Method for verifying a first time recording unit of a field device in automation technology

Abstract

The invention comprises a method for verifying a first time recording unit (RTC1) of a field device (FG) for automation technology, wherein the first time recording unit (RTC1) provides the field device (FG) with a first date and / or a first time, comprising: - receiving a ticket (TI) at the field device (FG), wherein the ticket (TI) comprises at least one cryptographically secured piece of information and a timestamp, the timestamp being obtained from a second time recording unit (RTC2), and wherein the timestamp contains a second date and / or second time; - performing a trust assessment of the timestamp contained in the ticket (TI), wherein, in the course of the trust assessment, the trustworthiness of the second time recording unit (RTC2) vis-à-vis the first time recording unit (RTC1) is examined;- In the event that the confidence assessment shows that the second time recording unit (RTC2) has a higher confidence level than the first time recording unit (RTC2): a) Compare the first date or time with the second date or time, b) Generate a warning message if a deviation greater than a predetermined factor is detected between the first date or time and the second date or time.

Description

The invention relates to a method for verifying a first time acquisition unit of a field device of automation technology, wherein the time acquisition unit supplies the field device with a first date and / or with a first time.Field devices which are used in industrial plants have already become known from the prior art. In process automation technology and in manufacturing automation technology, field devices are frequently used. Field devices are in principle all devices that are used close to the process and supply or process the process-relevant information. Field devices are thus used for detecting and / or influencing process variables. Measuring devices or sensors are used to record process variables. These are used, for example, for pressure and temperature measurement, conductivity measurement, flow measurement, pH measurement, fill level measurement, etc., and record the corresponding process variables pressure, temperature, conductivity, pH value, fill level, flow rate, etc. Actuators are used to influence process variables. These are, for example, pumps or valves which can influence the flow of a liquid in a pipe or the fill level in a container. In addition to the aforementioned measuring devices and actuators, field devices are also understood to mean remote I / Os, radio adapters or generally devices which are arranged at the field level.A large number of such field devices are produced and sold by the Endress+Hauser group.In modern industrial plants, field devices are generally connected to superordinate units via communication networks such as fieldbuses (Profibus ®, Foundation ® Fieldbus, HART ®, etc.). Normally, the superordinate units are control systems (DCS) or control units, such as an PLC (programmable logic controller). The superordinate units serve, inter alia, for process control, process visualization, process monitoring and also for starting up the field devices. The measured values recorded by the field devices, in particular by sensors, are transmitted via the respective bus system to one (or optionally a plurality of) superordinate unit(s). In addition, data transmission from the superordinate unit via the bus system to the field devices is also required, in particular for the configuration and parameterization of field devices and for the actuation of actuators.Protocols such as the Internet Network-Time Protocol (NTP, RFC 958) are known for distributing time information or for synchronizing clocks, but these require a direct IP network connection between terminal and time server, which is generally not present in the case of field devices.Mobile operating units can also be used for operating field devices which have implemented an FDT framework application. For example, there are operating units which are connected to the field bus network. However, the operating unit can also communicate with the field devices via a wireless communication connection, in particular based on a Bluetooth standard. The applicant produces and distributes devices which, as so-called Bluetooth gateways, allow the operator control units to be coupled to the field devices. The field device is connected to a Bluetooth gateway in a wired manner, in particular using the communication standards HART or CDI. Alternatively, the field devices themselves have their own Bluetooth interfaces.In contrast to field devices, operating units may have access to a network infrastructure at least temporarily and may use mechanisms as listed in RFC 958 for synchronizing their clocks.In the case of the use of a mobile terminal, for example a smartphone or tablet, as an operating unit for wireless communication with the field devices, application programs, so-called apps, are available, which provide the operating functions for the field device to the mobile terminal.In the industrial sector, most of the installed field devices have no or only very simple protection against unauthorized access. Thus, in these field devices, all device parameters can generally be accessed directly or, for example, after input of an unlocking code. In the context of the Federal Safety Law, only increasingly field devices are coming on the market which have individual user accounts and role-based authorization. For access via a user or also machine interface, therefore, an authorization, which is "permanent" in a certain sense, is required, which is usually granted by a preceding authentication. The authorization is to be selected in such a way that the accessor has (permanently) all authorisations that he requires to carry out his tasks.In order to reduce the administration effort for the administration of the individual field devices to an acceptable level, there have been isolated efforts of central administration, as has also been customary in the IT sector for years with respect to the IT devices (for example printers, workstations, etc.) located there. An example of such a concept is disclosed in DE 10 2018 1026 08 A1, in which a transport means is provided, to which user data are transmitted from a user database, access to said user data being granted by the field device after checking the user data.There are also ideas for limiting the access permissions required by humans to a minimum extent. For example, DE 102019131860 A1 discloses providing a digital request ticket which is transmitted from a server to the mobile terminal and which request ticket contains the access rights and the authorized works for the field device. When setting up a connection to the field device, this request ticket is transmitted. If the authorization is present, the tasks present in the order ticket, for example parameterization actions or execution of function test, can be processed with the field device.In particular in the case of so-called "asynchronous communication", it is provided that the order tickets are not transmitted directly, for example by network connection, from the issuing unit, for example a ticket server or a user database, to the field device, but to the above-described transport means (for example a USB stick or a mobile terminal such as a smartphone or a tablet). The transport means in turn then transmits the order ticket to the field device. For example, this can be done by a user inserting the USB stick with the request ticket into a corresponding interface of the field device and reading the data of the request ticket there.Due to the transmission path by means of transport, it is not guaranteed that the order tickets enter the field device in the order of creation. Thus, it may be that a first order ticket is created by the ticket server with the information "The tablet with the public key XYZ belongs to the industrial installation and is authorized for access to the installation part A-Signed by the ticket server on July 13, 2023.".For example, a second order ticket could be created with the information "The tablet with the public key XYZ was reported as stolen and is no longer access-authorized--signed by the ticket server on October 10, 2023"As is clear from the example mentioned, the chronological sequence of the instructions for job tickets is a critical task, for example because a later issued job ticket must generally be given doubtful priority over an earlier issued job ticket.Field devices have a system time. This is frequently made available via an operating hour counter (a logic clock), which does not make the real time available. As a rule, however, field devices have their own real-time clocks which can also be buffered, for example, in a battery-assisted manner in the event of power failures. However, in the case of empty battery buffers or power failures, situations may occur in which the field device's own real-time clock cannot be trusted. Also, sporadic or systematic gear errors with continuous operating time can lead to a deviation of the time provided by the real-time clock from the actual correct time.Proceeding from this problem, the object of the invention is to specify a method which makes it possible to make a statement regarding the correct temporal interpretation of job tickets arriving at a field device.The invention is achieved by a method for verifying a first time acquisition unit of a field device of automation technology, wherein the time acquisition unit supplies the field device with a first date and / or with a first time, comprising:receiving a ticket at the field device, wherein the ticket comprises at least one cryptographically secured information and a time stamp, wherein the time stamp is obtained from a second time acquisition unit, and wherein the time stamp contains a second date and / or second time;performing a trust assessment of the time stamp contained in the ticket, wherein a check is made in the course of the trust assessment as to which trustworthiness the second time acquisition unit has with respect to the first time acquisition unit;in the case that the trust assessment reveals that the second time recording unit has an increased trustworthiness compared to the first time recording unit: a) comparing the first date or the first time with the second date or the second time, b) generating a warning message if a deviation greater than a predetermined factor is detected between the first date or the first time and the second date or the second time.The method according to the invention thus makes it possible to check the plausibility of tickets arriving at the field device in relation to the system time of the field device and / or to the system time of the ticket server. A ticket is a digital, tamper-proof data packet which contains further data in addition to a signature of the unit issuing the ticket-for example a ticket server. The further data, for example, if the ticket is a request ticket, is an authorisation for the operating unit to carry out defined tasks on the field device. In addition to the authorisation for this task, a valid value range for the field device parameters to be written can also be stored in the ticket, for example. The signature allows the recipient of the ticket to verify the authenticity and integrity of the ticket. For this checking, the field device requires cryptographically relevant information of the ticket server. The cryptographically relevant information is, for example, public keys of a key pair (the key pair consisting of a private key which is written to the field device and the respective corresponding public key). Alternatively, this is information which is required for so-called "challenges", by means of which the field device and the ticket server establish a trust relationship.If the first date or the first time and the second date or the second time differ from one another by the predetermined factor, so that the warning message is generated, a plausibility problem exists. This can be caused by the transport path of the ticket being too long, for example, so that the first date or the first time is more than the predetermined factor before the second date or the second time. A further cause can be found in the fact that the first time acquisition unit of the field device develops a deviation, so that the first date or the first time of day is more than the predetermined factor before or after the second date or the second time of day.The first time acquisition unit of the field device is in particular a real time clock (RTC) or an operating hour counter. The second time acquisition unit is in particular an accurate real-time clock.The warning message can be sent back to the unit emitting the original ticket, for example, in the form of a return ticket. It can also be provided to display the warning message on a display of the field device or by means of an optical indicator, for example a flashing of the display or an LED of the field device. It can also be provided to output the warning message via a fieldbus interface or a local interface of the field device.Field devices which are mentioned in connection with the method according to the invention have already been listed by way of example in the introductory part of the description.One embodiment of the method provides that the warning message is only created if the time stamp of the ticket is more recent than the time stamps of all tickets previously received by the field device. In this case, the transmission path of the ticket to the field device is taken into account. For this, it is assumed that the time stamps of the tickets received so far are correct. Tickets which experience a great delay on the transmission path and contain legacy commands or information are thereby detected. Provision can be made, in addition to the warning message, for carrying out a measure, for example not allowing the commands contained in this affected ticket to be executed.According to one embodiment of the method, it is provided that the trust assessment is carried out only in the case that the field device can successfully verify the cryptographically secured information. Manipulations by third parties can thereby be prevented.According to a first variant of the method, the ticket is created by a ticket server, wherein the ticket server transmits the ticket to the field device, wherein the second time acquisition unit is assigned to the ticket server, wherein the second time acquisition unit assigned to the ticket server has a higher trust rating than the first time acquisition unit of the field device. It is thus assumed that the second time acquisition unit has more correct or more accurate information than the first time acquisition unit.In one embodiment of the first variant of the method, the ticket is transmitted via an operating unit, in that the ticket server transmits the ticket to the operating unit and in that the operating unit transmits the ticket to the field device. Alternatively, the ticket can be transmitted, for example, via a storage medium, for example a USB stick.According to a second variant of the method, the ticket is created by an operating unit, wherein the operating unit transmits the ticket to the field device, wherein the second time acquisition unit is assigned to the operating unit, and wherein the second time acquisition unit assigned to the operating unit only has a higher trust rating than the first time acquisition unit of the field device if the operating unit has already been made known to the field device. Manipulations by third parties are thereby prevented. It can advantageously be provided that the ticket server has transmitted a certificate to the operating unit as proof as a trusted timer, wherein the operating unit inserts the certificate into the ticket and transmits it to the field device, wherein the field device executes the steps following the receipt of the ticket only if the field device FG can successfully verify the certificate.A further development of the method provides that the first time acquisition unit is switched to the second date or the second time if the second date or the second time meets at least one plausibility condition. As a result, a phase difference of the first time acquisition unit of the field device can not only be detected but also corrected.In particular, it is provided that a third time acquisition unit is assigned to the operating unit, wherein the operating unit transmits the ticket to the field device together with a third date and / or third time obtained by the third time acquisition unit, wherein the plausibility condition is fulfilled in the case that the third date and / or the third time substantially corresponds to the second date or the second time. The plausibility check is carried out by the field device. As a result, inaccurate time information, which can arise as a result of delays on the transmission path between ticket server and field device, is not taken into account for the new time of the field device. "Essentially" is dependent on the specific requirement for the accuracy of the time or of the date of the field device. If, for example, the aim is to correct the first date of the field device in a day-accurate manner, the second date and the third date must match. If the first time of the field device is to be corrected, the second time and the third time must coincide exactly, for example.According to one configuration of the method, it is provided that a mobile terminal, in particular a tablet or a smartphone, is used as the operating unit.In particular, it is provided that the operating unit transmits the ticket to the field device via a wireless communication connection, in particular based on Bluetooth or WiFi. However, other suitable communication protocols or standards may also be used.The invention is explained in more detail with reference to the following figure. It shows FIG. 1 : shows an exemplary embodiment of the system according to the invention.With regard to security, the reliability of time stamps is gaining an increasingly greater significance also for the application context of industrial control technology, such as so-called control centers and field devices. In the sense, field devices FG are understood to mean various types of control technology, such as control centers, controllers, sensors or actuators. The time is given increased relevance for field devices FG for various operations and authorization checks. These include, in particular:time stamp-based validity checking for cryptographic certificates, as are used, for example, for authentication checking in the case of protocols such as TLS or IPSEC;- time-limited access grant for human users or terminals. (For example. access for people who have been set in a limited manner); and / orBlocking instructions (e.g. for removing access authorisation for a tablet HMI remote station stored in the field device FG after it has been reported as stolen).For this purpose, the field device FG has a first time acquisition unit RTC 1, which supplies the field device FG with a first time and / or a first date.A particular challenge exists with field devices FG which do not have a permanently available online connection and which receive instructions from a central station asynchronously via certificates or tickets TI or can access network time synchronization protocols such as NTP (RFC 958). The term "central office in the sense of this application is understood to mean, in particular, so-called certificate issuing digits, as are known, inter alia, in the context of the Internet under the term "certificate authority" (CA). In the present case, a ticket server TS, which is located, for example, in the installation network, forms such a central station.It is essential for the use of a ticket-based system that a trust condition is established between the central station and the field device FG during the startup of the field device FG, so that the field device FG can be configured in such a way that certificates and tickets TI issued by the central station are trusted.Certificates and tickets TI are understood in the sense of this application as digitally encoded data blocks which are distinguished in that they contain a data area on the one hand and a testable digital signature over the content of this data area on the other hand by the central office. For the purposes of this application, signature is understood to mean both conventional cryptographic signatures based on an asymmetric key pair (elliptic curves, RSA, Kyber, MacLic, etc.) and also message authentication codes, such as (HMAC, CMAC, CBC-MAC, etc.).If the data area contains, for example, information about a public key to be considered as trusted, one normally speaks of so-called certificates, which confirm the validity of the key.If the data area contains, for example, a coding of an instruction to change a configuration parameter of a field device or to create a user account for an employee of the operating personnel on a field device, it would be unusual to speak of a "certificate". Therefore, in this case, the term "ticket" is used. (In many cases, the data area of the ticket would also be additionally encrypted, in contrast to certificates.)Such a certificate or ticket TI enables the field device FG to check the authenticity of an instruction contained in the data block by checking the signature field to determine whether it has actually been created by the central office accepted as trusted.In the case of such asynchronous communication between a field device, the sequence consists in these certificates / tickets being initially created by the central station, subsequently being transferred to a "third party" (e.g. to a user on a USB stick or deposited on an operating unit BE such as a smartphone or tablet) and then this third party transmitting this certificate / ticket to the field device. This can be done, for example, by a user inserting the USB stick with the ticket into the field device and reading the data of the ticket TI or certificate there or connecting the operating unit to the field device FG and transmitting the ticket TI or certificate.The important point for this application is the realization that tickets TI within the meaning of this application do not necessarily reach the addressee (a field device) in the sequence of creation and that the first time provided by the first time acquisition unit RTC 1 of the field device FG, or the first date, may be erroneous.According to the invention, a method for measuring discrepancies between a time stamp of the ticket TI and the current time of the field device FG is implemented in the field device FG. In this case, a time stamp is added to the ticket TI from the issuing station, in this case the ticket server TS. For this purpose, the ticket server has a second time acquisition unit RTC 2, which delivers a second date and / or a second time to the ticket server TS.After receipt of the ticket TI, the field device FG performs a trust assessment. For this purpose, limits for the minimum and maximum possible valid time are first derived for the current time, which limits are based on associated confidence conditions. For example, it may be useful to assign the following trust priority: 1. highest trustworthiness is given time stamps which are contained in the certificates / tickets TI issued by the ticket server. The actual time after this acceptance cannot be earlier than the date of issuance of the last verified ticket TI. 2. subsequently, a subordinate trustworthiness grants certificates of a time transmitter with a valid certificate, in the present case to the operating unit BE. 3. subordinate trustworthiness is granted to the time information of the first time acquisition unit of the field device FG. 4. Least trustworthiness is granted time information from a local operator interface or from unauthenticated (obtained via a trusted certificate) sources.If the trustworthiness of the time stamp contained in the ticket TI is above the trustworthiness of the system time of the field device FG, then a check is made as to whether the second time contained in the time pace, or the second date, deviates from the first time, or the second date. If this is the case and the deviation is greater than a predetermined factor, a warning message is generated by the field device and is output, for example, as a back ticket to the ticket server and / or via a display or fieldbus interface.Trusted time transmitters within the meaning of the invention are devices which have their own clock and to which a certificate of the central station is transmitted, with which they can identify themselves as trusted timers. As a rule, the trusted transmitters contain their own asymmetric key pair. The certificate which identifies the trusted time transmitter as trusted thus contains, for example, the asymmetric public key of the transmitter and a signature issued by the central.Similar to the field device, the trusted transmitter can also have its own real-time clock, wherein the same restrictions are to be placed for the reliability in the case of voltage failures, etc. for the trusted transmitter as for the field device itself.In the present case, the operating unit is such a trusted timer and has a third time acquisition unit RTC 3, which outputs a third time and / or a third time.The operating unit BE can add its own time stamp to the ticket TI. After the generation of the warning message, the field device FG can perform a plausibility check and, for this purpose, compensates for both time stamps contained in the ticket, i.e. the second time, or the second date and the third date or the third time. If these essentially match, the field device FG resets the first time, or the first date of the first time acquisition unit RTC 1, to the second date, or the second time.The process according to the invention is explained in more detail below using three examples:In the first example, the field device FG has a battery-buffered real-time clock as the first time acquisition unit RTC 1. This data item was set to a first datum on 01.01.2024 via a local operator control unit on the field device FG. The date thus points to the year 24 after Christus, so that the date is incorrectly set by approximately 2000 years in error.The field device FG receives a ticket TI produced by the ticket server TS. This has a time stamp which contains a second date obtained by the second time acquisition unit RTC2 of the ticket server: 12.12.2024.The field device FG checks the trustworthiness of the time stamp. Since the time stamp originates from the ticket server TS and thus from the unit with the highest-ranking trustworthiness level, the time stamp is trusted since the trustworthiness of the manually set first datum is lower.The time variation is very high (>2000 years), with a comparison factor of only one day. The field device FG generates a warning message with respect to the first datum.In the second example, the field device FG has a battery-buffered real-time clock as the first time acquisition unit RTC 1. This should have a maximum gear error of + / - 5 minutes per day. The current first date is 05.03.2023, the current first time is 02:15 o'clock.The field device FG receives a ticket TI produced by the ticket server TS. This has a time stamp which contains a second date (03.05.2023) and a second time (02:24 o'clock) obtained from the second time acquisition unit RTC2 of the ticket server.The field device FG checks the trustworthiness of the time stamp. Since the time stamp originates from the ticket server TS and thus from the unit with the highest-ranking trustworthiness level, the time stamp is trusted since the trustworthiness of the time of the first time acquisition unit is lower.The time deviation amounts to more than five minutes, whereupon the field device FG generates a warning message with respect to the first datum.For both examples, it can be provided that the operating unit BE serves as a means of transport of the ticket TI and adds a further time stamp with a third date and / or a third time to the ticket. After generating the warning message, the field device FG performs the plausibility check and changes the clock if the further time stamp is within defined limits (first example: 1 day; second example: 1 minute).In the third example, the field device FG has a battery-buffered real-time clock as the first time acquisition unit RTC 1. This should have a maximum gear error of + / - 1 minutes per day. The current first date is 08.03.2023, the current first time is 9:17. The clock RTC1 was last set on the basis of a trusted time transmitter on the basis of 01.03.2023, and this event was written into a logbook of the field device FG.A connection to the field device FG is established by means of Bluetooth by means of an operating unit BE. The operating unit is identified as a trusted time transmitter by a certificate of the central station (of the ticket server TS).During the creation of the identity card as a trusted time transmitter, the operating unit BE has transmitted that a trusted time synchronization server exists in the installation, e.g. on the basis of a cryptographically secured protocol of the NTP protocol family.The operating unit BE has a second time acquisition unit RTC2 in the form of a battery-buffered real-time clock with a maximum gear error of + / - 10 seconds per day. The second time acquisition unit RTC2 is periodically synchronized once a day on the basis of the information of the NTP time server designated by the central office, last time on 06.03.2023, 00:00. The current second time of day of the second time acquisition unit RTC 2 is 9:12 am, the current second date is 06.03. 2023. 2023.The operating unit transmits its time with the information regarding an expected tolerance of the time RTC 2 to the field device, together with the certificate for identification as a trusted time transmitter.The field device FG checks the certificate which the BE identifies as a trusted time transmitter and uses the transmitted information to determine that the second time has a higher degree of trustworthiness and accuracy than its own first time. Furthermore, it is determined that the deviation of the second time from the first time of 5 minutes in the course of the gear error (7 days a 1 minute per day= + / - 7 min expected tolerance) is plausible and there is no reason for generating a warning message. The first time acquisition unit RTC 1 is switched to 9:12 o'clock without outputting a warning. The process carried out for automatically switching the clock is stored together with the identity of the time transmitter in a logbook of the field device FG. Optionally, the first time acquisition unit RTC 1 of its own is recalibration according to the gear deviation determined (The first time acquisition unit RTC 1 runs too quickly to a recognized extent, so that 5 minutes errors resulted after 7 days since the last time of the clock).List of reference charactersBE operator control unit FG field device RTC 1 first time acquisition unit (of the field device) RTC 2 first time acquisition unit (of the ticket server) RTC 3 first time acquisition unit (of the operator control unit) TI ticket TS ticket serverReferences included in the specificationThis list of documents cited by the applicant has been produced in an automated manner and is only included for the better information of the reader. The list is not part of the German patent application or utility model application. The DPMA does not take any adhesion for any faults or omissions.Patent Literature citedDE 10 2018 1026 08 A1

[0010] DE 102019131860 A1

[0011] Cited Non-Patent LiteratureThe tablet with the public key XYZ belongs to the industrial installation and is access-authorized for the installation part A-signed by the ticket server on July 13, 2023

[0013]

Claims

Method for verifying a first time acquisition unit (RTC1) of a field device (FG) of automation technology, wherein the first time acquisition unit (RTC1) provides the field device (FG) with a first date and / or with a first time, comprising: - receiving a ticket (TI) at the field device (FG), wherein the ticket (TI) comprises at least one cryptographically secured information and a time stamp, wherein the time stamp is obtained from a second time acquisition unit (RTC2), and wherein the time stamp contains a second date and / or second time; performing a trust assessment of the time stamp contained in the ticket (TI), wherein in the course of the trust assessment it is checked which trustworthiness the second time recording unit (RTC2) has with respect to the first time recording unit (RTC1); - in the case that the trust assessment reveals that the second time recording unit (RTC2) has an increased trustworthiness with respect to the first time recording unit (RTC2): a) comparing the first date or the first time with the second date or the second time, b) generating a warning message if a deviation greater than a predetermined factor between the first date or the first time and the second date or the second time is detected.Method according to Claim 1, wherein the warning message is created only if the time stamp of the ticket (TI) is more recent than the time stamps of all tickets (TI) previously received by the field device (FG).Method according to claim 1 or 2, wherein the trust assessment is carried out only in the case that the field device (FG) can successfully verify the cryptographically secured information.Method according to one of Claims 1 to 3, wherein the ticket (TI) is created by a ticket server, wherein the ticket server transmits the ticket (TI) to the field device (FG), wherein the second time acquisition unit (RTC2) is assigned to the ticket server, wherein the second time acquisition unit (RTC2) assigned to the ticket server has a higher trust rating than the first time acquisition unit (RTC1) of the field device (FG).Method according to Claim 4, wherein the ticket (TI) is transmitted via an operating unit (BE) by the ticket server transmitting the ticket (TI) to the operating unit and by the operating unit (BE) transmitting the ticket (TI) to the field device (FG).Method according to one of Claims 1 to 3, wherein the ticket (TI) is created by an operating unit (BE), wherein the operating unit (BE) transmits the ticket (TI) to the field device (FG), wherein the second time acquisition unit (RTC2) is assigned to the operating unit (BE), and wherein the second time acquisition unit (RTC2) assigned to the operating unit (BE) has a higher confidence rating than the first time acquisition unit (RTC1) of the field device (FG) only if the operating unit (BE) has already been made known to the field device (FG).Method according to claim 6, wherein the ticket server (TS) has transmitted a certificate to the operating unit (BE) as proof as a trusted timer, wherein the operating unit (BE) inserts the certificate into the ticket and transmits it to the field device, wherein the field device carries out the steps following the receipt of the ticket (TI) only if the field device FG can successfully verify the certificate.Method according to one of the preceding claims, wherein the first time acquisition unit (RTC1) is switched to the second date or the second time if the second date or the second time meets at least one plausibility condition.Method according to Claims 6 and 8, wherein a third time recording unit (RTC3) is assigned to the operating unit (BE), wherein the operating unit (BE) transmits the ticket (TI) to the field device (FG) together with a third date and / or third time obtained by the third time recording unit (RTC3), wherein the plausibility condition is fulfilled in the event that the third date and / or the third time substantially corresponds to the second date or the second time.Method according to Claim 7, 8 or 9, wherein a mobile terminal, in particular a tablet or a smartphone, is used as the operating unit (BE).Method according to claim 10, wherein the operating unit (BE) transmits the ticket (TI) to the field device (FG) via a wireless communication connection, in particular based on Bluetooth or WiFi.creating a warning message if a deviation greater than a predetermined factor is detected between the first date or the first time and the second date or the second time.

Images