Procedure for diagnosing in case of a fault of a field device and field device

Abstract

The invention discloses a method for diagnosing a fault in a field device (1), comprising the steps - a provision of a field device (1) wherein the field device (1) comprises a base module (2) and an edge device (20), wherein a data diode (21) is arranged in the data flow between the base module (2) and the edge device (20), wherein the edge device (20) is configured to send data from the base module (2) to a cloud (30); - Checking the data flow direction at the data diode (21); - Providing a data connection from the edge device (20) to the base module (2); - Making a diagnosis in case of a fault, creating diagnostic information, in particular a logbook, and sending the diagnostic information from the edge device (20) to the base module (2); - Terminating the data connection between the edge device (20) and the base module (2); - Evaluating the diagnostic information; and - Deriving measures to eliminate the error. The invention further relates to a field device for carrying out the method.

Description

[0001] The invention relates to a method for diagnosing a fault in a field device and to a field device.

[0002] To optimize process flows and plan maintenance work, industry is increasingly transferring data from process- and production-related devices to other processing systems, independent of the process control system. One such processing system is a so-called "Maintenance + Optimization" (M+O) system. In process automation, this involves connecting field-level devices ("field devices") to cloud systems. This creates a link from the previously closed control area, also known as "Core Process Control" (CPC), to spatially and functionally remote M+O systems.

[0003] The connection is established via an edge device, also called an edge module. An edge device is a linking device between the field device and a server or server platform in the cloud. The edge device is therefore the network element responsible for connecting the LAN (local area network) to an external WAN (wide area network), ensuring that all data is available anytime, anywhere. The edge device is responsible for making local information available to an external network. It translates between different protocols, if necessary, and establishes the connection between the two network boundaries.

[0004] This potentially poses a security threat. To ensure that the M+O systems do not affect the CPC level, NAMUR described the so-called NOA concept ("NAMUR Open Architecture") in NAMUR Recommendation 175. In this concept, a data diode ensures data transmission only from the CPC towards the M+O. This diode is referred to as a data diode, NOA diode, or NAMUR diode. The data diode thus guarantees secure, unidirectional data transmission from the field devices to the cloud without affecting the process.

[0005] This means that an edge device with an integrated data diode meets the NOA objective of making data "easily and securely usable for plant and equipment monitoring and optimization." For IT security reasons, automation components should only send data unidirectionally (via the data diode) over the communication channel, but not receive it.

[0006] For reasons of cost and space, the edge device often has no display other than status LEDs.

[0007] Some edge device configurations include a controlled bypass for the data diode, enabling data transfer from the cloud to the field device when needed. However, this is only possible for applications whose security requirements permit this bidirectional data transmission. The bypass can be implemented using a software-controlled electronic switch, a mechanical switch (slide switch, DIP switch, jumper, etc.), or a series connection of these options.

[0008] In applications with high safety requirements, the data diode is always active, and only unidirectional data transmission from the CPC to the M+O level is possible. If a fault occurs at the edge device, a status LED on the edge device may light up or flash, but no detailed information can be transmitted to the field device.

[0009] The situation becomes serious if the fault lies in the connection to the cloud, as no information from the edge device will then reach the cloud system either.

[0010] Although a service technician on site can see the status LED of the edge device, they do not have an easy way to determine details about the cause and solution of the error.

[0011] The invention is based on the objective of providing a service technician on site with fault details without impairing the safety function of the data diode.

[0012] The problem is solved by a method for diagnosing a fault in a field device, comprising the steps of: provisioning a field device, wherein the field device includes a base module and an edge device, wherein a data diode is arranged in the data flow between the base module and the edge device, and wherein the edge device is configured to send data from the base module to a cloud; checking the data flow direction at the diode; providing a data connection from the edge device to the base module; performing a fault diagnosis, creating diagnostic information, in particular a log, and sending the diagnostic information from the edge device to the base module; terminating the data connection between the edge device and the base module; evaluating the diagnostic information; and deriving measures to eliminate the fault.

[0013] The data diode is located in the data flow between the base module and the edge device, and therefore, under normal operation, only allows data to pass in one direction. In the event of a fault, it is first checked whether this is indeed the case. If so, a user action briefly enables a data connection in the opposite direction. Diagnostic information, such as a log file, is transmitted, which can be used to diagnose the cause of the fault. The temporary data connection is then disconnected. The user action can be performed either directly at the field device or via fieldbus communication from the secure CPC area.

[0014] One configuration stipulates that only diagnostic information is transmitted. No executable code or other data qualities, nor any further data connections, are transmitted or accepted by the field device.

[0015] One design involves closing a mechanical switch to establish a data connection from the edge device to the base module.

[0016] Detecting whether the data direction is unidirectional or not can be achieved, for example, with a 2-pole design in the case of a mechanical switch, allowing the field device to verify the switch's position. Alternatively, the edge device can cyclically send a test telegram or so-called "keep-alive" message to the field device. If this message is not received, the field device can infer an interruption—and thus unidirectional operation.

[0017] One implementation provides for software-controlled establishment of a data connection from the edge device to the base module. This implementation therefore requires that the edge device and / or the base module has a software-implemented "switch" that prevents / allows the sending or processing of data, thus acting as the data diode.

[0018] In one implementation, the software-controlled "switch" is opened or closed via a fieldbus command. This eliminates the need for a service technician to be physically present to close the switch.

[0019] In one embodiment, the software-controlled "switch" is influenced by user interaction at the field device (from the safe area, i.e., the base module).

[0020] One implementation involves closing an electronically controlled switch to establish a data connection from the edge device to the base module. The opening and closing of this electronically controlled switch is software-controlled. From a safety perspective, the electronically controlled switch is exactly as safe as a mechanical switch because it is controlled directly from within the safe area by the field device (i.e., the base module). The edge device has no influence whatsoever on this process, and any external influence is impossible.

[0021] In one implementation, the electronically controlled switch is opened or closed via a fieldbus command. This eliminates the need for a service technician to physically access the field device to close the switch.

[0022] In one embodiment, the electronically controlled switch is influenced by user interaction at the field device (from the safe area, i.e., the base module).

[0023] There are three ways to temporarily provide a data channel from the edge device to the base module, which can also be cascaded. These options are software-controlled actuation of a "switch" and hardware actuation of a switch, either a mechanical or an electronically controlled switch. The combination of a mechanical switch with a software "switch" is particularly advantageous.

[0024] One implementation provides that before the step "checking the data flow direction at the data diode", the following step is performed: terminating the connection between the edge device and the cloud.

[0025] One implementation stipulates that after the step "terminating the data connection between the edge device and the base module", the following step is performed: re-establishing the connection from the edge device to the cloud.

[0026] One design provides that, in the event of a fault, data from the field device and / or connected devices are collected and / or processed by the edge device over a period of time and transmitted when a connection is re-established, preferably with a timestamp.

[0027] One implementation involves guiding the user through the individual steps using a wizard. In this particular implementation, this is achieved through a state machine. A "wizard" is a tool that automatically guides the user through one or more dialogs. Depending on the answer to an initial question, the user is presented with a corresponding second question or other answers. In this way, the user can be guided step-by-step.

[0028] One design provides that the transmitted diagnostic information, i.e., the transmitted logbook, is displayed by the field device.

[0029] The task is further solved by a field device for performing a procedure as described above, comprising a base module; an edge device; and a data diode arranged in the data flow between the base module and the edge device.

[0030] One embodiment provides that the field device is designed as a measuring transmitter and the edge device is designed as a plug-in module for it.

[0031] One embodiment provides that the edge device includes a mechanical switch that forms the data diode.

[0032] One embodiment provides that the edge device includes an electronically controlled switch (in particular an electronic switch, such as a digital gate, relay, circuits with field-effect transistors or diodes, etc.) that is actuated by the base module via software and forms the data diode, and that this switch is closed to provide a data connection from the edge device to the base module.

[0033] One design includes a display on the field device. The diagnostic information, i.e., the logbook, can be shown on the display. This is advantageous for the user on site.

[0034] One embodiment provides that the field device includes one or more operating elements. The user can interact via the operating elements and / or the display (especially in the case of a touch display); for example, the software-controlled "switch" or the electronically controlled switch can be opened or closed.

[0035] Alternatively or additionally, in one embodiment the diagnostic information is sent via a fieldbus protocol of the transmitter. In another embodiment, the diagnostic information is sent to a mobile device, for example via Bluetooth. In yet another embodiment, the transmitter, specifically the base module, includes an SD card slot, and the diagnostic information is loaded onto an SD card for further processing.

[0036] This will be explained in more detail using the following figures. Fig. Figure 1 symbolically shows a measuring system. Fig. Figure 2 shows a claimed measuring transmitter in a measuring system.

[0037] In the figures, identical features are marked with the same reference symbols.

[0038] A field device is designed as a measuring transmitter 1 in the figures.

[0039] First, the measuring transmitter 1 and its integration into a measuring system 200 will be discussed.

[0040] In Fig. Figure 1 shows a measuring system 200 with four subsystems, specifically a sensor 100, a transmitter 1, an edge device 20, and a cloud 30. A measuring system 200 with more or fewer than four subsystems is possible.

[0041] Pictured in Fig. 1 is the configuration with a measuring transmitter 1 and a separate edge device 20.

[0042] In general, an edge device 20 is a linking device between the internal domain of the process owner—here, the owner or user of the sensor 100 and the transmitter 1—and the external domain, i.e., the internet and the cloud 30. The edge device 20 collects, for example, time-stamped measurement data from the sensor 100, processes it, and / or transmits it to a server platform or a remote server in the cloud 30. In one configuration, the edge device 20 is located remotely from the sensor 100 / transmitter 1 and has a first data interface for communication with the transmitter 1 and a second data interface for communication with the server or server platform. Communication between the transmitter 1—and, if applicable, other field devices—and the edge device 20 is based, for example, on the HART protocol or another protocol used in process automation applications.However, the data can also be transmitted via other standardized protocols, such as Bluetooth. Communication between the edge device 20 and the server platform / server in the cloud 30 is preferably based on a standard internet protocol. This communication can be wired or wireless.

[0043] However, the edge device 20 can also be part of the transmitter 1. This shows Fig. 2. Then the Edge Device 20 is designed as a plug-in module for the transmitter 1 (see below).

[0044] The measuring system 200 is designed with the sensor 100, transmitter 1, edge device 20 and the cloud 30 to monitor a process of process automation technology, to display the measured values, for example, on the local display 7 of the transmitter 1, to transmit the measured values ​​from the transmitter 1 via the edge device 20 to the cloud 30 and to display them there.

[0045] A transmitter, also called a measuring transducer, is generally a device that converts an input quantity into an output quantity according to a fixed relationship. In process automation technology, a field device is connected to a measuring transducer. The terms "measuring transducer" and "transmitter" are used synonymously here. The field device is, for example, a sensor. Its raw measured values ​​are processed in the measuring transducer, for example, averaged or converted into another quantity using a computational model, such as the process variable to be determined, and possibly forwarded, for example, to a control system.

[0046] Various sensors can be connected to the transmitter 1. The applicant markets sensors for measuring pH, conductivity, oxygen, turbidity, and other parameters under the aforementioned name "Memosens". The transmitter can also be an integral part of the sensor.

[0047] In Fig. 2. The transmitter 1 is connected to the sensor 100 via a cable 111. The raw measured values ​​from the sensor 100 are processed in the transmitter 1, for example, averaged and / or converted into another quantity, such as the process variable to be determined, using a computational model, and possibly forwarded, for example, to a control system. The transmitter 1 includes a data processing unit 14 with a memory 5.

[0048] The sensor 100 comprises a first physical interface 103, via which the sensor 100 is connected to the transmitter 1 and exchanges data (bidirectionally) and is supplied with power (unidirectionally). The cable 111 is part of a connection element 110, which can be connected to the transmitter 1 at one end and to the sensor 100 at the other end. The cable 111 has a second physical interface 113 at its sensor-side end, complementary to the first physical interface 103. The physical interfaces 103 and 113 are designed as galvanically isolated, in particular inductive, interfaces. The physical interfaces 103 and 113 can be coupled to each other by means of a mechanical connector. The mechanical connector is hermetically sealed, so that no liquid, such as the medium to be measured, air, or dust can penetrate from the outside.

[0049] Sensor 100 comprises at least one sensor element 104 for detecting a measured quantity in process automation. Sensor 100 is, for example, a pH sensor, also known as an ISFET, generally an ion-selective sensor, a sensor for measuring the redox potential, the absorption of electromagnetic waves in the medium (e.g., with wavelengths in the UV, IR, and / or visible range), oxygen, conductivity, turbidity, the concentration of non-metallic materials, or temperature, with the respective corresponding measured quantity.

[0050] The sensor 100 further comprises a first coupling body 102, which includes the first physical interface 103. The connection element 110 comprises a second, cylindrical coupling body 112, which is designed to be complementary to the first coupling body 102 and which can be plugged onto the first coupling body 102 with a sleeve-shaped end section, wherein the second physical interface 113 is plugged into the first physical interface 103.

[0051] The sensor 100 includes a data processing unit 105, such as a microcontroller, which processes the raw values ​​of the measured quantity acquired by the acquisition hardware integrated into the sensor 100 and converts them, for example, into a different data format. For reasons of energy and space, the data processing unit 105 is usually designed to be rather small or economical in terms of computing capacity and storage volume. It is therefore often only intended for "simple" arithmetic operations, such as digital conversion, preprocessing, and averaging. The data processing unit 105 converts the value dependent on the measured quantity (i.e., the measurement signal of the sensor element 104) into a protocol that the transmitter 1 can understand.

[0052] The connection element 110 can include a data processing unit 115. The data processing unit 105 is designed to be "small" and can serve as a data repeater.

[0053] Multiple sensors (100) can also be connected to one transmitter (1). Fig. Figure 2 shows two sensors 100, but only one of them is labeled with all reference symbols. Identical or different sensors can be connected. The left sensor is shown in its connected state. Up to eight sensors, for example, can be connected to the transmitter 1.

[0054] Transmitter 1 can be connected to a higher-level unit, such as a control system, via a cable. Transmitter 1 forwards the measurement data to a control system. The control system is configured as either a process control system (PLC), PC, or server. Transmitter 1 transmits the data via a communication protocol understood by the control system, such as a fieldbus like HART, Profibus PA, Profibus DP, Foundation Fieldbus, Modbus RS485, or an Ethernet-based fieldbus like EtherNet / IP, PROFINET, or Modbus / TCP. This last scenario is not shown here. Additionally or alternatively, the data is transmitted to Cloud 30.

[0055] The transmitter 1 comprises a display 7 and one or more operating elements 8, such as knobs or rotary knobs, buttons, or softkeys, by which the transmitter 1 can be operated. For example, measurement data from sensor 100 is displayed on the display 7. Likewise, sensor 100 can be configured and parameterized via the operating elements 8 and the corresponding view on the display 7. The display 7 can also be designed as a touch display; in this case, the operating elements 8 can also be part of the touch display as touch controls. The transmitter 1 includes the data processing unit 14.

[0056] In this configuration, the transmitter 1 includes the edge device 20. The edge device 20 is designed, for example, as a plug-in module for the transmitter 1. Data is forwarded to the cloud 30 via the edge device 20. The edge device 20 includes one or more wireless modules for mobile communications (2G, 3G, 4G, 5G, ...). The edge device 20 includes an antenna, which in one configuration is located within the housing of the transmitter 1.

[0057] Additionally, the transmitter 1 can include one or more further wireless modules, for example for Bluetooth or WirelessHART.

[0058] In general, the transmitter 1 comprises a base module 2 and one or more additional modules. One of these additional modules is the edge device 20. The transmitter 1 can be expanded using such modules, allowing more than one or two sensors (as shown) to be connected (see above). The base module 2 includes, for example, the data processing unit 14, the memory 5, and the power supply. Furthermore, the base module 2 includes the interfaces to the various fieldbuses (see above).

[0059] The transmitter 1 or the connected sensors 100 can be operated and parameterized via the control elements 8. A menu or menu structure is displayed on the display 7. The menu structure describes the hierarchy, navigation, and text of the various menu pages shown on the display 7. The menu structure allows the user to select and execute the desired command from a list of options.

[0060] The edge device 20 includes a data diode 21. The data diode 21 ensures that, during normal operation, data can only be sent from the transmitter 1 (via the edge device 20) to the cloud 30, and not vice versa. The data diode 21 is set to unidirectional operation during normal operation because the user does not allow an internet connection to the measuring system 200.

[0061] In case of a fault, the data diode 21 can be temporarily "bridged," or in other words: in case of a fault, a data connection can also be established from the edge device 20 to the base module 2. There are several ways to do this: • Via a software-controlled “switch”. • Via a mechanical switch 22, which is operated locally. • Via an electronically controlled switch 22, which is switched via software from the base module 2. The transmitter 1 is connected to a fieldbus via the base module 2 (see above). The electronically controlled switch 22 can therefore be switched via a command using a fieldbus protocol (Profibus PA, Profibus DP, Foundation Fieldbus, Modbus RS485, EtherNet / IP, PROFINET or Modbus / TCP).

[0062] The Edge Device 20 also provides a diagnostic signal, which it uses to electrically communicate its status to the transmitter 1. This diagnostic signal allows the user to detect a fault even when they are not physically present, for example, via the fieldbus, an alarm relay, a fault current, etc. The diagnostic signal can be encoded as follows, for example: • Off -> everything is OK; On -> error • Off -> major error, e.g., hardware defect; On -> everything is OK; “Alternating” -> edge device is working, diagnostic information is available • Or variations thereof.

[0063] The Edge Device 20 includes one or more status LEDs to indicate its condition to the user. The status LED is helpful for the field user. The electrical diagnostic signal can also be displayed visually via this status LED for the field user, for example, as described above.

[0064] The following incidents could occur at measuring system 200, for example: ▪ Overvoltage caused by lightning damages the radio module or the network connection ▪ Animals damage one or more cables, for example the antenna cable or a network cable, or the antenna • Antenna or network infrastructure damaged by vandalism ▪ Expired Edge Device Certificate 20 ▪ Incorrect IP configuration of the edge device 20 ▪ Hacking attack on the Edge device 20 ▪etc.

[0065] The Edge Device 20 can detect the error state, i.e., that there is no connection to the Cloud 30, and sets the status LED and the electrical diagnostic signal to the error state. The field device, i.e., the transmitter 1, displays an Edge Device error, which, however, only indicates a general problem with the Edge Device, but not the exact cause.

[0066] The edge device may now display the diagnostics for the error in the cloud. However, in the events described above, there is no connection to the cloud and nothing is transmitted.

[0067] A service technician on site can often struggle to determine the cause. Transporting the entire measuring device to the workshop for closer examination is usually not an option either. Switching the data diode to bidirectional communication mode is also often not an option due to cyber threats.

[0068] The transmitter 1 now offers a wizard for the secure transfer of diagnostic information, such as a logbook, with diagnostic data from the edge device 20 to the transmitter 1.

[0069] The term "wizard" refers to an interface that guides a user through several dialogs for ergonomic data entry. It provides assistance to simplify certain steps, in this case, the secure transfer of diagnostic data.

[0070] The following steps are performed: 1. Start the wizard on transmitter 1. 2. The Edge Device 20 is notified by the transmitter 1 that the wizard has been started. 3. The wizard checks the data flow direction at data diode 21; in other words, it verifies whether the software switch, the mechanical switch, and / or the electronically controlled switch is / are open or closed. For example, the following dialogs might appear on display 7, which the user must confirm or perform the necessary steps to do: a. "The software switch will be briefly closed to transmit the diagnostic data. ESC / Continue?" b. “Please close the hardware switch to transfer the diagnostic data. ESC / Continue?” 4. Only the diagnostic log will now be transmitted as a data package. No executable code or other data types or further data connections will be transmitted or accepted by the field device. 5. Afterwards, the software and / or hardware switches are automatically or manually switched back to the safe state. The following messages may be displayed: a. "The software switch has been reset to its original state." b. "Please reopen the hardware switch." 6. The transferred diagnostic log from the Edge Device 20 can now be checked and evaluated in the transmitter 1. 7. The Edge Device 20 is notified by the transmitter 1 that the wizard has finished. 8. Display of information: a. Normally, the diagnostic information of the Edge device is displayed, for example: "Weak signal strength, please check antenna" "No IP connection, please check settings or start the setup wizard." "Expired certificate. Please upload a current certificate." Accordingly, these error details can be used to solve the underlying problem (replacement antenna, cable, etc.). b. If the Edge device has been hacked, the diagnostic log may contain incorrect or no entries. This indicates a hacking attack to the service technician, who can then take appropriate action.

[0071] To increase security, the Edge Device 20 can use Wizard steps “2.” and “7.” to interrupt and resume the Internet connection during temporary communication between Edge Device 20 and Base Module 2, ensuring that there is never a continuous connection between the Internet (Cloud 30) and Transmitter 1.

[0072] This document describes a security wizard for the guided, secure transmission of diagnostic information from an edge device 20 with a data diode 21. This is achieved by temporarily, deliberately, and remotely switching the data diode 21 on for diagnostic purposes. Additionally, the fault condition is signaled, for example, via an alternating signal and / or a status LED. Reference symbol list 1 measuring transmitter 2 Basic Module 5 storage 7" Display 8 Control element 10 Wireless module 14 Data processing unit 20 Edge Device 21 Data diode 22 switches 30 Cloud 100 Sensor 102 Coupling bodies 103 Interface 104 Sensor element 105 Data processing unit 110 connection element 111 cables 112 Coupling bodies 113 Interface 115 Data processing unit 200 measuring system

Claims

A method for diagnosing a fault in a field device (1), comprising the steps of: - providing a field device (1), wherein the field device (1) comprises a base module (2) and an edge device (20), wherein a data diode (21) is arranged in the data flow between the base module (2) and the edge device (20), and wherein the edge device (20) is configured to send data from the base module (2) to a cloud (30); - checking the data flow direction at the data diode (21); - providing a data connection from the edge device (20) to the base module (2); - performing a fault diagnosis, creating diagnostic information, in particular a log, and sending the diagnostic information from the edge device (20) to the base module (2); - terminating the data connection between the edge device (20) and the base module (2); - evaluating the diagnostic information; and - deriving measures to eliminate the fault. Method according to claim 1, wherein only the diagnostic information is transmitted. Method according to claim 1 or 2, wherein a mechanical switch (22) is closed to provide a data connection from the edge device (20) to the base module (2). Method according to one of the preceding claims, wherein the provision of a data connection from the edge device (20) to the base module (2) is software controlled. Method according to one of the preceding claims, wherein an electronically controlled switch (22) is closed to provide a data connection from the edge device (20) to the base module (2). Method according to one of the preceding claims, wherein the following step is performed before the step “checking the data flow direction at the data diode (21)”: - Terminating the connection between the edge device (20) and the cloud (30). Method according to one of the preceding claims, wherein after the step “terminating the data connection between edge device (20) and base module (2)” the following step is performed:- Re-establishing the connection from edge device (20) to the cloud (30). Method according to one of the preceding claims, wherein a user is guided through the individual steps by means of a wizard. Method according to one of the preceding claims, wherein the diagnostic information is displayed by the field device (1). Field device (1) for carrying out a method according to one of the preceding claims, comprising: - a base module (2); - an edge device (20); and - a data diode (21) arranged in the data flow between the base module (2) and the edge device (20). Field device (1) according to the previous claim, wherein the field device (1) is configured as a transmitter and the edge device (20) is configured as a plug-in module for it. Field device (1) according to one of the preceding claims, wherein the edge device (20) comprises a mechanical switch (22) forming the data diode (21). Field device (1) according to one of the preceding claims, wherein the edge device (21) comprises an electronically controlled switch (22) actuated by the base module (2) via software, which forms the data diode, and which is closed to provide a data connection from the edge device (20) to the base module (2). Field device (1) according to one of the preceding claims, wherein the field device (1) comprises a display (7).

Images