first channel to the second memory segment in the first PLDev, and enabling the first safety function copied in the auxiliary channel to send output data to the industrial system to replace the output data of the first safety function in the first channel, include: Enable the first security feature for copying in the auxiliary channel to write the output data to the second memory segment; Disable the first security function that writes output data to the first channel in the second memory segment.
9. The method according to claim 8, wherein, The steps to disconnect the first safety function replicated in the auxiliary channel from the industrial system include: Stop writing output data to the second memory segment via the first safety function that replicates in the auxiliary channel; and Enable the first security function in the first channel to write the output data to the second memory segment.
10. The method according to claim 2, wherein, The first PLDev also includes a second channel as a copy of the first channel and a diagnostic function block, wherein each safety function in the first channel and the corresponding safety function in the second channel processes the same input data in the same manner, and if the diagnostic function block determines that the output data from the two copies of the same safety function are identical, the diagnostic function block allows the output data to be sent to the industrial system. The overwriting process also includes overwriting the second channel by copying the auxiliary channel to the second channel.
11. The method according to claim 1, wherein, When the first PLDev and the second PLDev are the same single PLDev, the step of providing an auxiliary channel in the second PLDev includes: reserving the auxiliary channel in the first PLDev; When the first PLDev and the second PLDev are two separate PLDevs, the step of providing an auxiliary channel in the second PLDev includes: providing a separate PLDev as a second PLDev to reserve the auxiliary channel; and providing a communication path between the second PLDev and the first PLDev, which supports the communication required for the copy step, the join step, the perform step, the disconnect step, and the overwrite step.
12. The method according to claim 1, wherein, The maintenance of the primary safety function includes at least one of the following: The function of testing security features; Debug the primary safety function; Modify the primary security features, and test and debug the modified primary security features.
13. A programmable logic device PLDev suitable for industrial systems, comprising: The first channel includes a first security function for a first security purpose of the industrial system and a second security function for a second security purpose of the industrial system; and A secondary channel, suitable for including copies of the primary channel; PLDev is suitable for copying the entire first channel to an auxiliary channel.
14. The PLDev according to claim 13, comprising: The first memory segment is suitable for storing input data for the first security function. The first memory segment is adapted to be readable by a first security function in the first channel, and is also adapted to be readable by a first security function copied in the auxiliary channel after the entire first channel has been copied to the auxiliary channel.
15. The PLDev according to claim 13, comprising: The second memory segment is suitable for storing the output data of the first security function. The second memory segment is writable by the first security function in the first channel, and is also writable by the first security function copied in the auxiliary channel after the entire first channel has been copied to the auxiliary channel.
16. The PLDev according to claim 15, PLDev also includes: A switching function block is adapted to enable or disable the first security function that writes the output data of the first security function into the first channel of the second memory segment.