Method and apparatus for verifying real-time communication on a communication link of an industrial communication network

Abstract

The invention relates to a method for verifying real-time communication on a communication link (21) of an industrial communication network (20), comprising: capturing communication on the communication link (21) at at least one location of the communication network (20) for a predetermined time using a network test access point (2) and providing an associated recording (10), feeding the recording (10) as input data to a trained large language model (4), wherein the language model (4) has, according to training, knowledge of at least one protocol structure of a protocol used on the communication link (21) and / or has access to such knowledge, and feeding at least one query string (11) to the trained large language model (4).wherein the query string (4) includes at least one command for checking a technical state of the communication link (21) and / or the industrial communication network (20) based on the recording (10), receiving and providing an output string (12) of the trained large language model (4) representing and / or describing the technical state, generating a verification signal (13) based on the output string (12), and outputting the generated verification signal (13). The invention further relates to a corresponding device (1).

Description

The invention relates to a method and a device for checking real-time communication on a communication link of an industrial communication network. Industrial communication networks for real-time communication, such as those used for process control in industrial automation or energy distribution, are becoming increasingly complex. In particular, more and more devices are being integrated into the communication network. An increasing number of protocols are being used or must be supported, e.g., Profinet, MQTT, HTTP, OPC UA, CC-LINK TSN, HTTP(S), video streams (e.g., Real-Time Streaming Protocol (RTSP)), etc. The dynamics of communication are also increasing. Furthermore, communication networks exhibit greater heterogeneity in physical transmission; for example, transmission takes place via copper wires, fiber optic cables, and / or wireless communication (e.g., 5G), enabling the use of a wide range of different bit rates.This makes finding, diagnosing, and quickly fixing errors increasingly complex, time-consuming, and costly, and it is hardly manageable manually anymore. It is known to use so-called network test access points (TAPs) to capture communication in a network in order to manually find errors and identify their causes by means of a recording. It is known to use large language models for fault diagnosis in communication networks, for example from Sifan Long et al., 6G comprehensive intelligence: network operations and optimization based on Large Language Models, IEEE Journal of Latex Class Files, Vol. 14, No. 8, August 2021, IEEE. The invention is based on the objective of improving a method and a device for checking real-time communication on a communication link of an industrial communication network. The problem is solved according to the invention by a method with the features of claim 1 and a device with the features of claim 15. Advantageous embodiments of the invention are set forth in the dependent claims. In particular, a method for verifying real-time communication on a communication link of an industrial communication network is provided, comprising: capturing communication on the communication link at at least one point in the communication network for a specified time using a network test access point and providing an associated recording; feeding the recording as input data to a trained large language model, wherein the large language model, according to training, has knowledge of at least one protocol structure of a protocol used on the communication link and / or has access to such knowledge; and feeding at least one query string as input data to the trained large language model.wherein the query string includes at least one command to check a technical state of the communication link and / or the industrial communication network based on the recording, receiving and providing an output string of the trained large language model representing and / or describing the technical state of the communication link and / or the industrial communication network, generating a verification signal based on the output string, outputting the generated verification signal. Furthermore, a device for verifying real-time communication on a communication link of an industrial communication network is provided, comprising a network test access point, wherein the network test access point is configured and / or controlled to capture communication on the communication link at at least one point in the communication network for a predetermined time and to provide an associated recording; an evaluation device, wherein the evaluation device is configured to provide a trained large language model or to provide access to the trained large language model, wherein the large language model, according to training, has knowledge of at least one protocol structure of a protocol used on the communication link and / or has access to such knowledge.to feed the recording as input data to the trained large language model, to feed at least one query string to the trained large language model, wherein the query string contains at least one command to check a technical state of the communication link and / or the industrial communication network based on the recording, to obtain and provide an output string of the trained large language model representing and / or describing the technical state of the communication link and / or the industrial communication network, and to generate a verification signal based on the output string and output the generated verification signal. The method and the device enable improved, and in particular automated, evaluation of communication on a communication link of an industrial communication network, especially with regard to the presence of errors. For this purpose, communication on the communication link is recorded at at least one point in the communication network for a predetermined period using a network test access point, and a corresponding recording is made available. The recording is then fed as input data to a trained large language model (LLM). According to training, the large language model possesses knowledge of at least one protocol structure of a protocol used on the communication link and / or has access to such knowledge. The communication link can, in particular, be a communication bus.For example, if communication takes place via Profinet over the communication link, the large-scale language model, due to its training, possesses knowledge of the protocol structure. This means the large-scale language model understands the rules governing Profinet communication over the communication link, particularly via the communication bus. Specifically, semantic and / or syntactic relationships within the protocol, and especially within the communication process, are contained in the large-scale language model, particularly encoded in its parameters. Furthermore, the trained large-scale language model receives at least one query string as input data, where the query string contains at least one command for checking the technical status of the communication link and / or the industrial communication network based on the captured data.Depending on the configuration of the large language model, the query string can include natural language and / or a more abstract and / or coded (programming) language. The query string can also be referred to as a prompt for the large language model. Applying the trained large language model generates an output string representing and / or describing the technical state of the communication link and / or the industrial communication network. This output string is then retrieved and made available. Based on this output string, a verification signal is generated and output. In the simplest case, the verification signal consists of the output string. A protocol used on the communication link, in particular on a communication bus, can be one of the following: Profinet, MQTT, http, OPC UA, Video, CC-Link IE TSN, Precision Time Protocol (PTP), generalized Precision Time Protocol (gPTP), OPC UA, OPC UA FX, IPv4, TCP, UDP, http(s), PROFINET over TSN. The large language model (LLM), according to training, possesses knowledge of at least one protocol structure of a protocol used on the communication link, particularly on the communication bus. The term "protocol structure" here refers specifically to the structure and execution of the protocol. Large language models can be, for example, freely available or commercial models, such as those in the GPT model series from OpenAI, San Francisco, USA (e.g., GPT-3.5 and GPT-4, used in ChatGPT and Microsoft Copilot); PaLM, Gemini, and Gemma 2 from Google LLC, Mountain View, USA; the LLaMA family from Meta Inc., Menlo Park, USA; Claude from Anthropic PBC; or Grok-1 from X.AI Corp., San Francisco Bay Area, USA. It may be possible to obtain the large language model by modifying an existing or...A pre-trained large language model is retrained so that it acquires knowledge of at least the protocol structure and exhibits this knowledge after retraining. For example, a description of the protocol structure can be provided to the pre-trained large language model for retraining. Input data is provided to the large language model, primarily in text form in natural language and / or in abstract and / or coded form. The large language model generates output data, primarily in text form in natural language and / or in abstract and / or coded form. Alternatively, the large language model can be provided by the evaluation unit. Alternatively, the evaluation unit is configured to provide access to the trained large language model, for example, by having a suitable interface to the large language model. In the latter alternative, the device can, in particular, have a communication interface to provide the interface to the large language model. A network test access point (network TAP) enables the capture and recording of communication traffic on the communication link, particularly on the communication bus or a communication segment of the communication network. The communication traffic itself is not interfered with; the capture and recording are passive. For example, a ProfiShark test access point from Profitap HQ BV, Eindhoven, Netherlands, can be used. The capture process is controlled using a suitable data processing program, such as the Wireshark software (www.wireshark.org). The recording includes, in particular, data packets or frames transmitted via the communication link, especially via the communication bus, in raw format and / or in already formatted and / or processed form, including in particular each associated timestamp, which record a respective recording time by the network test access point. Parts of the device, in particular the evaluation unit, can be configured individually or collectively as a combination of hardware and software, for example, as program code executed on a computing unit, in particular a microcontroller or microprocessor. However, it can also be configured individually or collectively as an application-specific integrated circuit (ASIC) and / or a field-programmable gate array (FPGA) and / or a graphics processing unit (GPU) and / or a digital signal processor (DSP). The evaluation unit can, in particular, comprise at least one computing unit and at least one memory. The device can further comprise at least one communication interface, at least one display unit, and / or at least one human-machine interface. It can be implemented that after receiving and providing the output string and / or after issuing the verification signal, another query in the form of a further query string is sent to the trained large language model. This can further improve error detection and / or error diagnosis, as targeted queries can be made in response to an output string. This process can be repeated multiple times. The trained large language model is specifically aware of the preceding query string(s), the preceding output string(s), and / or the preceding verification signal(s). This improves error detection and the identification of the root cause. In one embodiment, the trained large language model is capable of retrieval-augmented generation and / or is operated using retrieval-augmented generation, accessing at least one information source outside the trained large language model. Specifically, a system is used that combines information retrieval from the at least one information source, for example, from a database, with the large language model. This allows additional information to be considered beyond the knowledge contained in the large language model. This can particularly increase accuracy, as the information in the at least one information source can be curated and / or verified by experts. The information retrieval by the large language model and / or in conjunction with it is fundamentally carried out in a manner known per se. It may be provided that the at least one information source is queried and / or provided by a service provider and / or third-party provider. This allows the at least one information source to be provided as needed. Furthermore, the at least one information source can always be kept up to date, so that the most current version of the at least one information source is always used when carrying out the procedure. For this purpose, it may be provided that a connection to this service provider and / or third-party provider is established via a communication interface, and the at least one information source is queried and / or provided by the service provider and / or third-party provider. The communication interface could, for example, be a suitable communication interface via the internet. The querying is carried out in particular by means of the device. In one embodiment, the at least one information source includes and / or provides a description of the protocol structure. This allows knowledge about the protocol structure to be made available to the trained large language model. Furthermore, this method allows the addition of protocols that the large language model does not recognize. In one embodiment, the at least one information source includes and / or provides a description of a structure and / or participants of the industrial communication network. This allows the structure and / or participants of the industrial communication network to be taken into account. For example, this can improve fault diagnosis because the inferences of the large language model consider the structure and / or participants. In particular, this improves fault diagnosis. Furthermore, it allows for the improved identification of measures for correcting a detected fault.For example, if there is a switch in the industrial communication network that allows a port change, then, based on the known structure and / or the known participants, a port change can be suggested and / or carried out on the switch after an error is detected on a port, so that a communication path can be changed. In one embodiment, the at least one information source comprises and / or provides information that links technical states with their respective diagnostic information. This improves fault diagnosis. The at least one information source can, for example, be an information source compiled and / or maintained by experts, in which diagnostic information is stored for each individual technical state. Examples of technical conditions and associated diagnostic information are given below: Example 1: gPTP protocol - Technical condition: PDelay values ​​are above a predefined threshold; - Diagnostic information (cause): after component replacement, incorrect configuration of a network participant (switch), e.g., incorrect synchronization profile IEEE 1588 default instead of IEEE 802.1AS (gPTP). Example 2: - Technical condition: there is jitter in the transmission accuracy of an industrial communication participant (controller); - Diagnostic information (cause): malfunction in the time reference for the network (PTP Grandmaster). Example 3: - Technical condition: a system or communication component indicates a bus error (BF);- (Consequence: alarm on the medium);- Diagnostic information (cause): the communication partners have no physical connection. In one embodiment, the at least one information source includes and / or provides instructions for a type and / or form of the output string of the trained large language model. This allows the user to specify how the output string should be structured. For example, the instructions may specify that the output string should be generated in a human-readable way and / or form, such as natural language. In another example, the instructions may specify that the type and / or form of the output string is structured for automated or machine-based processing, for example, because an automated or machine-based recommendation is to be generated based on the output string. In one embodiment, the at least one information source includes and / or provides instructions for verification and / or evaluation by the trained large language model. This allows the large language model to be given specific instructions on how the verification and / or evaluation should be performed. For example, the instructions can specify that a particular type of verification and / or evaluation should be carried out. Furthermore, the instructions can formulate and / or contain specific questions relating to the recording, such as: "Is one of the participants not responding?" or "Are the time tolerances for the responses being observed?" etc. The instructions can be in natural language and / or in abstract or coded form. In one embodiment, the at least one information source comprises a link between technical states and / or diagnostic information with corresponding instructions. This allows for the direct provision of recommendations for action, enabling the correction of a detected error and / or anomaly (e.g., a temporal jitter above a threshold) and / or the mitigation of its effects. For example, the information source may include a database containing one or more recommendations for action in human-readable, machine-readable, and / or machine-executable form for each technical state and / or diagnostic information. Based on this information source or database, the large language model can then directly identify and output an instruction for action. In one embodiment, the query string and / or the at least one information source includes at least one command specifying that the output string of the trained large language model must contain a report with at least one predefined piece of report information. This allows the large language model to be specifically given a specification for output. In particular, the report can process and output the technical status and / or derived diagnostic information and / or detected errors and / or recommendations for action in a structured format. In one embodiment, the query string is generated based on a predefined query string stored in memory. This enables standardized and / or pre-defined verification of the technical status of the communication link and / or the industrial communication network. The stored query string can be defined, in particular, by experts. For example, the query string can comprise a set of questions that the trained large language model is to answer during processing. In one embodiment, the method is initiated when an error is detected and / or reported in the industrial communication network. The detection and / or reporting of the error is performed, in particular, by the industrial communication network itself. The device, especially the evaluation unit, may, for this purpose, have a communication interface with the industrial communication network via which a detected error and / or an error message is transmitted to the device. The method is then initiated. Industrial communication networks, or the protocols used, already possess error detection methods. For example, it can be detected if participants are unreachable or if the network is overloaded.For this purpose, performance, configuration, and / or service quality can be monitored, for example, based on predefined thresholds that, depending on the design, must not be exceeded or fallen below. Based on such a detected and / or reported error, the procedure described in this disclosure is initiated. In one embodiment, the method is performed repeatedly and automatically. This allows for continuous monitoring of communication within the industrial communication network. This enables immediate responses to errors or irregularities. Performance degradation or network outages can thus be prevented or at least shortened. In particular, the network test access point can be permanently positioned at a section of the industrial communication network so that communication can be recorded there. Specifically, recordings of a predetermined duration can be captured at regular intervals and evaluated as described. In one embodiment, at least one instruction for reconfiguring the industrial communication network is generated based on the output string and / or the verification signal, and the industrial communication network is reconfigured based on this at least one instruction. This allows a detected error to be rectified or at least mitigated. The at least one instruction can be determined from an information source, such as a database and / or a rule-based expert system. In particular, the database and / or the rule-based expert system contains a link between the output string and / or the verification signal and the at least one instruction.It can also be provided that the reconfiguration instruction is generated by a renewed query to the trained large language model, which in particular issues at least one command to the trained large language model, taking into account the previous output string(s) and / or the verification signal. In the aforementioned variants, the information sources described above can be considered via information retrieval, especially the information source containing the structure and / or participants of the industrial communication network. Based on this, the trained large language model then generates the reconfiguration instructions, which can subsequently be implemented manually or automatically.As described above, a communication channel can be changed, for example, by changing a port on a switch in the industrial communication network. Furthermore, it may be possible to deactivate and activate participants in the industrial communication network, such as redundant control units. In one embodiment, the trained large language model is trained and / or the query string is designed such that the output string includes at least one instruction for reconfiguring the industrial communication network, and the industrial communication network is reconfigured based on this at least one instruction. This allows the reconfiguration instructions to be implemented directly. In particular, the output string can contain the instructions in an encoded form, for example, as predefined program code, which can be used directly for reconfiguration.The output string, or a portion specifically marked therein, can then be directly injected into the communication network and cause a reconfiguration there, for example, as described above, changing a communication path and / or deactivating and activating participants. Further features for the design of the device result from the description of embodiments of the method. The advantages of the device are the same in each case as in the embodiments of the method. The invention is explained in more detail below with reference to preferred embodiments and the figures. Figure 1 shows a schematic representation of embodiments of the device for checking real-time communication on a communication link of an industrial communication network; Figure 2 shows a schematic flowchart of an embodiment of the method; Figure 3 shows a schematic flowchart of an embodiment of the method. Figure 1 shows a schematic representation of embodiments of the device 1 for verifying real-time communication on a communication link 21, for example on a communication bus, of an industrial communication network 20. The industrial communication network 20 is, for example, integrated into a process engineering and / or energy engineering plant. The method described in this disclosure is described in more detail below with reference to the device 1. The device 1 comprises a network test access point 2 and an evaluation unit 3. Network test access point 2 is configured and / or controlled to capture communication on communication link 21 at at least one point in communication network 20 for a specified period of time and to provide a corresponding recording 10. Network test access point 2 is used in a manner known per se. Below are three (processed) sample recordings 10 from a network test access point 2, the first showing a packet ("frame") of the Transmission Transfer Protocol (TCP), and the last two each showing a packet of the Precision Time Protocol (PTP). The raw recordings 10 are also shown for the last two examples (see lines 0000-0040 and 0000-0030, respectively). TCP: Basic representation packet text: PTPv2: Basic representation with byte text and raw representation: PTPv2: Extended display with Wireshark Dissector for protocols and raw display: The evaluation unit 3 comprises, in particular, at least one computing unit (not shown) and at least one storage unit (not shown). The evaluation unit 3 is configured to provide a trained large language model 4 or to provide access to the trained large language model 4. In the latter case, the trained large language model 4 is contacted, for example, via a dedicated interface (not shown), such as an interface to a cloud server (not shown) that provides the trained large language model 4. According to training, the large language model 4 possesses knowledge of at least one protocol structure of a protocol used on the communication link 21 and / or has access to such knowledge, for example, via at least one information source 5 by means of information retrieval. The evaluation unit 3 feeds the recording 10, for example one of the three recordings 10 shown above as examples (as raw data and / or already processed, for example using Wireshark Dissector), as input data to the trained large language model 4. Furthermore, the evaluation unit 3 feeds at least one query string 11 as input data to the trained large language model 4, wherein the query string 11 contains at least one command for checking a technical state of the communication link 21 and / or the industrial communication network 20 based on the recording 10. The trained large language model 4 generates, based on this input data, an output string 12 representing and / or describing the technical state of the communication link 21 and / or the industrial communication network 21. In particular, the information contained in the recording 10 is extracted and / or processed according to instructions contained in the query string 11. The evaluation unit 3 is configured to receive and provide the output string 12 of the trained large language model 4, to generate a verification signal 13 based on the output string 12, and to output the generated verification signal 13. In the simplest case, the verification signal 13 contains the output string 12 or encodes it in a predefined manner. It may be provided that the trained large language model 4 is capable of retrieval-augmented generation and / or is operated by means of retrieval-augmented generation, whereby at least one information source 5 outside the trained large language model 4 is accessed for this purpose. The evaluation unit 3 may, in particular, provide a system 6 that combines information retrieval with the trained large language model 4. The at least one information source 5 may be stored in the evaluation unit 3. Alternatively or additionally, the at least one information source 5 may also be stored on a device located outside the device 1, for example, on a server 7, in particular a cloud server, to which a communication interface exists.The at least one information source 5 can, as already described in the general description, also be provided by a service provider and / or third-party provider. The at least one information source 5 can then be received, for example, via a suitable communication interface. It may be provided that at least one information source 5 includes and / or provides a description of the protocol structure. It may be provided that at least one information source 5 includes and / or provides a description of a structure and / or participants of the industrial communication network 20. It may be provided that at least one information source includes and / or provides 5 pieces of information that link technical states with their respective accompanying diagnostic information. It may be provided that at least one information source includes and / or provides instructions for a type and / or form of the output string 12 of the trained large language model 4. It may be provided that at least one information source includes and / or provides 5 instructions for verification and / or evaluation by the trained large language model 4. It may be provided that at least one information source 5 includes a link between technical states and / or diagnostic information with respective instructions for action. It may be provided that the query string 11 and / or the at least one information source 5 includes at least one command which contains a specification that the output string 12 of the trained large language model 4 includes a report with at least one specified report information. It may be intended that the query string 11 is generated based on a predefined query string 11 stored in memory. It can be provided that the procedure is started when an error 22 is detected and / or reported in the industrial communication network 21. The error 22, which is detected and / or reported by the industrial communication network 21 in a known manner, serves as a trigger to start the procedure, that is, the acquisition of the recording 10 and the evaluation of the recording 10 by the trained large language model 4. It can be provided that the procedure is carried out repeatedly and automatically. For this purpose, the device 1 is permanently connected to the communication link 21, in particular to a communication bus, of the industrial communication network 20 and records communication traffic on the communication link 21 at regular intervals, e.g., every x seconds, for a predetermined duration, for example, y seconds each time. Each of these regularly recorded recordings 10 is fed to the trained large language model 4 according to the procedure and processed by it in the manner described. It can be provided that, based on the output string 12 and / or the verification signal 13, at least one instruction 14 for reconfiguring the industrial communication network 20 is generated, whereby the industrial communication network 20 is reconfigured based on the at least one instruction 14. This can be done, for example, using a rule-based expert system, such as a database representing the expert system, in which one or more instructions 14 are stored for each of the output string 12 and / or the verification signal 13. The instruction 14 can then be implemented manually or automatically. The generation of the instruction 14 can be carried out, for example, using the evaluation unit 3, which is configured for this purpose. It can be provided that the trained large language model 4 is trained and / or the query string 11 is designed such that the output string 12 includes at least one instruction 14 for reconfiguring the industrial communication network 20, wherein the industrial communication network 20 is reconfigured based on the at least one instruction 14. In particular, it is provided that the instruction 14 directly contains encoded information that can be received and executed by at least one participant of the communication network 20 via the communication link 21, in particular via the communication bus, so that the at least one participant performs a reconfiguration, for example, by changing its communication behavior based on the instruction 14.It is specifically intended that instruction 14 be fed to the communication link 21, in particular the communication bus, i.e., sent via this link. Instruction 14 can be generated, for example, by means of the evaluation unit 3, which is configured for this purpose. Figure 2 shows a schematic flowchart of an embodiment of the method for verifying real-time communication on a communication link of an industrial communication network. The method is carried out, in particular, using a device according to the embodiments shown in Figure 1. In an optional process step 100, it is checked whether the industrial communication network has detected and / or reported an error. If this is not the case, process step 100 is repeated. If, however, this is the case, process step 101 is continued and the procedure is started. Alternatively, instead of checking, the procedure can also be started by a specialist, for example, because they have detected an error in the industrial communication network. In process step 101, communication on the communication link is recorded at at least one point in the communication network for a specified period of time using a network test access point, and a corresponding recording is provided. For this purpose, the technician selects a suitable point for integrating the network test access point into the industrial communication network. In process step 102, the recording is fed as input data to a trained large language model. This large language model, after training, possesses knowledge of at least one protocol structure of a protocol used on the communication link and / or has access to such knowledge. Furthermore, at least one query string is fed as input data to the trained large language model. This query string contains at least one command for checking a technical state of the communication link and / or the industrial communication network based on the recording. The query string can also be referred to as a prompt. The recording and the query string can also be fed to the trained large language model as a single prompt.It may be intended that the content of the recording is pre-processed, for example to change formatting and / or apply filters, for example to filter out part of the contained information, such as a data payload. The query string might include the following text, for example, if the trained large language model can also process natural language: - Which protocols are included in the capture? - Is the communication of the detected protocols error-free? - What anomalies are there? - How strong is the jitter of packet type XY? - etc. If the trained large language model does not understand natural language, a suitable coding can be chosen for the content based on similar questions. In process step 103, the trained large language model processes the recording and the query string (the prompt) and outputs a string representing and / or describing the technical state of the communication link and / or the industrial communication network. The trained large language model can consider at least one information source using retrieval augmented generation. Based on this, a verification signal is generated in process step 104, based on the output string. In the simplest case, the verification signal contains the output string. The verification signal or output string can, for example, contain the following information in natural language or another encoding, which relates to information from the data packets contained in the capture: - Ethertype - Protocol type - Data size - Sender and receiver address - Timestamp - Communication over the protocol is error-free / not error-free ◯ e.g., there was / no PING RESPONSE to a PING REQUEST - etc. In process step 104, the generated verification signal is output, for example displayed on a display device or in the form of a text file. In process step 104, it may be stipulated that the output string of the trained large language model includes a report with at least one predefined piece of report information. In particular, this can be achieved by accessing an information source via retrieval augmented generation, which defines the content and / or format of the report or the at least one predefined piece of report information. For example, the natural language report could include information on the following points: - Which protocols were detected in the capture? - Were any errors detected? - Which errors were detected? - What are the possible causes of the errors? - Recommended action(s) to isolate or correct the error In process step 105, it may be provided that the trained large language model is fed another query string, and the trained large language model then generates and provides another output string. This allows a specialist to perform targeted further queries, for example, to further narrow down an error and / or analyze the recording. The trained large language model retains knowledge of previous queries and outputs. In an optional process step 106, it may be provided that, starting from the output string and / or the verification signal, at least one instruction for reconfiguring the industrial communication network is generated, and the industrial communication network is reconfigured based on this at least one instruction. Alternatively, process step 106 may provide that the trained large language model is trained and / or the query string is structured such that the output string includes at least one instruction for reconfiguring the industrial communication network, and the industrial communication network is reconfigured based on this at least one instruction. In this case, the instruction is specifically fed directly into the communication network to effect the reconfiguration there. Figure 3 shows a schematic flowchart of an embodiment of the method for verifying real-time communication on a communication link of an industrial communication network. The method is carried out, in particular, using a device according to the embodiments shown in Figure 1. In this embodiment, the network test access point is permanently integrated into the industrial communication network. In an optional process step 200, it is checked whether the industrial communication network has detected and / or reported an error. Such an error could, for example, be an alarm in Profinet. If this is not the case, process step 200 is repeated. If, however, this is the case, process step 201 is executed and the procedure is started. Alternatively, instead of checking, the procedure can also be started by a specialist, for example, because they have detected an error in the industrial communication network. Another alternative is that the procedure can be carried out repeatedly and automatically. In process step 201, communication on the communication link, for example on a communication bus, is recorded at at least one point in the communication network for a specified time using the network test access point, and a corresponding recording is provided. Specifically, this is repeated every x seconds, and a recording is made for y seconds. Process steps 202 to 206 are the same as the previously described process steps 102 to 106. In process step 202, it may be provided that the query string is generated based on a predefined query string stored in memory. At least one information source may also be considered. In process step 204, it may be provided that an information source is accessed via retrieval augmented generation, which defines the content and / or form of the report or at least one predefined piece of report information. Further embodiments of the method have already been described above with reference to the device. Reference symbol list 1 Device 2 Network test access point 3 Evaluation device 4 Trained large language model 5 Information source 6 System 7 Server 10 Capture 11 Query string 12 Output string 13 Verification signal 14 Instruction 20 Industrial communication network 21 Communication link (e.g., communication bus) 22 Error 100-106 Procedure steps of the procedure 200-206 Procedure steps of the procedure QUOTES INCLUDED IN THE DESCRIPTION This list of documents cited by the applicant was automatically generated and is included solely for the reader's convenience. The list is not part of the German patent or utility model application. The DPMA accepts no liability for any errors or omissions. Cited non-patent literature Sifan Long et al., 6G comprehensive intelligence: network operations and optimization based on Large Language Models, IEEE Journal of Latex Class Files, Vol. 14, Nr. 8, August 2021

[0004]

Claims

Method for verifying real-time communication on a communication link (21) of an industrial communication network (20), comprising: capturing communication on the communication link (21) at at least one location of the communication network (20) for a specified time using a network test access point (2) and providing an associated recording (10); feeding the recording (10) as input data to a trained large language model (4), wherein the large language model (4) has, according to training, knowledge of at least one protocol structure of a protocol used on the communication link (21) and / or has access to such knowledge; feeding at least one query string (11) as input data to the trained large language model (4).wherein the query string (4) includes at least one command for checking a technical state of the communication link (21) and / or the industrial communication network (20) based on the recording (10), obtaining and providing an output string (12) of the trained large language model (4) representing and / or describing the technical state of the communication link (21) and / or the industrial communication network (20), generating a verification signal (13) based on the output string (12), and outputting the generated verification signal (13). Method according to claim 1, characterized in that the trained large language model is capable of retrieval-augmented generation and / or is operated by means of retrieval-augmented generation, wherein at least one information source (5) outside the trained large language model (4) is accessed for this purpose. Method according to claim 2, characterized in that the at least one information source (5) comprises and / or provides a description of the protocol structure. Method according to claim 2 or 3, characterized in that the at least one information source (5) comprises and / or provides a description of a structure and / or participants of the industrial communication network (20). Method according to one of claims 2 to 4, characterized in that the at least one information source (5) comprises and / or provides information that links technical states with corresponding diagnostic information. Method according to one of claims 2 to 5, characterized in that the at least one information source (5) comprises and / or provides instructions for a type and / or a form of the output string (12) of the trained large language model (4). Method according to one of claims 2 to 6, characterized in that the at least one information source (5) comprises and / or provides instructions for checking and / or evaluating by the trained large language model (4). Method according to one of claims 2 to 7, characterized in that the at least one information source (5) comprises a link between technical states and / or diagnostic information with respective instructions for action. Method according to one of the preceding claims, characterized in that the query string (11) and / or the at least one information source (5) comprises at least one command which includes a specification that the output string (12) of the trained large language model (4) comprises a report with at least one specified report information. Method according to one of the preceding claims, characterized in that the query string (11) is generated based on a predefined query string stored in a memory. Method according to one of the preceding claims, characterized in that the method is started when an error (22) is detected and / or reported in the industrial communication network (20). Method according to one of the preceding claims, characterized in that the method is repeatedly carried out automatically. Method according to one of the preceding claims, characterized in that, starting from the output string (12) and / or the verification signal (13), at least one instruction (14) for a reconfiguration of the industrial communication network (20) is generated, wherein the industrial communication network (20) is reconfigured based on the at least one instruction (14). Method according to one of the preceding claims, characterized in that the trained large language model (4) is trained and / or the query string (11) is designed such that the output string (12) comprises at least one instruction (14) for a reconfiguration of the industrial communication network (20), wherein the industrial communication network (20) is reconfigured based on the at least one instruction (14). Device (1) for checking real-time communication on a communication link (21) of an industrial communication network (20), comprising: - a network test access point (2), wherein the network test access point (2) is configured and / or controlled to capture communication on the communication link (21) at at least one location of the communication network (20) for a predetermined time and to provide an associated recording (10); - an evaluation device (3), wherein the evaluation device (3) is configured to provide a trained large language model (4) or to provide access to the trained large language model (4), wherein the large language model (4) has, according to training, knowledge of at least one protocol structure of a protocol used on the communication link (21) and / or has access to such knowledge.to feed the recording (10) as input data to the trained large language model (4), to feed at least one query string (11) to the trained large language model (4), wherein the query string (11) contains at least one command to check a technical state of the communication link (21) and / or the industrial communication network (20) based on the recording (10), to obtain and provide an output string (12) of the trained large language model (4) representing and / or describing the technical state of the communication link (21) and / or the industrial communication network (20), and to generate a verification signal (13) based on the output string (12) and output the generated verification signal (13).

Images