AUTOMATION CONTROLLER AND METHOD FOR OPERATION OF AN AUTOMATION CONTROLLER

Description

[0001] The patent US 2008 / 291907 is considered to be the closest prior art to the subject matter of the invention.

[0002] The invention relates to an automation controller comprising a processor onto which an operating system is loaded, a first interface module with at least a first Ethernet channel and a second Ethernet channel, which are connected to a first selection circuit, a second interface module with at least a first Ethernet channel and a second Ethernet channel, which are connected to a second selection circuit, a first network interface for connection to a first network and a second network interface for connection to a second network, connecting means for connecting the selection circuits to the network interfaces, a first register with a first register value and a second register with a second register value, the selection circuits being designed to assign the Ethernet channels to the network interfaces in accordance with the register values.

[0003] Especially when an automation controller is designed for functional safety, safety-relevant settings, such as hardware configurations, must not be tampered with and must therefore be protected during runtime. Previously, such protection was implemented in so-called F-CPUs (fail-safe) from a user program. The previous solution is not applicable to values ​​to be protected that are not accessible via the user program. Furthermore, detection of possible tampering must also occur when the automation controller is in a stop state or without the aid of a safety program (F-program / user program).

[0004] It is therefore the object of the invention to provide an automation controller which reliably detects falsifications, in particular falsifications of register values ​​for network interface assignments.

[0005] For the automation controller mentioned at the beginning, the problem is solved in that the operating system is designed to generate a number in a definable cycle and that a query means is present which is designed to apply a logical function to the register values ​​with the number in each cycle, whereby a return value is generated, the operating system is further designed to apply the logical function again to the return value with the number, whereby the register values ​​are generated again, furthermore there are code instructions which are designed to compare the regenerated register values ​​with test values ​​and to put the automation controller into a safe state in the event of a deviation.

[0006] A safeguarding of a safety-relevant value, in particular the register value, to realize a network separation is now done by a double input (target value and a check value).

[0007] It is also advantageous that the actual value is read cyclically and compared with the test value. If a discrepancy is found, an appropriate response is initiated, e.g., a stop state or a fault condition with all network interfaces shut down.

[0008] Reading the actual value of the register values ​​could be achieved using the following mechanism. Using an asynchronous service, a channel to an EDDP (Ethernet Device Driver PNIP) can be defined using PNIO base packets. For example, the automation controller's operating system could generate a 32-bit random value every 1,000 ms and pass it to the EDDP. In the EDDP, the 32-bit random value is XORed with the actual values ​​and returned to the operating system. These so-called actual port mapping values ​​are then compared with the test values ​​by the automation controller using special code instructions. If a deviation is found, the automation controller switches to a fault state, for example, and all physical ports / network interfaces are shut down.

[0009] Another design variant of the automation controller provides a test value table with the test values ​​and a combination table. The combination table lists the combinations of the Ethernet channel assignments to the network interfaces, with a test value assigned to each combination stored in the test value table. Since known test values ​​have now been assigned to the combinations, a configured port mapping can be cyclically tested against an expected value.

[0010] The testing is further improved if the automation controller has code instructions configured to multiply the first regenerated register value by a first factor and to check whether the product corresponds to the first test value, and to multiply the second regenerated register value by a second factor and to check whether the product corresponds to the second test value.

[0011] For example, if a multiplication with 0×200 H is made as the first check value and a multiplication with 0x200 00O H as the second check value, a change in the register content by only one bit (lowest value) can be detected during the runtime test.

[0012] With regard to a Profisafe application, it is advantageous if the register values ​​for assigning the Ethernet channels to the network interfaces are selected in such a way that it is ensured that the first network and the second network are separated from each other.

[0013] Such safety-relevant settings of register values ​​must be protected against tampering due to hardware and software errors. This setting (register values) affects the "Network Isolator according to IEC 61784-3-3 (Profisafe)" function, which is provided by a fail-safe CPU (F-CPU). This protection can advantageously be implemented without a user program (F-program) or even in a stop state.

[0014] For the purposes of the invention, a network separator is understood to be an absolute network separator between two network interfaces. If the first network interface and the second network interface belong to different local Ethernet interfaces or networks, no bridging may be implemented for these interfaces at communication level 2. If the first interface leads to a local Ethernet network and the other to a backplane bus module of the automation controller with an Ethernet interface, no bridging may be implemented at communication level 2 for this configuration either.

[0015] It is advantageous if the automation controller has an input device designed to allow a user to select and set the combinations. For example, a user could select the interface variants or combinations via a display on the automation controller. The user could confirm the selected combination by confirming the corresponding test value.

[0016] Furthermore, the object mentioned at the outset is achieved by a method for operating an automation controller, wherein for network separation of a first network and a second network, a first register value of a first register and a second register value of a second register are monitored against corruption by hardware and software errors, wherein the register values ​​are used to set a first or second network.second selection circuit is used, the selection circuits are operated according to the register values, to assign Ethernet channels of interface modules to network interfaces and thus to the networks, whereby a number is generated from an operating system of the automation controller in a definable cycle and with each cycle a logical function is applied to the register values ​​with the number, whereby a return value is generated, in the operating system the logical function is again applied to the return value with the number, whereby the register values ​​are generated again, furthermore code instructions are run through which compare the regenerated register values ​​with test values ​​and put the automation controller into a safe state in the event of a deviation.

[0017] With regard to an implementation of the code instruction, a check value table with check values ​​and a combination table have proven to be helpful. In the combination table, combinations of the assignments of the Ethernet channels to the network interfaces are listed and used for the comparison, whereby in the check value table a check value assigned to the respective combination is stored for each combination.

[0018] In order to be able to detect changes of only 1 bit, the first regenerated register value is multiplied by a first factor and it is checked whether the product corresponds to the first check value, and the second regenerated register value is multiplied by a second factor and it is checked whether the product corresponds to the second check value.

[0019] If an automation controller is operated with regard to functional safety, it is advantageous if the automation controller is operated as an automation controller designed for functional safety and the network separation of the first network and the second network is carried out according to the IEC 61784-3 standard.

[0020] The drawing shows an embodiment of the invention.

[0021] The FIG 1 shows the automation controller, FIG 2 shows a combination table, FIG 3 shows a test value table and FIG 4 shows an illustration of the assignment of a register value to a register.

[0022] With the FIG 1 An automation controller 1 is shown. The automation controller 1 has a processor MP on which an operating system (FW) is loaded. For communication connections, the automation controller 1 has a first interface module IF1 and a second interface module IF2. The first interface module IF1 is configured, for example, as a PN-IP 100 megabit / s module. The second interface module IF2 is configured as a PN-IP 100 gigabit / s module. Selection circuits Mux1, Mux2 are arranged between the interface modules IF1, IF2 and network interfaces P1,..., P4. Since the first interface module IF1 has a first Ethernet channel E11, a second Ethernet channel E12, a third Ethernet channel E13 and a fourth Ethernet channel E14, different Ethernet channels E11,...,E14 can be connected to different network interfaces P1,P2,P3,P4 via the selection circuits Mux1,Mux2.For this purpose, the automation controller 1 has a first register 5041 with a first register value HWIF1 and a second register 5042 with a second register value HWIF2. The selection circuits Mux1, Mux2 are configured to assign the Ethernet channels E11,..., E22 to the network interfaces P1, P2, P3, P4 according to the register values ​​HIF1, HIF2. Since the assignment is safety-relevant, particularly to the functionality of a network isolator in a Profisafe environment, the assigned register values ​​HWIF1, HWIF2 must be monitored.

[0023] For this purpose, the operating system FW is designed to generate a number ZZ, e.g. a random number, in a definable cycle Z and, via a query means AM, which is designed to apply a logical function to the register values ​​HWIF1, HWIF2 with the number ZZ in each cycle Z. This generates a return value ZZ' and returns it to the operating system FW. In the operating system FW, the logical function XOR is again applied to the returned return value ZZ' with the number ZZ, thereby generating the register values ​​HHIF1`, HWIF2` again. For further testing, code instructions SC are available which are designed to compare the newly generated register values ​​HWIF1', HWIF2' with test values ​​CV_HWIF1, CV_HWIF2 (see FIG 3 ) and, in the event of a deviation, to place the automation controller 1 into a safe state. For this purpose, a comparison device 30 is available, for example, which forces the automation controller 1 into a stop state.

[0024] The code instructions SC are further configured to multiply the first regenerated register value HWIF1' by a first factor F1 and to check whether the product corresponds to the first check value CV_HWIF1, and to multiply the second register value HWIF2' by a second factor F2 and to check whether the product corresponds to the second check value CV_HWIF2.

[0025] As an exemplary configuration of the automation controller 1 with regard to a network separator, the sixth combination K6 from the FIG 2 shown configuration table KT. The sixth combination K6 provides that the first Ethernet channel E11 of the first interface module IF1 is connected to the first network interface P1 and that the second Ethernet channel E12 of the second interface module IF2 is connected to the second network interface P2.

[0026] From the FIG 3 The following register values ​​result for the sixth combination K6. The first register value HWIF1 receives the value 0×7770 H, and the second register value HWIF2 receives the value 0×71 H. Accordingly, the check values ​​0xEE E000 H and 0xE200 0000 H are selected for the first register value HWIF1 and the second register value HWIF2 in the sixth combination K6. This means that multiplying the register value 0×770 H by 0×200 H must result in the corresponding check value 0xEE E000 H.

[0027] The FIG 4shows a possible configuration using the first register 5041 as an example. The first register 5041 has the address 000504H. In a line labeled "bit number," 32 bits can be assigned to the register. As an example, the configuration 0×7770H was assigned. This means that bits 0 to 2 are assigned 0, bits 4 to 6 are assigned 1, bits 8 to 10 are also assigned 1, and bits 12 to 14 are also assigned 1. Binary numbers can be divided into groups of four and easily converted to hexadecimal numbers, i.e., a block of four "1"s corresponds to one "7."The explanation column for bit numbers 0 to 2 indicates that a configuration with "000" is equivalent to a connection to the first network interface P1, a configuration with "001" corresponds to a connection to the second network interface E2, a configuration with "010" corresponds to a connection to the third network interface P3, and a configuration with "011" corresponds to a connection to the fourth network interface P4. The configuration of bits "100" to "110" is reserved and behaves like a configuration with "111," which is equivalent to no network interface assignment.

[0028] As an initial value, all bits receive 0x7 H, which in turn corresponds to "111" and therefore does not represent a port assignment for security reasons.

Claims

1. Automation controller (1) comprising - a processor (MP), onto which an operating system (FW) is loaded, - a first interface module (IF1) with at least a first Ethernet channel (E11) and a second Ethernet channel (E12), which are connected to a first selection circuit (Mux1), - a second interface module (IF2) with at least a first Ethernet channel (EA21) and a second Ethernet channel (EA22), which are connected to a second selection circuit (Mux2), - a first network interface (P1) for the connection to a first network (N1) and a second network interface (P2) for the connection to a second network (N2), - connection means (VM) designed to connect the selection circuits (Mux1, Mux2) with the network interfaces (P1, P2), - a first register (5041) with a first register value (HWIF1) and a second register (5042) with a second register value (HWIF2), here the selection circuits (Mux1, Mux2) are designed to assign the Ethernet channels (E11,...,E22) to the network interfaces (P1, P2) in accordance with the register values (HWIF1, HWIF2), characterised in that the operating system (FW) is designed to generate a number (ZZ) in a definable cycle (Z) and that a query means (AM) is present, which is designed to apply a logical function (XOR) to the register values (HWIF1, HWIF2) with the number (ZZ) with each cycle (Z), as a result of which a return value (ZZ') is produced, the operating system (FW) is further designed to apply the logical function (XOR) to the return value (ZZ') with the number (ZZ), as a result of which the register values (HWIF1', HWIF2') are produced again, furthermore code instructions (SC) are present, which are designed to compare the reproduced register values (HWIF1', HWIF2') with test values (CV_HWIF1, CV_HWIF2) and in the event of a variance to move the automation controller (1) into a safe state.

2. Automation controller according to claim 1, having a test value table (PWT) with the test values (CV_HWIF1, CV_HWIF2) and a combination table (KT), in which combinations (K1,...,K6) of the assignments of the Ethernet channels (E11,...,E22) to the network interfaces (P1, P2) are listed, wherein a test value (CV_HWIF1, CV_HWIF2) assigned to the respective combination is stored in the test value table (PWT) for each combination (K1,...,K6).

3. Automation controller (1) according to claim 2, wherein the code instructions (SC) are designed to multiply the first reproduced register value (HWIF1') by a first factor (F1) and to test whether the product corresponds to the first test value (CV_HWIF1) and to multiply the second reproduced register value (HWIF2') by a second factor (F2) and to test whether the product corresponds to the second test value (CV_HWIF2) .

4. Automation controller (1) according to one of claims 1 to 3, wherein the register values (HWIF1, HWIF2) for the assignment of the Ethernet channels (E11,...,E22) to the network interfaces (P1, P2) are selected so that it is ensured that the first network (N1) and the second network (N2) are separated from one another.

5. Automation controller according to one of claims 2 to 4, wherein an input means (EM) is present, which is designed for a user to be able to select and set the combinations (K1,...,K6).

6. Method for operating an automation controller (1), wherein for the network separation of a first network (N1) and a second network (N2), a first register value (HWIF1) of a first register (5041) and a second register value (HWIF2) of a second register (5042) are monitored for falsifications as a result of hardware and software errors, wherein the register values (HWIF1, HWIF2) are used to set a first or second selection circuit (Mux1, Mux2), here the selection circuits (Mux1, Mux2) are operated to assign Ethernet channels (E11,...,E22) of interface modules (IF1, IF2) to network interfaces (P1, P2) and thus to the networks (NW1, NW2) in accordance with the register values (HWIF1, HWIF2), wherein a number (ZZ) is generated from an operating system (FW) of the automation controller (1) in a definable cycle (Z) and a logical function (XOR) is applied with each cycle (Z) to the register values (HWIF1, HWIF2) with the number (Z), as a result of which a return value (Z') is produced, in the operating system (FW) the logical function (XOR) is applied in turn to the return value (Z') with the number (ZZ), as a result of which the register values (HWIF1', HWIF2') are produced, furthermore code instructions (SC) are run through, which compare the reproduced register values (HWIF1', HWIF2') with test values (CV_HWIF1, CV_HWIF2) and in the event of a variance move the automation controller (1) into a safe state.

7. Method according to claim 6, wherein a test value table (PWT) with the test values (CV_HWIF1, CV_HWIF2) and a combination table (KT), in which combinations (K1,...,K6) of the assignments of the Ethernet channels (E11,...,E22) to the network interfaces (P1, P2) are listed, is used, wherein a test value (CV_HWIF1, CV_HWIF2) assigned to the respective combination (K1,...,K6) is stored in the test value table (PWT) for each combination (K1,...,K6).

8. Method according to claim 6 or 7, wherein with the code instructions (SC) the first reproduced register value (HWIF1') is multiplied by a first factor (F1) and a test is carried out to determine whether the product corresponds to the first test value (CV_HWIF1) and the second reproduced register value (HWIF2') is multiplied by a second factor (F2) and a test is carried out to determine whether the product corresponds to the second test value (CV_HWIF2).

9. Method according to one of claims 6 to 8, wherein the automation controller (1) is operated as an automation control unit designed for functional safety and the network separation of the first network (N1) and the second network (N2) is carried out according to IEC standard 61784-3.