METHOD FOR EDITING APPLICATION PROGRAMS ON A DISTRIBUTED AUTOMATION SYSTEM

Description

[0001] The invention relates to a method for processing a safety-related user program for a safety controller which is configured to control an automated device which includes at least one protective device for performing at least one safety function, wherein the user program defines logical connections depending on a respective state of the at least one safety function for the safety controller to control the machine by the safety controller, and an automation system for carrying out the method.

[0002] It is well known that nowadays applications for the creation, commissioning, maintenance and generation of code for safety-related user programs run as a closed application on a device.

[0003] In this context, EP 0 997 807 A2, for example, discloses a method for the online update of safety-critical software in railway signaling technology, in particular for the deployment of production software to specific target computers. For this purpose, each participant in the processing chain receives a public and a private key. Furthermore, a certification authority is designated, which confirms the key's association with the participants by issuing a certificate. During the creation and testing of the safety-critical software in successive steps of the processing chain, each participant then receives, as a specification, the software and the signatures and key certificates of the predecessors generated with the private key.

[0004] Furthermore, EP 2 363 770 B1, for example, discloses a safety device with a configuration unit and a safety controller configurable therewith. The configuration unit generates a numerical code representing logic rules, based on which a control signal is generated by a control program of the safety controller depending on input signals.

[0005] From DE 10 2015 209 108 A1, a method for authorizing a function of an embedded target control unit is known, wherein a decision gateway requests a function request intended for the target control unit from a hardware security module and subsequently receives this request from the hardware security module, the function request having been previously signed by the hardware security module. Via a communication channel based on a cryptographic identity of the decision gateway, the received function request is also sent to a backend, which then receives a ticket corresponding to the function request and signed by the backend, and stores this ticket. After a request for release of the function by the target control unit, the function is released accordingly if the ticket is valid, and the ticket is then invalidated.

[0006] Furthermore, US2018227116A1 contains a method for generating and installing code such as smart contracts in blockchains that reside in a distributed database environment.

[0007] One objective of the invention is to demonstrate a technical method whereby the development of even more complex control logic and consequently the processing of application programs, including the generation of corresponding safety-related machine code, can take place on different devices and still be clearly traceable.

[0008] The technical solution according to the invention is provided by a method according to claim 1. Preferred embodiments are the subject of the dependent claims.

[0009] For a technical solution, the invention proposes a method for processing a safety-related user program for a safety controller, which is configured to control at least one automated device which includes at least one protective device for performing at least one safety function, wherein the user program defines logical connections depending on a respective state of the at least one safety function for the safety controller to control the machine by the safety controller, consequently a method in which data for a user program are generated successively on a plurality of device environments distributed from one another, each of which provides a safety-related user program processing tool for generating data, and which is further characterized by the following steps.On each of the device environments, data for the user program is generated via the safety-related user program editing tool provided by that device environment, and after the data has been generated, this generated data for the user program is transferred to one of the other of these device environments.

[0010] Before each transfer of generated data, a signature is generated by the signature device of the device environment on which the data to be transferred for the user program was generated, based at least on the entirety of the generated data, and the generated signature is transferred together with the generated data.

[0011] After each transfer of generated data along with a generated signature, a signature unit on the receiving device environment performs a check of the received signature. If the signature check is successful, data is generated again for the user program based on the received data, and the signature to be transferred along with this newly generated data is generated by the signature unit of the user program editing tool, based at least on the entirety of the data generated on this device environment and the respective received signature.

[0012] A key advantage is that every step in the processing of a safety-related application, i.e., every generation of data for the application, can be automatically documented and clearly traced at any time without requiring a self-contained application on a single device. Consequently, falsifications of a processing step can be automatically detected on other, even different, devices.

[0013] The technical solution according to the invention is also reflected in an automation system by a method according to claim 13.

[0014] For an automation system designed to carry out the method according to the invention, the invention further provides that this automation system comprises a plurality of device environments arranged at a distance from one another, each of which provides a safety-related user program editing tool for generating data for a user program for a safety controller, wherein the user program editing tool further comprises a signature device for generating a signature and for verifying signatures.It is advantageous to set up a first device environment of this plurality of different, geographically distributed device environments on a communication user terminal, in particular a mobile communication user terminal, to set up a second device environment on a cloud computer, and to set up at least one further device environment of this plurality of geographically distributed device environments.

[0015] Furthermore, the first device environment, the second device environment and the at least one further device environment have interfaces and are configured to transfer generated data together with a generated signature from the first to the second device environment, from the second to the at least one further device environment and, most preferably, also from the at least one further device environment to the second device environment.

[0016] The first device environment expediently provides, as a user program editing tool, a security-related programming tool for generating source code of the user program, as well as a signature device cooperating with the programming tool for generating a signature, at least on the basis of the entirety of the generated source code; and the second device environment expediently provides, as a user program editing tool, a security-related compilation tool for generating machine code of the user program, and, particularly preferably, also a security-related tool for generating commissioning data and / or test procedure data for the user program.and provides a signature device that works in conjunction with the tools to verify a currently received signature and to generate a signature, at least on the basis of all data generated on the second device environment and the last signature verified.

[0017] The processing of a safety-related user program for a safety controller, i.e., in particular the creation, commissioning, and maintenance of safety-related user programs, can therefore preferably be started on mobile communication user devices, e.g., phones, tablets, notebooks, or PCs with appropriate editors. The tools for creating the machine code as well as the commissioning data and / or test procedure data for the safety-related user program of the safety controller, on the other hand, are outsourced to a cloud server. Thus, within the scope of the invention, the generation of the machine code as well as the commissioning data and / or test procedure data takes place remotely and independently of the mobile device on such a cloud server, which, with the appropriately configured device environment, consequently handles the individual or...Application-related tools and the services required for them are combined in a system accessible via a computer network, preferably also accessible via the Internet, but centrally operated.

[0018] The identification between the individual device environments, such as phone, tablet, cloud computer, etc., and the security controller is nevertheless unambiguous due to the respective signature generation, transfer, and verification according to the invention. The data required for generating the machine code, and thus in particular the source data for the user program, expediently including any integrated object, parameterization, and / or library data and / or files, are secured with a unique signature and transmitted to the cloud computer.

[0019] Further features and advantages of the invention will become apparent from the following description of preferred embodiments with reference to the accompanying drawings, which show: Fig. 1 is a highly schematic representation of an embodiment of an automation system within the scope of the invention, Fig. 2 is a highly schematic sequence of an embodiment of a method within the scope of the invention, and Fig. 3 is a highly schematic sequence of a further embodiment of a method within the scope of the invention.

[0020] Preferred embodiments of the inventive method for processing a safety-related user program for a safety controller (not shown in detail in the figures for the sake of clarity) and an automation system suitably configured for its implementation are described in more detail below with reference to the drawings. The safety controller is configured to control an automated device which includes at least one protective device (also not shown in detail in the figures for the sake of clarity) for performing at least one safety function. The user program defines logical connections for the safety controller to control the machine, depending on the respective state of the at least one safety function.Such safety controllers and their applications are known to those skilled in the art and are therefore not described in detail here. For example, an automated device with at least one protective device, such as a punching machine, can be considered an application of such a safety controller. This device integrates the safety functions of an emergency stop and a light barrier. The protective device is thus used by the machine manufacturer to reduce risks for the user, i.e., to prevent or avoid hazards to people and / or the environment. In the example above, this means, in particular, that a protective device consisting of an emergency stop and a light barrier prevents hazards to the personnel operating the machine. The drive of this machine may only be activated if both safety functions, i.e.,The emergency stop and the light barrier report a safe state to the safety device. Monitoring of this safety device is carried out by a safety-related controller, i.e., within the terminology of this description and claims, by a safety controller, which activates or deactivates the drive according to the monitoring result and thus controls the machine as a whole, e.g., also bringing it to a safe state. Traditionally, a programmer creates a safety-related user program for the safety controller using suitable software. This program defines the logical connections for controlling the automated device, depending on the respective state of the at least one safety function. Examples of automated devices are described in the [reference to be added]. Fig. 2 and 3Labeled M1, M2, M3 and M4. The safety controller can be located within the automated device or control it externally.

[0021] Fig. 1 The figure shows, in a highly schematic representation, an embodiment of an automation system which, in contrast to the conventional creation of such a safety-related user program, uses a method similar to, for example, the following: Fig. 2 or Fig. 3Each embodiment of a method, depicted in a highly schematic sequence, can be carried out within the scope of the invention, i.e., with which the processing of application programs, and thus in particular the individual steps in the creation of application programs, is performed on different devices. Each device is therefore integrated into or provides its own device environment. In other words, a plurality of device environments involved in the processing of a respective application program within the scope of the invention, e.g., device environments E1, E2, E3a, and E4 according to [reference to relevant section], are involved. Fig.1 , each of which provides a safety-related user program editing tool T1, T2, T3a and T4 for generating data for a user program for a safety controller, are distributed and located remotely from each other and are therefore set up on different devices.

[0022] The data required for each user program, i.e., in particular starting with the creation of source code through compilation to the data required for commissioning and maintenance, are thus generated successively on such distributed and remotely arranged device environments and then transferred together with a signature to another of these device environments.

[0023] A first device environment E1 is furthermore expediently set up on a communication user terminal, in particular on a PC, a notebook, or a mobile device such as a tablet or smartphone. The first device environment E1 preferably includes, as a user program editing tool T1, a security-related programming tool configured for generating source code of the user program, as well as a signature device interacting with the programming tool for generating a signature, at least on the basis of the entirety of the generated source code.

[0024] Preferably, the first device environment E1 is set up on a mobile communication user terminal, so that a programmer starting or initiating the processing of a user program can work as independently of location as possible.

[0025] A second device environment, designated by reference numeral E2, within this plurality of distributed device environments is preferably set up on a cloud server. In addition to providing computing services known per se, such as servers, storage, databases, network components, software, analysis or intelligent functions, etc., via a computer network ("the cloud"), such as a corporate network or the internet, such a device environment can therefore conveniently combine the individual or application-specific tools and services in a system accessible via the computer network, and preferably also via the internet, but centrally operated.

[0026] As in Fig. 1As indicated, the first device environment E1 and the second device environment E2 are equipped with interfaces I1, I2 and are set up to transfer the data generated on the first device environment E1 together with a signature generated there from the first device environment E1 to the second device environment E2.

[0027] The second device environment E2, which is therefore set up to receive the data generated on the first device environment E1, in particular the source code, including any embedded object, parameterization, and / or library data and / or files, and the generated signature, expediently includes a security-related compilation tool as the user program editing tool T2 for generating machine code of the user program. Furthermore, the user program editing tool T2 of the second device environment E2 preferably also includes a security-related tool for generating commissioning data and / or test procedure data for the user program, as explained in more detail below.Furthermore, the second device environment E2, conveniently as part of the application program editing tool T2, has a signature device that works in conjunction with the tools to check a currently received signature and to generate a signature at least on the basis of the entirety of data generated on the second device environment E2 and the last signature checked.

[0028] Furthermore, the automation system within the scope of the invention has at least one additional configured device environment. Fig. 1Five further device environments E3a, E3b, E3c, E3d, and E4 are shown, equipped with interfaces I3a, I3b, I3c, I3d, and I4. Preferably, a plurality of further configured device environments are provided. These at least one further device environment E3a, E3b, E3c, E3d, and E4, respectively, and the second device environment E2 are further conveniently configured to transfer generated data, along with a generated signature, from the second to the at least one further device environment, and particularly preferably also from the at least one further device environment to the second device environment.

[0029] At least one of these other device environments, at Fig. 1For example, the four additional device environments E3a, E3b, E3c, and E3d are advantageously set up on an automated device, for whose control the safety-related user program of the safety controller is processed according to the invention. In this case, commissioning data generated on device environment E2 are preferably also transferred to such an additional device environment.

[0030] Additionally or alternatively, one of these other device environments can also be used, in the case of Fig. 1 For example, the additional device environment E4 might be set up on a device providing a test environment. In this case, test procedure data generated on device environment E2 would also preferably be transferred to such an additional device environment.

[0031] As previously mentioned, the Fig. 2 or Fig. 3In each case, a highly schematic embodiment of the processing of a safety-related user program according to the invention using such an automation system is described. In this embodiment, the respective data for the user program are generated on each of the device environments using the safety-related user program processing tool provided by that device environment, and a signature is generated based on all of this generated data. Subsequently, this generated data, together with the signature, is transferred to another of these device environments.

[0032] According to Fig. 2 and 3For example, on device environment E1, the data designated proj.data is generated, and based on this data, i.e., in particular the source code, and expediently including any included object, parameterization, and / or library data and / or files, the signature designated Sig1 is generated. Subsequently, the data designated proj.data, i.e., in particular the source code data, expediently including any included object, parameterization, and / or library data and / or files, together with the signature designated Sig1, is transferred to device environment E2, as indicated by the arrow marked with the reference symbol 1.

[0033] After the transmission of such generated data along with the signature, the received signature is first verified by a signature module on the receiving device environment. If the signature verification is successful, data for the user program is generated again on this device environment based on the received data. A signature, which is then transmitted along with this newly generated data, is further generated by the signature module of this device environment, taking into account at least all the data generated on this device environment and the respective received signature.

[0034] According to Fig. 2 and 3For example, on device environment E2, after the signature labeled Sig.1 has been successfully verified, the data labeled comp.data is generated again, at least based on the received data labeled proj.data. This data, labeled comp.data, generated on device environment E2, is then conveniently stored there. Furthermore, the signature labeled Sig2 is generated based on the regenerated data labeled comp.data and the received signature labeled Sig1.

[0035] Data generated in this way, along with the signature generated for this purpose, can therefore be transferred to another device environment that follows in the data processing process, or, depending on the processing sequence and the processing steps included, to a device environment on which no further data is generated.

[0036] However, it is preferred that data for the user program be generated sequentially on the distributed device environments, at least until the user program has been fully commissioned as intended, as can be seen below.

[0037] As in the embodiments according to Fig. 2 and 3 In a preferred embodiment, metadata, referred to as MetaData in the figures, is also transmitted with each transfer of the generated data and signature. This metadata can relate in particular to the respective device environment on which the generated data was created, and / or the date of data generation, and / or a user of an application program editing tool that generated the data. Furthermore, as in the embodiment according to Fig. 3As can be seen, SmartContract data, referred to as SmartContract in the figure, are also transmitted, particularly concerning the device environment to which the generated data is transferred. As is known per se, SmartContracts are based on computer protocols, especially using blockchain technology, and enable automatic contracts that come into effect upon certain events without requiring human oversight. Within the scope of the invention, therefore, a predetermined further action can be automatically triggered upon the occurrence of a specific event using SmartContracts, particularly on the device environment to which the transmitted data is transferred.

[0038] Taking into account the foregoing statements regarding the Fig. 1 , 2 and 3 are therefore preferred according to Fig. 2 and 3Source code data for the user program is generated on the device environment E1 as data designated proj.data, and machine code data for the user program is generated on the device environment E2 as data designated comp.data.

[0039] The in Fig. 2 and 3 The embodiments shown thus represent, in particular, an exemplary embodiment in which the safety-related user program is first developed within the framework of a specific project using a programming tool, i.e., expediently using a program editor, and source code for this safety-related user program is generated. The device environment E1 therefore has, in a special version, this programming tool as a user program editing tool (T1, Fig. 1) and is preferably set up as or on a communication user terminal, e.g., a PC, notebook, or mobile device such as a tablet or smartphone. After the data designated proj.data, i.e., specifically the source code data for this security-related user program within a specific project, has been generated, this data, expediently including any embedded object, parameterization, and / or library data and / or files, is sent to at least one compiler as the compiling tool of the user program editing tool (T2, Fig. 1) the device environment E2, see reference 1, wherein the device environment E2 in this embodiment is set up on a cloud computer. The transfer is expediently carried out in the form of a file containing all this data. However, further metadata, such as the name of the editor who made the last change, is also preferably transferred, with the aforementioned file expediently also containing this metadata. Alternatively to the metadata, or additionally, in a particularly preferred embodiment ( Fig. 3 ) via the user program editing tool (T1, Fig. 1SmartContract data, generated in the form of a program, is transferred, containing the condition(s) for automatic further processing. The aforementioned file also expediently contains this SmartContract data. In particular, the source code data generated on the device environment E1 is expediently protected against any kind of falsification during the transfer. Subsequently, a signature Sig.1 is generated based on all the data generated on the device environment E1. For this purpose, a unique signature is calculated for all of this data generated on the device environment E1. The signature Sig.1 is appended to the generated data and transferred together with it, see reference 1, preferably also within the aforementioned file.

[0040] The compiler(s) run on the cloud server with the E2 device environment. Before further processing the security-related application program, this compiler(s) checks the received signature Sig.1 and, after successful verification, generates the comp.data file from the source code data contained in the received file. Fig. 2 and 3The data referred to is, according to the exemplary embodiment, executable machine code for the safety controller. If the compilation process is successfully completed, a signature can, in the simplest implementation according to the invention, be generated again based on this generated data, i.e., a signature can be calculated again via the machine code, additionally incorporating the previously received signature Sig.1, and the newly generated signature, at least together with the machine code, can be transmitted to another device environment of this plurality of geographically distributed device environments. This device environment can, for example, be set up on an automated device to be controlled.

[0041] It is useful, especially depending on the application-specific nature of the SmartContract data that may be transmitted and thus received, to process it via the user program editing tool (T2, Fig. 1) In addition to the machine code data, the device environment E2 also generates commissioning data for the user program and passes the generated machine code data and commissioning data to at least one other device environment for commissioning the user program. In this case, the regeneration of the signature to be passed is therefore additionally based on the generated commissioning data. However, it should be noted that such commissioning data for the user program can also be generated in a modified form on another device environment, as shown in the figures.For the sake of clarity, a device environment can be created that is not shown, which initially only receives the machine code together with the newly generated signature from device environment E2, and this other device environment then passes the commissioning data as generated data together with a correspondingly newly generated signature and the machine code data to at least one other device environment for commissioning the user program.

[0042] In a particularly preferred design, however, as in the embodiments shown below, Fig. 2 and 3 , via the user program editing tool (T2, Fig. 1 ) of the device environment E2 in addition to the machine code data, i.e., especially upon successful completion of the compilation process, test procedure data, in the Fig. 2 and 3Designated as testdata, the machine code data and test procedure data are generated for the user program, and the generated data is initially passed to another device environment E4 (one of a plurality of geographically distributed device environments) for testing the user program. In this case, the regeneration of the signature Sig.2, which is also to be passed, consequently takes place, at least additionally, based on the generated test procedure data. However, it should be noted that such test procedure data for the user program can also be generated in a modified form on another device environment, as shown in the figures.For the sake of clarity, a device environment can be created that is not shown, which initially only receives the machine code together with the newly generated signature from device environment E2, and this other device environment then passes the test procedure data as generated data together with a correspondingly newly generated signature and the machine code data to at least one further device environment E4 for testing the user program.

[0043] On the subsequent device environment E4, after receiving the machine code data and test procedure data, and if the verification of the received signature Sig.2 is error-free, a test procedure is executed and test result data is stored. Fig. 2 and 3The test result data, designated as testrec.data, is generated for the user program. This test result data is then, in a particularly preferred configuration, passed back to the device environment E2. In this configuration, the generated data testrec.data is used as the basis for the signature Sig.3 to be passed along with the test result data, and the previously received signature Sig.2 is also included. However, it should be noted that, in a modified form, the test result data can also be passed to a different device environment instead of device environment E2, which is not shown in the figures for the sake of clarity.

[0044] This thus returns to the point with reference to the in Fig. 2 and 3 In the embodiments shown, the previously described embodiment on the device environment E2 performs the compilation process for generating the comp.data in the Fig. 2 and 3The data specified in the source code data contained in the received file was successfully completed, and in the case of additionally transmitted SmartContract data ( Fig. 3Thus, when a specific event occurs, test procedure data (testdata) is generated for individual test cases in the safety-related user program on the device environment E2. Subsequently, the new signature (Sig.2) is calculated using the machine code (comp.data), the test procedure data (testdata), and, where appropriate, further metadata such as information about the compiler(s), the signature (Sig.1) from the previous processing step, and / or, where appropriate, further conditions for automatic further processing in the form of SmartContract data. A condition contained in the SmartContract data could, for example, be that after the successful execution of all test cases, the results are automatically transferred back to the device environment E2 in a defined manner, i.e., according to the example implementation, to the cloud computer. The aforementioned data is then conveniently forwarded to a test environment in the form of a file, i.e., according to the example implementation. Fig. 2 and 3passed to the further device environment E4, see reference 2.

[0045] Once the test has been successfully completed and the corresponding test result data, testrec.data, has been generated, a condition such as the aforementioned one is fulfilled. The results are therefore automatically and conveniently transferred back to the device environment E2. The signature Sig.3, which must be transferred along with the results, is recalculated and thus regenerated using the test procedure data testdata contained in the test results, the signature Sig.2 from the previous processing step of the device environment E2, and, if applicable, other metadata such as information about the test environment and / or SmartContract data. The aforementioned data, together with the signature Sig.3, is then conveniently transferred to the cloud server in the form of a file (see reference 3).

[0046] Once the test results of the successfully completed test are available on the cloud computer, i.e., generally the device environment E2, the received signature Sig.3 is checked again. If this signature check is error-free, commissioning data for the user program is then generated according to the preferred implementation described above, as previously outlined. In a particularly preferred further development, the cloud computer, i.e., generally the device environment E2, then only generates the commissioning data... Fig. 2 and 3The generated data, designated as startdata, is made available together with the previously generated machine code data comp.data, e.g., in the form of a commissioning file, and is then transferred to the previously described third device environment E3a for commissioning the user program. As mentioned above, this machine code data is conveniently stored on the device environment E2. Along with this generated data, and especially within such a file, a signature Sig.4 is again transferred, which is generated based on all the data described above and the received signature, i.e., specifically via the machine code, the commissioning data, and preferably also via further metadata, such as who generated the commissioning data and / or further SmartContract data, such as..., that for release a complete validation of the wiring must have been carried out, and is calculated via the signature received from step 3. Together with the signature Sig.4, this file is then transferred to device environment E3a, which is set up on an automated device to be controlled, for commissioning, cf. reference 4.

[0047] On the device environment E3a of the majority of distributed, geographically dispersed device environments, after receiving the machine code data and commissioning data and if the signature verification Sig.4 is error-free, a commissioning procedure is carried out and, when the commissioning is completely finished, commissioning validation data is expediently generated. Fig. 2 and 3 Designated as com.data, it is generated for the user program.

[0048] A file containing the validation result is generated. This commissioning validation data, also contained in a file, is supplemented with a new signature, Sig.5. This signature is generated in the same manner as the preceding processing steps and is therefore calculated primarily using the previously received signature, Sig.4, from the preceding processing step, the results (i.e., the commissioning validation data), and, where appropriate, other metadata such as who performed the validation and / or other SmartContract data. Subsequently, this commissioning validation data, along with any other data contained in the file and the signature Sig.5, is returned to the device environment E2, i.e., to complete the full intended commissioning of the user program.In this specific embodiment, the data is transferred to the cloud computer, see reference numeral 5. However, it should be noted that, alternatively, the commissioning validation data can also be transferred to a different device environment instead of device environment E2, which is not shown in the figures for the sake of clarity.

[0049] Once the commissioning and validation steps are complete, the safety-related user program is considered certified. For this purpose, according to the preferred implementation shown, certification data is generated on the device environment E2 if the signature verification (Sig.5) is error-free. Fig. 2 and 3The machine certificate is generated for the user program and expediently stored on the device environment E2, in particular in a certificate for device environments that are set up on an automated device to be controlled, which includes at least one protective device for executing at least one security function. Furthermore, a new signature Sig.6 is generated, i.e., calculated from the certification data as generated data, the previously generated machine code, and expediently further metadata and / or SmartContract data, as well as the signature Sig.5 received from the previous processing step. This newly generated signature Sig.6 is expediently entered into the aforementioned certificate, which is preferably located on the cloud computer, i.e., generally on the device environment E2. Subsequently, the aforementioned data, together with the newly generated signature Sig.6. Automated transfer to multiple device environments E3b, E3c and / or E3d, or additionally or alternatively E3a, which are set up on an automated device to be controlled, which includes at least one protective device for performing at least one safety function, see reference numeral 6. As described above, such automated devices are in the . Fig. 2 and 3 labelled M1, M2, M3 and M4.

[0050] On device environments E3b, E3c, E3d, and / or E3a, after receiving the certification data and machine code data and if the signature verification is successful, the user program can be executed as intended. To verify the signature Sig.6, a preferred implementation specifically provides that on device environments E3b, E3c, E3d, and / or E3a, and thus in particular on the automated device, an online verification is performed to check whether the signature Sig.6 of the received file is entered in the corresponding machine certificate on device environment E2. If the verification is successful, the machine code is then executed. However, it should be noted that the certificate can also be stored on a different device environment instead of device environment E2, which is not shown in the figures for clarity.

[0051] Considering the foregoing description, it is thus evident that the generation of commissioning and / or test procedure data is neither mandatory nor is it mandatory that such commissioning and / or test procedure data be generated on the device environment E2. Consequently, it is also not mandatory that newly generated data based on the test procedure and / or commissioning be transferred back to the device environment E2. Thus, in addition to the device environment E2, other device environments or instances may also be included within the scope of the invention, on which the respective processing steps, preferably carried out on the device environment E2 according to the foregoing description, are then performed.If it is necessary to access machine code data in this process, it must then be transferred, in a suitably signed manner as described above, to the other device environment intended for the corresponding processing step.

[0052] Considering the foregoing description, the present invention therefore relates, in the context of developing a safety-related user program for a safety controller, and in a particularly preferred embodiment, especially to the creation, commissioning, and maintenance of safety-related user programs for a control device for automation machines using mobile devices such as smartphones, tablets, notebooks, or PCs. For this purpose, the editors run on the respective mobile device, while the compilers for generating the machine code run on a remote cloud server. The generation of the machine code for the safety controller thus takes place on a cloud server. The identification between the mobile device and the safety-related control device is unambiguous, and the data required for generating the machine code, such as...The source code data of the application program is secured with a unique signature and transferred to the cloud server. On the cloud server, the machine code is generated from the transferred data. A new signature is generated using the resulting data and the signature from the previous step. If the machine code generation is successful, the generated machine code, along with the signature and any metadata, can be automatically or manually transferred to a test environment. This automation is preferably implemented using a smart contract within the signature. When using smart contracts, the code of the smart contract is also secured via the signature. Test cases can then be executed in a test environment to verify the security-related application program. If the tests are successful, the test data and any metadata are transferred to the test environment.A new signature is calculated from the existing metadata, incorporating the signature from the previous step. Here too, it is preferably stipulated via smart contracts that the data, with the newly calculated signature, is only transferred back to the cloud server or, alternatively, to another instance after a successful test. If the test is successful, a new signature is calculated from the machine code, potentially including additional commissioning data and the signature from the previous step, and then transferred to a machine for commissioning. It is also specified that automatic program release only occurs after successful commissioning. Once commissioning is successfully completed, a new signature is calculated from the machine code, potentially including additional data such as certification data, and the signature from the previous step, and the data is then distributed to the machines.Using the signature, which was appropriately transmitted to the machine, the entire safety lifecycle can be traced, and the machine can perform an online verification against a machine certificate stored on the cloud server or, alternatively, on another instance. This ensures that the safety-related application has completed all steps of the safety lifecycle and is certified.

[0053] In particular, the entire safety lifecycle is covered, including simulation of the application, commissioning and distribution to the machines, as each step in the lifecycle is automatically documented and can be clearly traced at any time, and falsifications of a step can be detected.

Claims

1. Method for processing a safety-related user program for a safety control system that is designed to control at least one automated device (M1, M2, M3, M4) that includes at least one protective device for performing at least one safety function, wherein the user program defines logical links depending on a respective state of the at least one safety function for the safety control system for controlling the automated device (M1, M2, M3, M4) by the safety control system, characterized by the steps: - generating data (proj.data, comp.data, startdata, testdata, testrec.data, com.data, machine certificate, cert.data) for an user program sequentially on a plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another, each of which provides a safety-related user program processing tool (T1, T2, T3a, T3b, T3c, T3d, T4), wherein the data (proj.data, comp.data, startdata, testdata, testrec.data, com.data, machine certificate, cert.data) for the user program are generated on a respective device environment of the device environments (E1, E2, E3a, E3b, E3c, E3d, E4) via the safety-related user program processing tool (T1, T2, T3a, T3b, T3c, T3d, E4) provided in each case by this device environment (E1, E2, E3a, E3b, E3c, E3d, E4). E3b, E3c, E3d, E4) and, after the data (proj.data, comp.data, startdata, testdata, testrec.data, com.data, machine certificate, cert.data) are generated, the generated data are transferred (1, 2, 3, 4, 5, 6) together with a signature (Sig1, Sig2, Sig3, Sig4, Sig5, Sig6) to another of these device environments (E2, E3a, E3b, E3c, E3d, E4), - wherein, prior to the transfer of the generated data together with the signature (Sig1, Sig2, Sig3, Sig4, Sig5, Sig6), this signature is generated at least on the basis of the entirety of the generated data by a signature device of the device environment (E1, E2, E3a, E3b, E3c, E3d, E4) at least on the basis of the entirety of the generated data, on which the data (proj.data, comp.data, startdata, testdata, testrec.data, com.data, machine certificate, cert.data) for the user program has been generated, - wherein, after the transfer of the generated data together with the signature (Sig1, Sig2, Sig3, Sig4, Sig5, Sig6) on the device environment (E2, E3a, E3b, E3c, E3d, E4) receiving these data (proj.data, comp.data, startdata, testdata, testrec.data, com.data, machine certificate, cert.data) and signature (Sig1, Sig2, Sig3, Sig4, Sig5, Sig6) ∘ the received signature (Sig1, Sig2, Sig3, Sig4, Sig5, Sig6) is checked by a signature device of this device environment (E2, E3a, E3b, E3c, E3d, E4), and if the result of the signature check is error-free ∘ Data (comp.data, startdata, testdata, testrec.data, com.data, machine certificate, cert.data) for the user program based are newly regenerated based on the received data (proj.data, comp.data, startdata, testdata, testrec.data, com.data, machine certificate), and the signature (Sig2, Sig3, Sig4, Sig5, Sig6) to then be transferred together with this newly generated data is generated by the signature device of this device environment (E2, E3a, E3b, E3c, E3d, E4) at least based on the entirety of the data (comp.data, startdata, testdata, testrec.data, com.data, machine certificate, cert.data) generated on this device environment (E2, E3a, E3b, E3c, E3d, E4) and the respective received signature (Sig1, Sig2, Sig3, Sig4, Sig5).

2. Method according to the preceding claim, wherein data for the user program is generated sequentially on the device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another, at least until the completion of a complete intended start-up of the user program.

3. Method according to one of the preceding claims, wherein, when the generated data is transferred together with the signature (Sig1, Sig2, Sig3, Sig4, Sig5, Sig6), additional metadata (MetaData) is also transferred in each case, in particular concerning the device environment (E1, E2, E3a, E3b, E3c, E3d, E4) on which the generated data was generated, concerning the date of data generation and / or concerning a user of the user program processing tool (T1, T2, T3a, T3b, T3c, T3d, T4) that generated the data (proj.data, comp.data, startdata, testdata, testrec.data, com.data, machine certificate, cert.data), and / or SmartContract data concerning the device environment (E2, E3a, E3b, E3c, E3d, E4) to which the generated data is transferred.

4. Method according to one of the preceding claims, wherein - on a first (E1) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) source code data (proj.data) for the user program is generated and transferred (1) from this as generated data to a second (E2) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another, - on the second (E2) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another, machine code data (comp.data) for the user program is generated after receiving the source code data (proj.data) and if the result of the signature check is error-free, - the machine code data (comp.data) is transferred (2, 4) as generated data to at least one third (E3a, E3b, E3c, E3d) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another.

5. Method according to the preceding claim 4, wherein - in addition to the machine code data (comp.data), in particular on the second (E2) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another, after receiving the source code data (proj.data), startup data (startdata) for the user program is generated, and - the machine code data (comp.data) and start-up data (startdata) are transferred (4) as generated data to at least one third (E3a) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another for start-up of the user program.

6. Method according to the preceding claim 4, wherein - in addition to the machine code data (comp.data), in particular on the second (E2) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another, after receiving the source code data (proj.data), test procedure data (testdata) for the user program are generated, and - the machine code data (comp.data) and test procedure data (testdata) are transferred (2) as generated data to a fourth (E4) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another for testing the user program, - on the fourth (E4) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another, after receiving the machine code data (comp.data) and test procedure data (testdata) and if the result of the signature check is error-free, a test procedure is run and test result data (testrec.data) is generated for the user program, - the test result data (testrec.data) is transferred (3) as generated data to the second (E2) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another .

7. Method according to the preceding claim 6, wherein - on the second (E2) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another, after receiving the test result data (testrec.data) and if there is an error-free result of the signature check, start-up data (startdata) for the user program is generated, and - the start-up data (startdata) is transferred (4) as generated data together with the previously generated machine code data (comp.data) to a third (E3a) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another for start-up of the user program.

8. Method according to the preceding claims 5 or 7, wherein - on the third (E3a) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another, after receiving the machine code data (comp.data) and start-up data (startdata) and if the result of the signature check is error-free, a start-up procedure is run and start-up validation data (com.data) is generated for the user program, and - the start-up validation data (com.data) is transferred (5) as generated data to the second (E2) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another for concluding the complete intended start-up of the user program .

9. Method according to the preceding claim 8, wherein on the second (E2) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another, after receiving the start-up validation data (com.data) and if the result of the signature check is error-free, certification data (machine certificate) for the user program is generated.

10. Method according to the preceding claim 9, wherein the generated certification data (machine certificate) is stored on the second (E2) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another.

11. Method according to the preceding claim 9 or 10, wherein the certification data (machine certificate) is transferred (6) as generated data together with the previously generated machine code data (comp.data) to a number of third (E3a, E3b, E3c, E3d) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another.

12. Method according to the preceding claim 11, wherein on the number of third (E3a, E3b, E3c, E3d) of the plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another, after receiving the certification data (machine certificate) and machine code data (comp.data) and, if the signature check yields an error-free result, the user program is executed as intended.

13. Automation system for carrying out the method according to one of the preceding claims 1 to 12, comprising: - a plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another, each of which has a safety-related user program processing tool (T1, T2, T3a, T3b, T3c, T3d, T4) for generating data (proj.data, comp.data, startdata, testdata, testrec.data, com.data, machine certificate, cert.data) for a user program for a safety control, wherein the user program processing tool (T1, T2, T3a, T3b, T3c, T3d, T4) further comprises a signature device, - wherein - a first device environment (E1) of this plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another is configured on a communication user terminal equipment which is set up in particular as a mobile communication user terminal equipment, - a second device environment (E2) of this plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another is configured up on a cloud computer, and - at least one further device environment (E3a, E3b, E3c, E3d, E4) of this plurality of device environments (E1, E2, E3a, E3b, E3c, E3d, E4) distributed spaced apart from one another is configured, wherein - the first device environment (E1), the second device environment (E2) and the at least one further device environment (E3a, E3b, E3c, E3d, E4) have interfaces (I1, I2, I3a, I3b, I3c, I3d, I4) and are designed to transfer data generated in each case together with a signature (Sig1, Sig2, Sig3, Sig4, Sig5, Sig6) generated in each case from the first (E1) to the second device environment (E2), from the second (E2) to the at least one further device environment (E3a, E3b, E3c, E3d, E4) and from the at least one further device environment (E3a, E3b, E3c, E3d, E4) to the second device environment (E2), and in particular wherein - the first device environment (E1) provides as an user program processing tool (T1) a safety-related programming tool for generating a source code of the user program and a signature device cooperating with the programming tool for generating a signature (Sig1) at least on the basis of the entirety of the generated source code, - the second device environment (E2) provides, as an user program processing tool (T2), a safety-related compilation tool for generating a machine code of the user program and, preferably, also a safety-related tool for generating start-up data (startdata) and / or test procedure data (testdata) for the user program, and wherein the second device environment (E2) provides a signature device cooperating with the tool or tools for checking a respectively currently received signature (Sig1, Sig3, Sig5, Sig6) and for generating a signature (Sig2, Sig4) at least on the basis of the entirety of data (comp.data, startdata, testdata, machine certificate) generated on the second device environment (E2) and the last signature (Sig1, Sig3, Sig5, Sig6) checked in each case.