How to embed an application in a real-time environment

Abstract

The present invention relates to a method (100) for embedding at least one application (20) in a real-time environment, wherein the real-time environment is provided by a programmable logic controller (31). -Step (101) of receiving at least one application (20), wherein at least one application (20) is received as an intermediate representation, - A step (102) of providing a sandbox (80) for at least one application (20) received, - Step (103) of executing at least one sandboxed application (21), wherein the execution step (103) is performed using a virtualization runtime (35) for a real-time environment based on an interpretation of at least one sandboxed application (21), and the intermediate representation is extended by the runtime (35) to provide at least one real-time and / or safety feature to at least one sandboxed application (21).

Description

Technical Field

[0001] The present invention relates to a method for embedding at least one application in a real-time environment. Further, the present invention relates to a computer program and a data processing device.

Background Art

[0002] Current Technical Status A programmable logic controller, also called a PLC (Programmable Logic Controllers), is an embedded computer specially made to control industrial processes. The common architecture of PLC software uses a real-time operating system, i.e., a short OS (short OS), to predictably execute PLC system software. This software is also called the PLC runtime. The PLC runtime plays a role in executing the PCL control logic. The PLC control logic is executed inside a scan cycle managed by the PLC runtime, scans inputs 55 and outputs 50 (shortened IO) to update an internal variable table, executes the control logic, and finally updates the IO. The PLC control logic continuously executes this scan cycle. This architecture has been widely used in recent industrial manufacturing equipment to control industrial control systems (ICS) that emphasize safety.

[0003] Because PLC control logic is executed by the PLC runtime, achieving multiprogramming within the PLC is difficult. All code executed by the PLC runtime must be reliable; a faulty component (e.g., one causing a runtime error) can jeopardize and destroy the entire system. While PLC runtimes can be built robust to some extent, this usually means that the PLC control logic must be somewhat reliable. For this reason, PLC programs are typically generated from specific programming models (ladders, functional block diagrams, or structured text, etc.). These models tend to limit functional complexity and expressiveness to exclude modern programming languages ​​and reduce the likelihood of introducing fatal errors into PLC programs. PLC runtimes supporting general-purpose languages ​​for advanced use cases must be carefully developed and debugged by highly specialized developers to avoid jeopardizing the entire PLC system. This is a costly and error-prone process. [Overview of the project] [Means for solving the problem]

[0004] Disclosure of the invention According to aspects of the present invention, a method having the features of claim 1, a computer program having the features of claim 9, and a data processing device having the features of claim 10 are provided. Further features and details of the present invention are disclosed in the respective dependent claims, description, and drawings. Features and details described in the context of the method also apply to the computer program and data processing device, and vice versa.

[0005] One aspect of the present invention includes a method for embedding at least one application in a real-time environment. The real-time environment can be provided by a programmable logic controller, also known as a PLC, and in particular, by enabling the use of the PLC to execute at least one application. The application can be configured as a program for the PLC.

[0006] This method may include, in particular, a step of receiving at least one application by a PLC in a real-time environment. The at least one application may be received as an intermediate representation, in particular as bytecode. Furthermore, this method may include a step of supplying a sandbox to the at least one application, specifically the received application. In other words, the application can be sandboxed. Thus, this method may also include a step of applying the sandbox to at least one application.

[0007] Furthermore, this method may include the step of executing at least one sandboxed application. In other words, the application can be executed by the PLC. This execution step can be performed based on the interpretation of at least one sandboxed application, specifically using a virtualized runtime in a real-time environment. The intermediate representation can be extended by the runtime to provide at least one real-time and / or safety feature for at least one sandboxed application. This extension may be made possible by injecting code into the intermediate representation, specifically bytecode, to provide the real-time and / or safety feature. This real-time feature can be used to enable the application to run under real-time conditions. The safety feature can make the execution of the application even safer, for example, by providing redundancy capabilities. Thus, the present invention can also provide a mechanism for embedding critical applications in the runtime. In the context of the present invention, the virtualized runtime, or simply the runtime, may also be called SafeRT (meaning "Safe Runtime") and / or the runtime environment and / or system software. The proposed mechanism may also make it possible to utilize WASM. Also known as WebAssembly, this is a known standard for defining a portable binary code format and its corresponding text format for executable programs and software interfaces to facilitate interaction between such programs and their host environments.

[0008] The extension, specifically known as code injection, can support application instrumentation. For example, safety features can run multiple versions of an application in a virtualized runtime to address application redundancy. Furthermore, real-time and / or safety features can provide application redundancy, and / or application monitoring, and / or application analysis, and / or a watchdog for the application. Thus, SafeRT can provide enhanced safety protection across heterogeneous hardware architectures through redundant execution of at least one functionally equivalent, automatically generated version of an application. In addition, SafeRT can use injected monitoring and assertion code in the application, specifically in the PLC program logic, to continuously analyze data and control flow. This can be used to detect and respond to failures and attacks.

[0009] The intermediate representation can be bytecode, specifically WebAssembly. In other words, applications executed by SafeRT can be compiled to WASM. This allows ergocode analysis and transformation to check and enforce program properties, and / or inject monitoring and assertions to enforce properties, and / or generate different program versions to run redundantly.

[0010] A virtualization runtime can provide a virtualization mechanism for securely embedding applications, specifically programs, into a PLC runtime system. For this purpose, the virtualization runtime can accept and interpret the intermediate bytecode representation of a program.

[0011] The real-time environment can be configured as a hardware device, specifically an embedded computer, preferably a programmable logic controller.

[0012] Runtime extension of the intermediate representation involves injecting monitoring and / or assertion code into the intermediate representation, specifically into bytecode, and specifically, it is possible to provide at least one real-time and / or safety function to detect and prevent faults and attacks. Preferably, different versions of the sandboxed application are generated and executed redundantly. A compliance checker may be used to inject the code. The compliance checker can be configured as a software and / or hardware component in a real-time environment. The method according to the present invention can provide software fault isolation between different applications, specifically PLC programs, to safely execute a general-purpose language within the PLC runtime, and to support the assurance of the real-time properties of the program. In addition, the method according to the present invention facilitates redundant execution of PLC programs, which can be used to detect faults. These properties can be achieved by using a common intermediate representation (WASM) of the PLC program and performing code analysis and transformation to ensure the properties at runtime. Another feature of the mechanism provided by the present invention is that it utilizes the common intermediate representation of the PLC program to detect and mitigate attacks against the control system by injecting monitoring and assertion code into the program logic.

[0013] Furthermore, the runtime can also provide a multiprogramming environment for simultaneously running multiple sandboxed applications. In other words, at least one application can include multiple applications, for example, at least two or at least three applications that can run concurrently.

[0014] Furthermore, the runtime can be configured to provide software fault isolation between a sandboxed application and another application running in a real-time environment, and / or between multiple sandboxed applications. The method according to the present invention can thereby provide a secure multiprogramming environment for the PLC runtime. This allows multiple programs to coexist through software fault isolation that prevents faults from propagating to other programs or the rest of the system. Another advantage of the present invention is that the safety assurances provided by the system allow for support for various general-purpose languages ​​(e.g., C, C++) with little or no burden on the developer.

[0015] Furthermore, it can also provide fine-grained system access. The virtualized runtime can follow a capability-based execution model; that is, programs are denied access to resources by default, and are only granted access to system resources that they strictly need to execute. Therefore, the runtime can include system access primitives specific to the industrial automation domain to grant fine-grained access to specific devices (modules, drives, etc.).

[0016] Another advantage is high fault tolerance. The method according to the present invention can provide enhanced security protection across heterogeneous HW (i.e., hardware) architectures through redundant execution of functionally equivalent, automatically generated versions of the application. It can also provide advanced fault and attack detection. The method according to the present invention can continuously analyze data and control flow using monitoring and assertion code injected into the PLC program logic. This can be used to detect and respond to faults and attacks. Furthermore, the application can include details of those codes and program properties, thus allowing for secure updates.

[0017] Another advantage is that it can support real-time aware orchestration. This allows for continuous monitoring of application resource usage. Therefore, the underlying operating system (e.g., scheduling parameters) can be configured to ensure timely and predictable execution. This feature can be crucial for considering different criticality and QoS requirements across applications, and for enabling the flexible addition of new applications to a running system.

[0018] It is possible to provide a system interface to allow sandboxed applications controlled access to resources in industrial control systems. It is also possible to run multiple versions of the sandboxed application at runtime. A runtime voting mechanism can be provided to check the results of multiple versions, specifically to provide redundancy for the sandboxed application. This runtime voting mechanism can be provided by redundant modules. Alternatively, or in addition, the following components can also be provided according to the method of the present invention.

[0019] - A runtime component configured to run sandboxed applications. Also known as the SafeRT WASM runtime.

[0020] - A system interface configured to allow controlled access to resources in industrial control systems. Also known as a SafeRT system interface.

[0021] - A compliance checker, also known as the SafeRT compliance checker. This is configured to provide a compile-time tool that injects monitoring and assertion code snippets into applications used at runtime to detect and prevent failures (such as runtime errors) and attacks.

[0022] - A redundant module, also known as the SafeRT Redundancy Module. It is configured to provide compile-time tools in combination with a runtime voting mechanism to support application redundancy across heterogeneous hardware architectures.

[0023] Furthermore, the sandboxed application can be configured as a safety-related application, specifically to automatically control the vehicle. The vehicle can also be configured as an automobile and / or passenger car and / or an autonomous vehicle for autonomous driving.

[0024] In other aspects of the present invention, a computer program, specifically a computer program product, can be provided. This computer program comprises instructions, and when this computer program is executed by a computer, it causes the computer to perform the method according to the present invention. That is, a computer program according to the present invention can have the same advantages as those described in detail with reference to the method according to the present invention.

[0025] In another aspect of the present invention, it is possible to provide an apparatus for data processing, also referred to as a data processing apparatus. This is configured to execute the method according to the present invention. As the apparatus, for example, it is possible to provide a computer that executes a computer program according to the present invention. This computer may include at least one processor that can be used to execute the computer program. Also, a non-volatile data memory can be provided, in which the computer program can be stored and read out therefrom by the processor in order to execute the computer program.

[0026] According to another aspect of the present invention, it is possible to provide a computer-readable storage medium comprising a computer program according to the present invention. This storage medium can be formed as a data storage device such as a hard disk and / or a non-volatile memory and / or a memory card and / or a solid state drive. The storage medium can also be integrated, for example, into a computer.

[0027] Furthermore, the method according to the present invention can also be implemented as a computer-implemented method.

[0028] Still other advantages, features, and details of the present invention will become apparent from the following description. In the following description, embodiments of the present invention will be described in detail with reference to the drawings. In this context, the features described in the claims and the description are, of course, essential for the present invention, either individually or in any combination.

Brief Description of the Drawings

[0029] [Figure 1] The method, computer program, and apparatus according to embodiments of the present invention. [Figure 2] Another exemplary visualization of embodiments of the present invention. [Figure 3] Another exemplary visualization of embodiments of the present invention. [Figure 4] Other exemplary visualizations of embodiments of the present invention [Figure 5] Other exemplary visualizations of embodiments of the present invention [Figure 6] Other exemplary visualizations of embodiments of the present invention [Modes for carrying out the invention]

[0030] In the following figures, the same reference numerals are used for the same technical features even in different embodiments.

[0031] Figure 1 shows Method 100 according to an embodiment of the present invention. Method 100 can be used to embed at least one application 20 into a real-time environment, as shown in Figures 2 to 6. The real-time environment can be provided by a programmable logic controller 31. According to the first method step 101, at least one application 20 can be received, which can be received as an intermediate representation. In other words, at least one application 20 can be supplied in bytecode format, allowing the same code to be executed across platforms, i.e., on different devices. The intermediate representation, and specifically bytecode, can take the form of an instruction set designed for efficient execution by a software interpreter. According to the second method step 102, a sandbox 80 can be supplied to the at least one received application 20. Then, according to the third method step 103, at least one sandboxed application 21 can be executed, specifically within the sandbox. Here, step 103 can be performed using a virtualization runtime 35 in a real-time environment, based on the interpretation of at least one sandboxed application 21, specifically its intermediate representation (bytecode). This intermediate representation may also be extended by the virtualization runtime 35 to provide at least one real-time and / or safety feature to at least one sandboxed application 21.

[0032] Embodiments of the present invention utilize a lightweight virtualization mechanism to securely embed a program into a PLC runtime system. However, this requires an environment that can limit memory access, I / O, and processing time without incurring the overhead associated with the conventional OS system's call chain or full-scale virtual machine. The lightweight virtualization runtime can accept and interpret intermediate bytecode representations of programs that can be generated from a wide range of source languages. The intermediate bytecode can be extended, i.e., modified ("in advance" or "just in time") before being converted to raw machine code 65, enabling hooks for resource metering, duplication, and usage limiting, without the use of special hardware. One example of a secure and reliable runtime target that is very well suited to a PLC environment is WebAssembly (Wasm), but there are other virtual machines with similar process modes using intermediate languages ​​such as eBPF, JVM, and LLVM IR.

[0033] Wasm is a binary instruction format for stack-based virtual machines. It is a safe, fast, and portable low-level bytecode format designed for efficient verification and compilation, as well as for safe execution with little or no overhead. Wasm also provides software-based fault isolation with respect to memory safety and control flow integrity. It prohibits access to memory outside its sandbox by restricting loads and stores to linear memory, ensuring that branches / jumps in code go only to intended addresses. It prevents buffer overflows with the help of a separate data stack and by ignoring function pointers by calling function references only from a table of checked functions.

[0034] Furthermore, the sandboxed application 21 can be provided with a system interface 36 to allow controlled access to resources in the industrial control system 5. The sandboxed application 21 can also be configured as a safety-related application 20, specifically to automatically control the vehicle 3.

[0035] Figure 1 also shows a computer program 20 and a data processing device 10 according to an embodiment of the present invention.

[0036] During the execution of an application, specifically a PLC program, conventional solutions often do not provide a mechanism for checking for program safety violations, such as memory access violations, malicious access to specific files of resources, sockets, and buffer overflows. The method according to embodiments of the present invention aims to create an execution environment for PLC programs that facilitates PLC program development, reduces development time, and supports safety and reliability properties. Specifically, embodiments of the present invention can provide at least one of the following:

[0037] - A mechanism to ensure that multiple independently created programs are executed at PLC runtime without interfering with each other, and that failures do not propagate to other programs or the system.

[0038] - A mechanism to support the coexistence of mixed criticality applications. Trusted applications can be deployed directly, while untrusted applications can be sandboxed using the mechanism described.

[0039] -Easy development of PLC programs. In current PLC program development, the environment provided for developing programs is relatively limited. This, in part, puts the entire system at risk. This stems from the need to create programs that never fail, and the lack of mechanisms to protect against failures in these programs.

[0040] - Automatic software redundancy for automatically running multiple versions of the same PLC program for fault detection. Furthermore, heterogeneous redundancy can also be easily achieved using the proposed lightweight virtualization technique. This is because the same virtualized PLC program can be run on different hardware architectures (e.g., Intel and ARM) without modification. For example, this can be used on SoCs containing different heterogeneous computing engines (e.g., μCs and μPs).

[0041] - Fine-grained virtualization of PLC programs. While virtualized PLCs can facilitate moving the entire PLC environment from the device to the (edge-)cloud, the proposed mechanism delves even deeper into the PLC infrastructure, significantly reducing overhead through platform-agnostic, lightweight sandboxing, and preparing for finer-grained virtualization (moving individual programs).

[0042] - Real-time awareness orchestration. The PLC system implements a scan cycle as shown in Figure 6. This scan cycle executes all PLC programs sequentially and equally. Therefore, there is no possibility of distinguishing between different levels of importance and QoS requirements between different PLC programs. The proposed mechanism enables the provisioning of system resources (e.g., CPU time) according to the individual real-time requirements of the PLC programs executed in the system.

[0043] -Furthermore, mechanisms for compliance checker 70 and automated code redundancy 75 can also be provided.

[0044] Figure 2 shows an embodiment of the present invention. Here, multiple applications 20 are executed using the proposed runtime 35 (SafeRT). For example, a Wasm-based sandbox 80 is provided for each program 21. Figure 3 shows another embodiment of the present invention. Here, the proposed runtime 35 coexists with one or more PLC runtimes 30. This is a more complex scenario in which a program 21 executed by the proposed runtime shares I / O with the PLC runtime through a shared memory (shm) mechanism. In this scenario, it may be necessary to protect I / O from data races, which can be done by an I / O manager that allows reading / writing I / O from only one of the runtimes 30 or 35. That is, if a certain I / O variable is accessed by the PLC runtime 30, this variable can be made read-only on the proposed runtime side. Conversely, if a program 21 executed by the proposed runtime 35 reads and writes a certain variable, this variable can be made read-only for program 22 on the PLC runtime 30. These checks can be performed statically at program startup using knowledge of the I / O used by each program.

[0045] Embodiments of the present invention can provide a sandbox 80 for the intermediate bytecode representation of the program 20, similar to Wasm. The sandbox 80, specifically the Wasm sandbox, can ensure isolation of software failures between various PLC programs 20. Furthermore, embodiments of the present invention can provide a custom dispatcher. This custom dispatcher uses the underlying OS 40 to provide the program 20 with real-time assurance during its execution. By utilizing Wasm support for multiple languages, the proposed runtime 35 can easily bring numerous programming languages ​​into PLC development. The runtime environment according to embodiments of the present invention can grant the program 20 access to various system equipment previously unavailable in common PLC programming environments, namely files 37, secure communications 38, and other peripherals. This access can be granted by a system interface 36 designed for industrial platforms and provided by embodiments of the present invention (see Figure 4).

[0046] According to embodiments of the present invention, a program 20 executed by the proposed runtime 35, such as WASM60, can be compiled into an intermediate bytecode representation, undergo code analysis and transformation, check and enforce program properties, inject monitoring and assertions to enforce properties, and generate different program versions for redundant execution.

[0047] A system interface 36 according to an embodiment of the present invention allows a program 20 to access system resources on the PLC platform, such as I / O, files, peripheral devices, or communication interfaces. This can be designed in the same way as a Wasm system interface (WASI), centered around the concept of capabilities, and grants a given program 20 access to resources in the industrial control system 5, an unforgeable reference to objects / resources, and a set of actions where capabilities qualify a holder. Figure 4 shows details of the system interface and how it interacts with the program and the PLC host system.

[0048] According to embodiments of the present invention, a code generation process can be provided as shown in Figure 5. For example, program 20 can be written in any Wasm-supporting language and compiled into Wasm bytecode (501). The code may then be analyzed (502) to ensure that program 20 can be converted into a program compliant with the proposed runtime. This step may be necessary to ensure that program 20 can meet real-time performance requirements and does not contain infinite recursion or loops. With respect to recursion and loops, the program may need to include boundary-defining declarations, such as program instructions supported by a particular compiler. In this step 503, additional performance counters and traps can be inserted into the code to monitor the program's performance at runtime and control its execution in case of exceptions. This step may also include the operation of generating multiple program versions.

[0049] A toolchain according to an embodiment of the present invention, when enabled, can generate multiple versions of a program that can be executed at runtime. These programs define I / O (provided by a system interface) and can be executed according to a defined structure, such as a scan cycle (implemented by a library for program development) that defines obvious points in time (at the end / start of each cycle) where the I / O can be compared. The proposed runtime 35 can also be responsible for checking whether the different versions of the program 20 have produced the same results and acts according to a developer-specified policy, such as a majority vote, minimum value, maximum value, or execution of an exception handler specified by the developer.

[0050] To generate different versions of the PLC program 20, the proposed runtime 35 can be based on three strategies. The first strategy is to perform address space randomization. The second strategy is to perform code obfuscation, which transforms the code and maintains its functional equivalent. Combining these, it becomes possible to probabilistically detect memory processing failures and program manipulation attacks. The third strategy is to make heterogeneous computation engines (including, for example, μCs and μPs) applicable. This creates diverse redundancy, and the execution of the PLC program is also protected against systematic hardware errors.

[0051] Embodiments of the present invention can also be used in middleware for industrial automation. Furthermore, embodiments of the present invention can be used for edge cloud orchestration in industrial automation, and / or for specialized safety check software for applications deployed in industrial automation, and / or for specialized automation code redundancy software for applications deployed in industrial automation and / or industrial automation platforms / ecosystems such as ctrIX World.

[0052] The above description of embodiments illustrates the present invention. Of course, individual features of the embodiments can be freely combined with each other without departing from the scope of the present invention, provided that this is technically justifiable.

Claims

1. A method (100) for embedding at least one application (20) in a real-time environment, wherein the real-time environment is provided by a programmable logic controller (31), and the method - A step (101) of receiving at least one application (20), wherein the at least one application (20) is received as an intermediate representation, - Step (102) of providing a sandbox (80) to the at least one application (20) received, - Step (103) of executing the at least one sandboxed application (21), which is executed using the virtualization runtime (35) of the real-time environment based on an interpretation of the at least one sandboxed application (21), and the intermediate representation is extended by the runtime (35) to provide at least one real-time and / or safety function for the at least one sandboxed application (21), A method (100) including the following.

2. The method (100) according to claim 1, characterized in that the intermediate representation is bytecode, specifically WebAssemble.

3. A method (100) according to any one of the preceding claims, wherein the extension of the intermediate representation by the runtime (35) includes injecting monitoring and / or assertion code into the intermediate representation to provide at least one real-time and / or safety function, specifically to detect and prevent faults and attacks, preferably generating and redundantly executing different versions of the sandboxed application (20).

4. A method (100) according to any one of the preceding claims, characterized in that the runtime (35) provides a multiprogramming environment for simultaneously executing a plurality of the at least one sandboxed applications (20).

5. The method (100) according to any one of the preceding claims, characterized in that the runtime (35) is configured to provide software fault isolation between the sandboxed application (21) and other applications (20) running in the real-time environment, and / or between a plurality of sandboxed applications (21).

6. A method (100) according to any one of the preceding claims, characterized in that the sandboxed application (21) is provided with a system interface (36) to allow controlled access to resources in the industrial control system (5).

7. A method (100) according to any one of the preceding claims, characterized in that a runtime (35) is provided to execute multiple versions of the sandboxed application (21) and to check the results of the multiple versions, specifically to provide redundancy for the sandboxed application (21).

8. The method (100) according to any one of the preceding claims, wherein the sandboxed application (21) is specifically configured as a safety-related application (20) for automatically controlling the vehicle (3).

9. A computer program (20) comprising instructions, wherein when the computer program (20) is executed by a computer, the computer causes the computer to execute the method (100) described in any one of the preceding claims.

10. A data processing device (10) comprising means for carrying out the method (100) according to any one of claims 1 to 8.

Images