Control system of a technical plant

Description

[0001] The invention relates to a control system for a technical plant, in particular a manufacturing or process plant, with the features of claim 1. The invention also relates to a method for operating a technical plant by means of a control system according to claim 3.

[0002] Simulation models that replicate the behavior of a process plant or a part of it are used for validation within the context of a (process) control system. For a given input, the simulation models should always produce the same output. By manipulating the simulation models, the associated tests can also be manipulated.

[0003] It is known that simulation models can be generated outside the actual control system using suitable tools, such as the "SIMIT" simulation tool from Siemens. Protecting these external simulation models is also known and is described, for example, in EP 3379351 A1. However, the simulation models used there do not have a strong, i.e., undeniable and not easily manipulated, connection to the respective technical system or system component. Furthermore, as of today, there is no protection against unauthorized access to particularly sensitive and therefore especially sensitive simulation models.

[0004] The computer-aided design and subsequent optimization of the operation of technical systems, especially process plants, often require extensive acceptance and certification measures, depending on the changes in certain industries (e.g., pharmaceuticals). After successful acceptance, there are limits to the permissible technical modifications without requiring a new acceptance test.

[0005] Furthermore, there are currently no automated processes for detecting changes relevant to acceptance testing and subsequently initiating the re-acceptance process. This results in considerable effort and therefore high costs for the approval of a technical system.

[0006] The invention is based on the objective of providing a control system that enables a reproducible and manipulation-proof virtual acceptance of technical systems or system components.

[0007] This problem is solved by a control system for a technical plant with the features of claim 1. Furthermore, the problem is solved by a method for operating a technical plant by means of a control system with the features of claim 3.

[0008] Beneficial further training opportunities arise from the dependent requirements.

[0009] A control system according to the invention for a technical plant, in particular a manufacturing or process plant, has at least one engineering station server which is designed and intended for use in the context of engineering the technical plant.

[0010] The control system is characterized by the fact that at least one first hierarchically structured digital representation of a first part of the technical system and at least one second hierarchically structured digital representation of a second part of the technical system are implemented on the Engineering Station Server.

[0011] In this process, a first simulation model is assigned to the first hierarchically structured digital representation of the first part of the technical system, and a second simulation model is assigned to the second hierarchically structured digital representation of the second part of the technical system.

[0012] The first simulation model can be used to simulate the technical behavior of the first part of the technical system, and the second simulation model can be used to simulate the technical behavior of the second part of the technical system.

[0013] In this context, a control system is understood to be a computer-aided technical system that includes functionalities for representing, operating, and controlling a technical plant, such as a manufacturing or production facility. The control system can include sensors for acquiring measured values ​​as well as various actuators. Furthermore, the control system can include so-called process- or production-related components that serve to control the actuators or sensors. In addition, the control system can include, among other things, means for visualizing the technical plant and for engineering purposes. The term "control system" also encompasses additional computing units for more complex control systems and systems for data storage and processing.

[0014] A technical installation can be a plant from the process industry, such as a chemical, pharmaceutical, petrochemical, or food and beverage plant. This also includes any plant from the manufacturing industry, such as factories where cars or goods of all kinds are produced. Technical installations can also come from the energy generation sector. Wind turbines, solar panels, or power plants for energy production are likewise encompassed by the term "technical installation."

[0015] In this context, an "Engineering Station Server" refers to a server designed to create, manage, archive, and document various hardware and software projects for the control system of a technical plant. Using specialized software design tools (Engineering Toolset) as well as pre-built modules and plans, the Engineering Station Server can be used to plan and manage the interaction of control system devices and equipment within the technical plant. An example of this is the SIMATIC Manager Server from Siemens.

[0016] The digital representations of the plant components are hierarchically structured. This means that individual components of the plant components, such as motors, pumps, valves, tanks, sensors, or actuators, are related to each other in a hierarchical relationship, which is stored in the Engineering Station Server. This is also referred to as a "technological hierarchy." Because the simulation models are fixed and assigned to the respective plant components, they can be used directly for the acceptance testing of each component. In particular, when changes are made to the plant's configuration that might alter the hierarchically structured digital representation of the plant components, the simulation model allows for a simple and efficient assessment of whether a new acceptance test of the plant, or more precisely, of the affected plant component, is necessary.

[0017] According to the invention, the first hierarchically structured digital representation of the first part of the technical system and / or the second hierarchically structured digital representation of the second part of the technical system have a digital seal by means of which the authenticity of the first and / or second hierarchically structured digital representation can be determined.

[0018] For sealing purposes, a hash value can be generated for the (acceptance-relevant) hierarchically structured digital representations of the respective part of the technical system. The cryptographic link of this hash value to the respective hierarchically structured digital representation can be ensured by a trusted authority (e.g., an auditor) digitally signing the data structure, which contains both the hash value and an ID of the hierarchically structured digital representation. Provided the necessary authorization is in place, an authority (e.g., a project engineer, an auditor) can issue the digital seals and thereby effectively "freeze" the current design status of the technical system.Once a seal is broken, it cannot be repaired - each new seal is different from the previous one, so that a difference can be reliably detected during an audit or even between audits.

[0019] If the seal was broken due to an optimization in the respective part of the technical system, it must be verified whether the optimization allows for a new acceptance test. For this purpose, the simulation model permanently assigned to the respective part of the technical system can be used. This simulation model virtually contains the test cases that are important for the acceptance of the respective part of the technical system. This allows for the best possible preparation for the acceptance test – even if parts of it have to be carried out on the actual technical system.

[0020] Within the scope of the invention, the first simulation model, which is permanently assigned to the first hierarchically structured digital representation of the first part of the technical system, and / or the second simulation model, which is permanently assigned to the second hierarchically structured digital representation of the second part of the technical system, have a digital seal by means of which the authenticity of the first and / or second simulation model can be determined.

[0021] To prevent undetected manipulation of the simulation models and to achieve a strong, i.e., undeniable and not easily tampered with, link to the underlying technical system and / or the underlying part of the technical system, the simulation models are advantageously secured by sealing – using appropriate authentication and tamper-proof mechanisms. The sealing ensures, in particular, that any modification made to the technical system / part of the technical system will "force" the breaking of the existing seal and the resealing by a responsible, trusted (appropriately certified and accredited) authority.

[0022] Preferably, the first and / or second simulation model incorporate encryption to prevent unauthorized access. This encryption can be implemented, for example, using a secret key belonging to the entity that previously digitally sealed the simulation model. This, in addition to the advantages described above, eliminates the possibility of misuse resulting from unauthorized access to the simulation model. This allows for the secure protection of particularly sensitive and therefore highly sensitive simulation models.

[0023] In the context of industrial security, the described combinations of features offer optimal protection for simulation models and the hierarchically structured digital representations of the individual parts of a technical system with regard to the fundamental security objectives of integrity, authenticity, and confidentiality. Furthermore, the control system according to the invention and the described advantageous enhancements help ensure that the simulation models can prove their originality (i.e., that they were created and signed by a specific, demonstrably trustworthy entity). By documenting all associated metadata in detail each time a seal is broken, an improved audit trail, i.e., enhanced traceability, is achieved.Furthermore, a high-quality (forensic) analysis is made possible afterwards for the precise determination of problem causes and optimization potentials.

[0024] The previously formulated task is also solved by a method for operating a technical plant using a control system.

[0025] The properties, features, and advantages of this invention described above, as well as the manner in which they are achieved, will become clearer and more readily understandable in connection with the following description of the exemplary embodiment, which is explained in more detail in conjunction with the drawings. The drawings show: FIG 1 an object model of a control system according to the invention; and FIG 2 a hierarchically structured, digital representation of a part of a technical plant.

[0026] In FIG 1 An object model 1 is represented as a hierarchically structured, digital representation 2 of a (first) part of a technical plant designed as a process plant. The object model 1 is implemented on an Engineering Station Server (not shown) of a control system of the process plant.

[0027] The hierarchically structured digital representation 2 can contain several - even nested - structure folders 3 for the design of a technological hierarchy of the process plant (e.g. "Plant 1" -> "Subplant 1" -> "Technical Unit 1" -> "Measuring Point 1", see also FIG 2 ).

[0028] From a hierarchical perspective, three different documents (4) can be created under each structure folder. These documents (4) could be, for example, plant diagrams (5), CFCs (Continuous Function Charts) (6), or SFCs (Sequential Function Charts). Further down the hierarchy below the CFC (6), objects (7) can be created. Such an object (7) could, for example, be a process object (8) assigned to a process component (not shown) of the process plant.

[0029] The components described above represent a hierarchically structured digital representation of a (first) part of a process plant, a structure known according to the state of the art. A second part of the process plant has a correspondingly designed hierarchically structured digital representation with a correspondingly designed object model, which is also implemented on an Engineering Station Server (this need not necessarily be a single Engineering Station Server).

[0030] A newly added aspect is that a simulation model 9 is permanently assigned to each hierarchically structured, digital representation 2 of a part of the process plant (i.e., to the first and the second part), whereby a technical behavior of the first part of the process plant can be simulated by means of a first simulation model 9 and a technical behavior of the second part of the process plant can be simulated by means of a second simulation model 9.

[0031] In object model 1, the simulation model 9 represents another type of document 4. Several simulation models 9 can be specifically used at different technological levels for testing and acceptance. · individual measuring points (e.g., controls...) · technical equipment (e.g., tanks), and · subsystems (e.g., filling...) to be assigned and allocated.

[0032] A simulation model 9 can have a specialization 10 with specific properties that are necessary for a reproducible and manipulation-proof virtual acceptance of the individual parts of the process plant.

[0033] One specialization (10) can consist of digital sealing. This sealing protects the simulation model (9) against manipulation, for example, if it is relevant for acceptance testing. The sealing can be carried out by a (correspondingly certified and accredited) auditor and includes information such as a unique identifier of the sealing entity.

[0034] Technically, the sealing process can be implemented as follows: The sealing instance signs the simulation model 9 using its private key. To verify the integrity, authenticity, and originality of the simulation model 9, the corresponding public key is then required. The binding of the public key to the private key (available only to the sealing instance) and to the identity of the sealing instance is achieved through a corresponding certificate. This certificate of the sealing instance, which is subsequently necessary for performing the verification described above, can, for example, be assigned to the simulation model 9 or stored in a database – alongside the certificates of other trusted sealing instances.

[0035] If simulation model 9 is modified or adapted (e.g., to prepare for a plant expansion), the seal may be broken. In this case, a new secure seal is required.

[0036] A further specialization 10 can consist of digital sealing and additional encryption. For particularly sensitive and protected simulation models 9, this additional encryption can protect them against unauthorized reading. This ensures, for example, that the engineering software is not exclusively optimized for the specific simulation model 9 in question.

[0037] FIG 1 It can be seen that a further connection 11 exists between the simulation model 9 and the previously known hierarchically structured digital representation 2, specifically the "Objects" block 4. This is a test association 11, which records that the relevant document 4 or documents (CFC 6, plant images 5, etc.) have been successfully approved by the respective simulation model 9. The following information, for example, can be assigned to the test association 11, which connects the respective simulation model 9 and the respective object 4: the state of the sealing of the simulation model 9 during the acceptance test, the timestamp in a standardized format that clearly proves exactly when the sealing took place, a unique identifier of the sealing instance, a predefined and "coded" justification for resealing, possibly further meta-information, for example taken from the certificate of the sealing instance or the simulation model 9, a signature of the sealing instance with which it confirms the correctness of the above contents of the test association 11.

[0038] FIG 2 Figure 1 shows an exemplary hierarchically structured digital representation 2 of a (first) part (designated as "Subplant 1") of a process plant (designated as "Plant 1"). This hierarchically structured digital representation 2 is implemented on an Engineering Station server of a control system for the process plant. The hierarchical structure is evident in the subordination of the individual components ("Plant 1" -> "Subplant 1" -> "Technical Unit 1" -> "Measuring Point 1"). "Technical Unit 1" forms a structure folder 3, as shown in FIG 1 This is shown. Further down the hierarchy are a document 4 "Measuring Point 1" and another document 4 "CFC 1". Document 4 "CFC 1" has a process object 8 "Process Object 1" hierarchically subordinate to it.

[0039] A first simulation model 9 (labeled "Certification Simulation Model: Sub-plant 1") is permanently assigned to "Sub-plant 1". A second simulation model 9 (labeled "Certification Simulation Model: Technical Unit 1") is assigned to "Technical Unit 1". The first simulation model 9 is in FIG 2 A first character 12 is assigned to the second simulation model 9, and a second character 13 to the second. In a column "Cert. State" on the left side in FIG 2 The diagram symbolizes which parts of the hierarchically structured digital representation 2 are represented by each of the two simulation models 9. The first simulation model 9 represents the parts "Overview Image 1", "Plant Image 1", "CFC 1", and "Process Object 1". The second simulation model 9 represents the parts "Plant Image 1", "CFC 1", and "Process Object 1".

[0040] By assigning the simulation models 9 to the respective parts of the process plant to be sealed, which were used, for example, during certification, and by implementing appropriate security mechanisms to protect the simulation models 9 against unnoticed manipulation and additionally (if necessary) against reading, it can be ensured that every (simulation-relevant) change made in the plant will "force" a new sealing.

Claims

1. Control system for a technical installation, in particular a manufacturing or processing installation, which has at least one engineering station server, which is embodied and provided for use as part of an engineering of the technical installation, wherein at least one first hierarchically structured, digital representation (2) of a first part of the technical installation and at least one second hierarchically structured, digital representation (2) of a second part of the technical installation is implemented on the engineering station server, wherein the first hierarchically structured, digital representation (2) of the first part of the technical installation is permanently assigned a first simulation model (9) and the second hierarchically structured, digital representation (2) of the second part of the technical installation is permanently assigned a second simulation model (9), characterised in that the first simulation model (9) is permanently assigned to the first hierarchically structured, digital representation (2) and the second simulation model (9) is permanently assigned to the second hierarchically structured, digital representation (2), in each case via a checking association (11), which states that the first hierarchically structured, digital representation (2) by the first simulation model (9) and the second hierarchically structured, digital representation (2) by the second simulation model (9) have been successfully approved, wherein the first hierarchically structured, digital representation (2) of the first part of the technical installation and / or the second hierarchically structured, digital representation (2) of the second part of the technical installation have a digital seal, with the aid of which it is possible to determine an authenticity of the first and / or second hierarchically structured, digital representation (2), wherein the first simulation model (9) permanently assigned to the first hierarchically structured, digital representation (2) of the first part of the technical installation and / or the second simulation model (9) permanently assigned to the second hierarchically structured, digital representation (2) of the second part of the technical installation have a digital seal, with the aid of which it is possible to determine an authenticity of the first and / or second simulation model (9), and wherein a technical behaviour of the first part of the technical installation can be simulated by means of the first simulation model (9) and a technical behaviour of the second part of the technical installation can be simulated by means of the second simulation model (9).

2. Control system according to claim 1, in which the first simulation model (9) and / or the second simulation model (9) have an encryption for preventing an unauthorised readout of the simulation model (9).

3. Method for operating a technical installation by means of a control system, which is embodied according to one of claims 1 or 2.