Method and device for testing a firmware update for an edge device

Abstract

The invention relates to a method for testing a new version of a firmware (FW) of a connection device (3), the connection device (3) being arranged in an automation system (14) between the field devices (1) of the automation system (14) and an external server platform (4), also referred to hereinafter as P system, said method having the following method steps: - the new version of the firmware (FW) is transmitted via the Internet or via another network to a test system (6), hereinafter also referred to as Q system, - the quality of at least some actions / reactions of the new firmware (FW) to simulated events that are at least largely modelled on the events actually occurring in the automation system (14) is tested on the Q system before installation on the P system, the new version of the firmware (FW) is installed by the operating personnel (BP) of the automation system (14) on the connection device (3) of the P system if the tested actions / reactions of the new firmware (FW) to the simulated events fulfil the quality criteria specified by the system operator on the Q system. The invention further relates to a device suitable for carrying out the method.

Description

[0001] Method and device for testing a firmware update for an edge device

[0002] The invention relates to a method for testing a new firmware version of a connection device arranged in an automation system between the field devices of the automation system and an external server platform. Furthermore, the invention relates to a device suitable for carrying out the method for testing a new firmware version for a connection device.

[0003] Field devices used in industrial automation systems are already known from the state of the art. They are used in many areas of process automation and manufacturing automation. In the context of the invention, field devices are considered to be all devices used close to the process and that provide and / or process process-relevant information. Depending on the area of ​​application, field devices detect and / or influence physical, chemical, or biological process variables of at least one process medium.

[0004] Measuring instruments, which typically consist of a sensor unit and a measuring transducer unit, are used to record process variables. These are used, for example, for pressure and temperature measurement, conductivity measurement, flow measurement, pH measurement, or level measurement and record the corresponding process variables: pressure, temperature, conductivity, pH value, level, or flow. Actuators such as pumps or valves are used to influence process variables, for example, controlling the flow of a liquid in a pipeline or the level in a container. In addition to the measuring instruments and actuators mentioned above, the term "field devices" also includes remote I / Os, wireless adapters, communication network components such as gateways, or - more generally - devices arranged at the field or process level in the automation system.A large number of such field devices are developed, manufactured and distributed by the Endress+Hauser Group.

[0005] Increasingly, at least one connecting device is located at the "edge" of an automation technology network, which, due to its location, is referred to as an edge device. Particularly in IoT environments, an edge device serves as a hub between the automation technology fieldbus network, consisting of a multitude of field devices that communicate with each other or with a higher-level control unit via at least one fieldbus protocol, and an external server unit, the IoT or - more generally - the cloud. Depending on requirements, an edge device provides various interfaces to wired and wireless transmission technologies and communication standards, such as Ethernet, WLAN, or mobile communications such as LTE (4G), 5G, etc.

[0006] The amount of data generated per unit of time by field devices used in automation technology is constantly increasing. In order to evaluate or further process the data in real time, or to upload it to the cloud, it is advisable to reduce the amount of data and decide locally which data will be processed in the edge device before it is forwarded. The corresponding keyword for solving this problem is edge computing. Here, decisions are made close to the point of data creation as to which of the data generated by the field devices will be transmitted to external server platforms and stored, and which data will be evaluated and further used locally in the edge device. Real-time data processing makes it possible to achieve an acceptable latency, which is particularly important for time-critical applications. Important in automation technology, for example, isthat at least one message is reliably received from a field device within a certain period of time. The reliability of the timely delivery of information is a prerequisite for trend formation and / or forecasting. Demand-based data processing enables efficient communication for applications such as predictive maintenance or machine learning. Uploading to the cloud or an external server platform only occurs when information cannot be evaluated locally, detailed analyses are required, or data needs to be archived. This also significantly reduces a plant operator's costs for using external communication networks. Roughly speaking, an edge device is a component with computing and storage resources.

[0007] Another advantage that should not be overlooked is that with edge computing, the data remains within the plant operator's local network. In the field of industrial process automation, this often involves sensitive process data that the plant operator would not want transmitted over the internet.

[0008] The invention is based on the object of providing a method and a corresponding device for carrying out the method by which the quality of a new version of the firmware of a connection device is tested in advance.

[0009] The problem is solved by a method for testing a new version of a firmware of a connection device, wherein the connection device is arranged in an automation system in the production system or P-system between the field devices of the automation system and an external server platform.The method comprises the following steps: the new version of the firmware is transmitted to a test system - quality system or Q system - via the Internet or via a network of the automation system, the quality of at least some actions / reactions of the new firmware to simulated events, which are at least largely modeled on the events actually occurring in the automation system, is tested on the Q system before installation on the P system, the new version of the firmware is installed on the P system by the operating personnel of the automation system if the tested actions / reactions of the new firmware to the simulated events meet the quality criteria specified by the plant operator on the Q system.

[0010] It goes without saying that the firmware of an edge device is continually being developed, for example, to implement security patches to close security vulnerabilities, but also to integrate new technical features or to improve the performance or already integrated functions of the edge device. To avoid system failures or to ensure that no sensitive data leaves the local network without authorization, system operators are highly interested in testing at least certain functions of the new firmware version before it is installed in the production system (P-System).

[0011] According to the invention, the P-system and the Q-system are located in the sphere of the plant operator.

[0012] The method according to the invention tests the quality of the new version of the firmware update before installation on the edge device of the production system in the sphere of the plant operator. Testing in the so-called Q-System can be carried out on-site by the plant operator's operating personnel. The method according to the invention makes it possible to identify any security gaps in data communication or a transfer of company data to an external server platform unauthorized by the plant operator during the test phase. Furthermore, it can be checked whether the field devices of the automation system, when communicating with the edge device, exhibit the behavior they are intended to exhibit. Undesirable behavioral changes in the production system that the new firmware version would cause can be effectively detected in advance.By pre-testing the edge device's firmware in the Q-System using test data that simulates or corresponds to the quality-critical test functions as realistically as possible, the plant operator receives the security required before releasing new firmware. This is particularly important if the automation system in which the edge device is used must meet high security standards regarding the external disclosure of internal data. It is certainly possible that a plant operator classifies process data from their automation system as confidential and only wishes to make it accessible to a limited group of people. Such data must remain within the sphere of the plant operator. A further fear of plant operators is that an edge device will make unauthorized changes in the field – for example, thatan edge device changes the behavior of a field device in such a way that the automation and thus the produced product undergoes unintended changes.

[0013] A further development of the method according to the invention provides that software programs are made available to the Q system for the quality assessment of the new version of the firmware, which at least largely simulate individual events that occur in the automation system under real conditions and in which the connecting device acts or reacts.

[0014] Furthermore, in one embodiment of the method according to the invention, it is proposed to record the data traffic on the connection device of the P-System over a specified period of time. During the specified period, a previous version of the firmware is installed on the connection device of the P-System that meets the specified quality criteria of the plant operator. The recorded data is made available to the Q-System as test data for the quality assessment of the new firmware.

[0015] Furthermore, a further development of the method according to the invention provides that simulation data generated in an external virtual simulation system that at least partially replicates the automation system are made available to the Q department for the quality assessment of the new version of the firmware.

[0016] Alternatively, it is proposed that simulation data generated in an external simulation system that at least partially simulates the automation system with real field devices when performing real or simulated measuring or control tasks be made available to the Q-System for the quality assessment of the new firmware version.

[0017] In one embodiment of the method according to the invention, it is further suggested that the results of the quality assessment conducted in the Q system be output and displayed to the operating personnel of the automation system. According to a further development, the new version is installed on the connecting device in the P system if the new firmware version sufficiently meets the quality criteria used for the quality assessment in the Q system. If the new firmware version does not meet the quality criteria used for the quality assessment in the Q system or does not meet them sufficiently, the installation of the new firmware version on the connecting device of the P system is refused.

[0018] As already explained in the introduction to the description, the field devices in the automation system perform different measurement or control functions depending on their design. Generally speaking, field devices measure physical, chemical, or biological process variables of at least one process medium, or they intervene in the processes taking place within the automation system in a control or regulation manner.

[0019] Furthermore, the object is achieved by a device for carrying out the inventive method for testing a new version of a firmware of a connection device, wherein the connection device is arranged in the P-system in an automation system between the field devices of the automation system and an external server platform. A Q-system with a test system is assigned to the connection device, which serves to verify the quality of the new version of the firmware intended for the connection device of the P-system, whereby the quality is checked against predetermined quality criteria. The test system has the following components:

[0020] - a real-time processing unit on which the new version of the connecting device's firmware is installed,

[0021] - a simulation unit that communicates with the real-time computing unit and provides the computing unit with test data, whereby the actions and reactions of the new firmware version to the provided test data are used to check whether the firmware meets the specified quality criteria of the plant operator,

[0022] - a listener unit that monitors the data traffic between the computing unit and the simulation unit,

[0023] - an output unit on which the data listened to and possibly further processed by the listener unit is output.

[0024] According to a further development of the device according to the invention, the connecting device is an edge device. The function of an edge device has already been described above. Furthermore, in connection with the device according to the invention, it is proposed that the test system have a communication interface to the Internet, so that the new version of the firmware of the connecting device or the edge device is loaded onto the computing unit of the test system via the Internet. For example, the manufacturer of the edge device can provide the system operator with the new version of the firmware on the test system via the Internet. The new version of the firmware is installed on the test system as soon as the system operator authorizes it.

[0025] Alternatively, the test system has a communication interface to a network of the automation system so that the new version of the firmware of the connecting device can be loaded onto the computing unit of the test system via the network and installed there.

[0026] One embodiment of the device according to the invention provides an external simulation system in which the automation system is at least partially simulated in real or virtual form. The external simulation system is connected to the test system, in particular to the simulation unit of the test system of the connecting device or the edge device, via the Internet. The virtual or real test data is made available directly to the simulation unit.

[0027] The quality criteria specified by the plant operator can be diverse. They are tailored to the specific requirements of the plant operator of the respective automation system. For example, they may be a request to perform a diagnostic procedure on the field devices, a request to provide diagnostic data or parameter data from the field devices, or the visualization of data communication on the external server platform.

[0028] The further embodiment of the device according to the invention relates to the design of the communication network in the automation system. Field devices of the automation system that communicate via Ethernet are directly connected to the connecting device or the edge device. Field devices that communicate via a fieldbus protocol commonly used in automation technology or via a proprietary fieldbus protocol are connected to the connecting device via an intermediate gateway. The gateway is connected between the field devices and the connecting device or the edge device.

[0029] The invention is explained in more detail with reference to the following figures. Fig. 1 shows a schematic representation of the productive system or P-system of an automation system in communication with an external server platform,

[0030] Fig. 2: a block diagram showing different configurations of the quality system or Q-system, and

[0031] Fig. 3: a flow chart visualizing an embodiment of the method according to the invention.

[0032] Fig. 1 shows a schematic representation of field devices 1 of an automation system 14 arranged at the field level, which are connected to an external server or an external server platform 4 via suitable transmission paths 5. The server platform 4 is part of the lloT 15. The field devices 1.1, ... 1.n or 1.1, ... 1.m are measuring devices, actuators, or other electronic components of the automation system, which were already referred to in the introduction to the description. Data exchange between the field level, i.e., a local network, and the lloT takes place via an edge device 3, whose function has also been described previously.

[0033] Shown in the left-hand area of ​​Fig. 1 are field devices 1.1, ... 1.n that communicate via one of the fieldbus protocols commonly used in automation technology, e.g., a HART bus protocol. A gateway 2 communicates with the edge device 3 by transforming the data supplied by the field devices 1.1, ... 1.n via the fieldbus protocol to an internet protocol or by transforming the data transmitted by the edge device 3 to the fieldbus protocol. The field devices 1.1, ... 1.m shown in the right-hand area of ​​Fig. 1 already communicate via an internet protocol, e.g., Ethernet IP, so that the interposition of a gateway 2 is unnecessary here.

[0034] The dashed line marks the boundary between the field level or process level, where the field devices 1 of the automation system 14 are located, and the Internet of Things 15 with the server platform 4 and the server platform 16. The Edge Device 3 is essentially the gateway from the closed communication sphere of the automation system 14 to the IoT 15. The Edge Device 4 must be designed to meet the respective security requirements of a plant operator: No unauthorized "data" may pass through this gate. Furthermore, the Edge Device 3 must not initiate any actions at the field level that in any way disrupt the process flow in the automation system or open a security gap "to the outside." Activating a new version of the firmware of the Edge Device 3 undoubtedly represents a potential security risk.Therefore, it is very important for a plant operator to test critical security functions of the firmware FW on-site using data from the real process plant or with data that at least approximately simulates the real process plant, before the firmware FW is released for installation on the Edge Device 3.

[0035] Fig. 2 shows a block diagram with different embodiments of the quality system or Q-system according to the invention. In particular, the test system 6 shown is suitable for pre-testing a new version of the firmware FW of an edge device 3 for implementing the method according to the invention. Only if the new version of the firmware FW for the edge device 3 meets the tested quality criteria in the Q-system will the new version of the firmware FW be installed on the edge device 3 in the production system or P-system. In general, the edge device 3 can also be referred to as a connecting device between a local automation technology network and the Internet, in particular a server platform or the Industrial Internet of Things (IoT).

[0036] Test system 6 is located in the local network or within the plant operator's sphere. The new firmware version for edge device 3 is created in the local network or within the manufacturer's / supplier's sphere and is transmitted from a server 16 via the Internet to the plant operator's test system 6, where it is installed.

[0037] The test system 6 is used to pre-test the quality of a new version of the firmware FW for the connecting device 3. The quality of the actions and reactions of the edge device 3 is assessed on-site with regard to quality criteria defined by the plant operator. The test system 6 has a real-time computing unit 7, a listener unit 8, and a simulation unit 9. The new version of the firmware FW of the edge device 3 is installed on the real-time computing unit 7. The simulation unit 9 communicates with the real-time computing unit 7 via Ethernet IP. Test data is made available to the computing unit 7. The actions and reactions of the new version of the firmware FW of the edge device 3 to the test data are used to check whether the firmware FW meets the plant operator's specified quality criteria.

[0038] The results of the review must be verifiable by the plant operator.

[0039] Therefore, the decision regarding the correct functioning of Edge Device 3 with the new firmware (FW) is made on-site within the plant operator's sphere. A listener unit 7 monitors the data traffic between the computing unit 6 and the simulation unit 8. The listener unit 8 is connected to an output unit 10, on which the data monitored and, if necessary, further processed by the listener unit 8 is output – in response to the test data specified by the plant operator. Appropriately trained operating personnel (BP) check the displayed data for congruence with the plant operator's specifications and subsequently accept or reject it.

[0040] The test data itself can be generated in different ways. For example, it can be software programs 13 that at least largely simulate the actions or reactions of the Edge Device 3 that occur in the automation system under real-life conditions. Based on the data / information displayed on the display unit 10, the operating personnel (BP) can decide whether the actions / reactions are being executed by the Edge Device 3 in the manner defined by the system operator.

[0041] An alternative method for generating test data involves recording the data traffic on Edge Device 3 installed in automation system 14 over a specified period of time. The specified period is designed to ensure that all actions / reactions that require quality assessment occur during the period. At the time of recording, the accepted previous version of the firmware (FW) is still installed on the productive Edge Device 3, which meets the plant operator's quality requirements. The recorded test data is made available to the real-time computing unit 7 of test system 6 for quality assessment of the new firmware (FW). This allows it to be determined whether the critical actions / reactions are handled the same or differently by the new version of the firmware (FW) of Edge Device 3.Based on the type of deviation, the operating personnel decides whether the safety criterion for release is met or not.

[0042] Another variant for providing test data proposes that the test data be simulation data generated in an external virtual simulation system 12 that at least partially replicates the real automation system 14. Alternatively, the test system 6 is provided with simulation data generated in an external, real simulation system 12 that at least partially replicates the automation system 14 with real field devices 1.

[0043] Fig. 3 shows a flow chart illustrating an embodiment of the inventive

[0044] The process is visualized. The process is started at step 20. The manufacturer of Edge Device 3 is responsible for developing the new firmware version of Edge Device 3. The new firmware version is transmitted via the internet to the company network of automation system 14. Depending on whether a test system 6 for the new firmware version is available there (step 22), the process is split into two branches.

[0045] If no test system 6 is available, the new firmware version is provided to Edge Device 3 (point 23) and installed on Edge Device 3 at point 24. This is always common practice when there is a complete relationship of trust between the plant operator and the manufacturer. It goes without saying that all important functions of the new firmware version have already been verified by the manufacturer. The firmware then performs its functions, such as reading measurement or control data and process data from the automation system 14 and transmitting the data, if necessary in processed form, to an external server platform 4 (point 25). The functions to be performed under point 25 are continuously executed by Edge Device 3 until Edge Device 3 is shut down (point 26). The process is terminated at point 27.

[0046] If, for safety reasons, a quality control system is to be used to verify the quality of the new version of the firmware (FW), the firmware (FW) is transmitted to the test system 6 via the internet (Section 28) and installed on the real-time computing unit 7 of the test system 6 under Section 29. Real or simulated measurement or process data is made available to the firmware (FW) to verify safety-critical functions of the edge device 3. To verify which data enters or leaves the system operator's sphere, the corresponding data communicated to a test cloud is evaluated. This evaluation and, if necessary, authorization is performed by the operating personnel B of the automation system 14. The data relating to critical functions of the edge device 3 is displayed on an output unit 10, in particular a display unit, and manually authorized or rejected by the operating personnel B (Sections 30, 31).

[0047] This process is repeated until all data results from the tested safety-critical functions of Edge Device 3 in automation system 14 have been verified. Only if the test results provide the expected information consistent with the plant operator's safety requirements (point 32) will the new firmware version be installed on Edge Device 3 of automation system 14 (point 23) – only then will it be deployed to the P-System. If one of the functions of the new firmware version classified as safety-critical by the plant operator is rejected, the firmware version will not be put into production, and the test procedure will end at point 33. The test procedure according to the invention provides the plant operator with the necessary security to accept the download and installation of a new firmware version of an Edge Device 4 via the Internet.The testing procedure makes everything the plant operator wants to know transparent. After the test, it's clear, for example, which diagnostic data is being queried from field devices 1, how the queried data is being interpreted, which test routines are being performed, and which data is being uploaded to the internet.

[0048] List of reference symbols

[0049] 1 field device

[0050] 2 Gateway

[0051] 3 Edge Device / Connecting Device

[0052] 4 external server platform

[0053] 5 Communication connection

[0054] 6 Test system / Q-system

[0055] 7 Real-time computing unit

[0056] 8 Listener unit

[0057] 9 Simulation unit

[0058] 10 Output unit / display unit

[0059] 11 Simulation system

[0060] 13 Software program

[0061] 14 Automation system

[0062] 15 lloT

[0063] 16 servers

Claims

Patent claims 1 . Method for testing a new version of a firmware (FW) of a connection device (3), wherein the connection device (3) is arranged in an automation system (14) between the field devices (1) of the automation system (14) of a system operator and an external server platform (4) in the so-called production system or P-system, with the following method steps: - the new version of the firmware (FW) is transmitted via the Internet or another network to a quality system or Q-system, whereby the Q-system is assigned to the P-system, - the quality of at least some actions / reactions of the new firmware (FW) to simulated events, which are at least largely modeled on the events actually occurring in the automation system (14), is tested on the Q system before installation on the P system, the new version of the firmware (FW) is installed on the connection device (3) of the P system if the actions / reactions of the new firmware (FW) to the simulated events tested on the Q system meet the quality criteria specified by the system operator.

2. Method according to claim 1, wherein simulation rules in the form of software programs (13) are made available to the Q-system for the quality assessment of the new version of the firmware (FW), which at least largely simulate individual events that take place in the P-system and in which the connecting device (3) acts or reacts.

3. The method according to claim 1, wherein the data traffic on the connection device (3) in the P-system is recorded over a predetermined period of time, wherein during the predetermined period of time the predecessor version of the new version of the firmware (FW) is installed on the connection device (3), which meets the predetermined quality criteria of the system operator, and wherein the data of the recorded data traffic are made available to the Q-system as test data for the quality assessment of the new version of the firmware (FW).

4. The method according to claim 1, wherein simulation data generated in an external virtual simulation system (11) which is simulated at least in parts of the automation system (14) are made available to the Q system for the quality assessment of the new version of the firmware (FW).

5. The method according to claim 1, wherein the Q-system for the quality assessment of the new version of the firmware (FW) is provided with simulation data which were generated in an external real simulation system (11) which is simulated at least in parts of the automation system (14) with real field devices when fulfilling real or simulated measuring or control tasks.

6. Method according to at least one of the preceding claims, wherein the results of the quality assessment carried out in the Q system are output and displayed to the operating personnel (BP) of the automation system (14).

7. The method according to claim 6, wherein the new version of the firmware (FW) is installed on the connection device (3) in the P-system if the new version of the firmware (FW) sufficiently meets the quality criteria used for the quality assessment in the Q-system, or wherein the installation of the new version of the firmware (FW) on the connection device (3) of the P-system is refused if the new version of the firmware (FW) does not meet the quality criteria used for the quality assessment in the Q-system or does not meet them sufficiently.

8. Method according to one or more of the preceding claims, wherein at least one process variable of a process medium is determined or regulated or controlled by each of the field devices (1) in the automation system.

9. Device for carrying out the method as described in at least one of claims 1-8, with a connecting device (3) which is arranged in an automation system (14) with a plurality of field devices (1) between the field devices (1) of the automation system (14) and an external server platform (4), wherein the connecting device (3) is assigned a test system (6) which serves to check the quality of the new version of the firmware (FW) intended for the connecting device (3), wherein the quality is checked with regard to predetermined quality criteria and wherein the test system (6) has the following components: - a real-time computing unit (7) on which the new version of the firmware (FW) of the connecting device (3) is installed, - a simulation unit (9) which is in communication with the real-time computing unit (7) and which provides the computing unit (7) with test data, whereby the actions and reactions of the new version of the firmware (FW) to the test data provided are used to check whether the firmware (FW) meets the specified quality criteria of the plant operator, - a listener unit (8) which monitors the data traffic between the computing unit (7) and the simulation unit (9), - an output unit (10) on which the data listened to and possibly further processed by the listener unit (8) are output.

10. Device according to claim 9, wherein the connecting device (3) is an edge device.

11. Device according to one of claims 9 and / or 10, wherein the test system (6) has a communication interface to the Internet, and wherein the new version of the firmware (FW) of the connecting device (3) is loaded onto the computing unit (7) of the test system (6) via the Internet.

12. Device according to one of claims 9 and / or 10, wherein the test system (6) has a communication interface to a network of the automation system (14), and wherein the new version of the firmware (FW) of the connecting device (3) is loaded onto the computing unit (7) of the test system (6) via the network.

13. Device according to at least one of claims 9-12, wherein an external simulation system (11) is provided in which the automation system (14) is at least partially simulated in real or virtual form, and wherein the external simulation system (11) is connected to the test system (6), in particular the simulation unit (9) of the test system (6), via the Internet.

14. Device according to one or more of the preceding claims, wherein the quality criteria relate, for example, to the performance of diagnostic procedures on the field devices (1) or to the request for diagnostic data or parameter data from the field devices (1).

15. Device according to one or more of the preceding claims 9-14, wherein field devices (1.

1. ... 1.m) of the automation system (14) communicating via Ethernet are in direct communication with the connecting device (3) or the edge device, while field devices (1.1, ...1.n) communicating via a fieldbus protocol commonly used in automation technology or a proprietary fieldbus protocol communicate with the connecting device (3) via a gateway (2) which is connected between the field devices (1.1, ...1.n) and the connecting device (3) or the edge device.

Images