Method for operating a technical system by means of an automation system, computer program product, computer-readable storage medium, and automation system

Abstract

The invention relates to a method for operating a technical system (129) by means of an automation system (10), said method comprising the steps of: - identifying a device configuration (44) of the technical system (12) by means of an electronic computing unit (14) of the automation system (10); - generating a device attestation (46) depending on the identified device configuration (44) by means of the electronic computing unit (14); - transmitting the device attestation (46) to a planning unit (16) of the automation system (10) for planning a project for the technical system (12) by means of the electronic computing unit (14); - verifying, by means of the planning unit (16), the device attestation (46) depending on the project to be carried out; and - transmitting planning data (48) for the project to the electronic computing unit (14) depending on the verification by means of the planning unit (16). The invention also relates to a computer program product, to a computer-readable storage medium, and to an automation system (10).

Description

[0001] Description

[0002] Method for operating a technical system by means of an automation system, computer program product, computer-readable storage medium and automation system

[0003] The invention relates to a method for operating a technical system using an automation system. Furthermore, the invention relates to a computer program product, a computer-readable storage medium, and an automation system.

[0004] A device, such as a control unit, an Internet of Things (IoT) device, or a programmable logic controller (PLC), can cryptographically authenticate itself to communication partners using a device certificate. In addition to the public device key, the device certificate also contains information about the control unit itself, such as the manufacturer, model, version, and serial number. This information contained in the device certificate thus describes immutable properties of the control unit.

[0005] However, especially in flexible production (Industry 4.0, plug-and-produce), a production environment is regularly reconfigured. This can also result in changes to the hardware components connected to the device, such as sensors, actuators, I / O modules (input / output), expansion modules, and technology modules. Conventional device authentication is not sufficiently reliable in this case, as authentication only reliably confirms the fixed, immutable aspects of the authenticating device itself.

[0006] There is therefore a need for improved device authentication, especially for devices that support flexible hardware configuration changes.

[0007] The object of the present invention is to provide a method, a computer program product, a computer-readable storage medium and an automation system by means of which improved device authentication can be realized.

[0008] This object is achieved by a method, a computer program product, a computer-readable storage medium, and an automation system according to the independent patent claims. Advantageous embodiments are specified in the subclaims.

[0009] One aspect of the invention relates to a method for operating a technical system by means of an automation system. A device configuration of the technical system is identified by means of an electronic computing device of the automation system. A device attestation is generated by means of the electronic computing device depending on the identified device configuration. The device attestation is provided to a configuration device of the automation system for configuration of a project for the technical system by means of the electronic computing device. The device attestation is checked by means of the configuration device depending on the project to be implemented, and configuration data for the project is transmitted to the electronic computing device depending on the check by means of the configuration device.

[0010] This makes it possible, for example, for appropriate device configurations to be certified in the so-called Industry 4.0, whereby changing hardware in the technical system can also be certified accordingly and appropriate project planning can be carried out. In particular, it is thus envisaged that the electronic computing device, for example in the form of an IoT device (Internet of Things), a programmable logic controller (PLC), or an IPC (Industrial Personal Computer) with a local or remote I / O interface (input / output), is provided with a changeable hardware configuration. The control unit orThe electronic computing device determines the corresponding device configuration, also referred to as the hardware configuration, i.e. which hardware components / device components are connected to the electronic computing device, and confirms this in the form of an attestation that is particularly cryptographically protected. In other words, the hardware configuration specifies in particular which hardware components and / or device components are connected to the electronic computing device. The hardware components can be, for example, sensors or actuators that are connected to the electronic computing device via a local I / O interface of the electronic computing device or via a remote I / O interface, in particular as so-called decentralized peripherals, in order to detect plugged-in or connected expansion modules, technology modules or configuration modules (configuration plug, SD card).The electronic computing device creates a cryptographic data structure that describes the determined device configuration and makes it available via a communication interface, such as OPC UA or HTTP. This data structure / device attestation can also be referred to as "hardware configuration attestation." In one variant, it can also include information about the components permanently installed in the control unit.

[0011] The corresponding Hardware Configuration Attestation is transmitted to the configuration facility, which can also be referred to as the configuration data system or the device management system, and checked. A configuration, i.e., the configuration data, is only loaded onto the electronic computing device if the configuration facility is compatible with the device configuration confirmed by the Hardware Configuration Attestation. This can be achieved, for example, by checking the consistency of the Hardware Configuration Attestation entries with a reference hardware configuration assigned to the configuration.

[0012] In particular, this reliably and tamper-proofs the possibility of a project that is incompatible with the current device configuration of the electronic computing device being accidentally loaded onto it and executed. A project is therefore only loaded onto the electronic computing device if it actually has the expected hardware components. This prevents the electronic computing device from switching to stop mode after detecting the incompatibility. This is particularly advantageous when, in flexible production, e.g., Industry 4.0, plug-and-produce, changes are regularly made to the hardware configuration of production systems. Delays and production downtimes are avoided if control devices switch to an error mode or stop mode that require manual intervention.

[0013] Furthermore, it can prevent a project from being loaded onto a test control unit for the purpose of reverse engineering that is not connected to the expected device configuration. The invention is applicable, in particular, to conventional hardware-based PLCs as well as to virtualized PLCs, for example, control units / PLCs implemented as native applications, containers, or virtual machines, which are executed on an open computer platform, such as an IPC or an edge server.

[0014] A configuration defines the control functionality of the device or adapts a prepared control functionality. A configuration, i.e., the configuration data that can be loaded onto a device, can include, for example, control parameters for a PID controller, values ​​for switching thresholds, a ladder diagram, a function block diagram, or an instruction list for a programmable logic controller.

[0015] In this case, it can further be provided, in particular, that the electronic computing device is arranged or configured, for example, on the technical system and has corresponding connections, whether wireless or wired, with the technical system. Wireless or wired communication can then take place between the configuration device, which can be server-based, for example. However, the configuration device is configured, in particular, independently of the technical system and the electronic computing device.

[0016] According to an advantageous embodiment, potential projects to be implemented are identified based on the device certification, and the potential projects to be implemented are made available for selection by a person. For example, the project planning facility can first determine a list of potential projects that are permissible for the device configuration confirmed by the device certification. This list of permissible projects can then be used to select all of these permissible projects for transfer to the electronic computing device. Accordingly, a user can be shown which projects are not permissible and which projects are permissible.

[0017] It is also advantageous if, after the configuration data has been transmitted to the electronic computing device, any changes to the device configuration on the technical system are blocked. In particular, this makes it possible for the device configuration confirmed, for example, by the so-called Hardware Configuration Attestation, to be sealed on the electronic computing device, i.e. temporarily, for example until the seal is lifted / revoked, thus blocking any changes to the hardware configuration. Blocking can be achieved, for example, by logical or mechanical protection. This ensures that the current device configuration is protected from further manipulation and, for example, prevents any further changes to the device configuration.

[0018] It has also proven advantageous to generate a warning message when the device configuration is changed. In particular, this can generate a warning for a user when the device configuration is changed, indicating that the originally attested device configuration no longer matches the actual device configuration. This can prevent, for example, the technical system from going into stop mode. This allows for reliable project implementation.

[0019] It is also advantageous if the device configuration is monitored by the electronic computing device during operation of the technical system. In particular, it can be provided that the electronic computing device monitors the technical system while the project planning is loaded / active, so that the attested device configuration remains unchanged. This can be done, in particular, automatically or upon instruction from a project planning data system, in particular the project planning device. Thus, even during operation, it can be reliably detected if an inadmissible change to the device configuration is made.

[0020] A further advantageous embodiment provides that a mechanical connection on the technical system is locked and / or blocked by means of the electronic computing device. In particular, the electronic computing device can, for example, appropriately lock a mechanical connection, e.g., a plug or socket, via which a replaceable hardware component or a cabling to it is connected. This prevents or at least impedes a change to the hardware configuration. Furthermore, the electronic computing device can also prevent or lock a cover flap, maintenance flap, or similar device that has physical access to corresponding hardware component interfaces.Furthermore, the electronic computing device and / or the configuration device can lock a corresponding control cabinet or a rack in which the electronic computing device is installed to prevent physical access to the corresponding hardware component of the electronic computing device. This allows the technical system to be operated in a tamper-proof manner. In another variant, hardware configuration attestation can include information indicating whether a mechanical protective device, e.g., a lock or a manually closable protective cover, is locked.

[0021] Furthermore, it has proven advantageous to generate the device attestation using cryptographic protection. This allows the corresponding device attestation to be reliably transmitted to the project planning facility, thus enabling tamper-proof project implementation on the technical system.

[0022] It has also proven advantageous if a device component in the technical system is identified based on a device-specific identifier. The device-specific identifier can be, for example, a serial number or an identifier. Preferably, the corresponding device component can also be cryptographically authenticated, as is known, for example, from USB or PCI. This allows the device configuration and thus the device attestation to be reliably determined and generated.

[0023] Furthermore, it has proven advantageous to identify device components based on a device-specific parameter of the device component. In particular, the device-specific parameter is a so-called "soft" property, particularly a component fingerprint. For example, the device can be identified based on electrical parameters that are subject to production fluctuations.Examples include internal resistance, impedance, scattering parameters of an analog-connected actuator or sensor, or of a component connected via a digital communication interface, such as ITC, SPI, or USB, or a time-resolved response signal to a test pulse signal, such as that known from time-domain reflectometers, or a frequency spectrum signal that, similar to the measurement of an electrical filter, is determined by a spectrum analyzer upon excitation by a noise signal or by reading calibration data from the connected and stored devices. In particular, the selected device certification preferably also contains information on how the respective device component was identified or authenticated.

[0024] It is also advantageous if the design data is only transferred to the electronic computer if the project is compatible with the device configuration. This has the particular advantage that, for example, no design data is transferred to the electronic computer if the project is incompatible with the current device configuration. This prevents, for example, the technical system from being started without the project actually being feasible. This prevents corresponding downtimes. This allows the project to be implemented reliably.

[0025] It is also advantageous if, in order to check the device configuration, a simulation of the device configuration is carried out using the configuration facility depending on the project to be implemented. In particular, based on the corresponding hardware configuration attestation, a simulation corresponding to the confirmed hardware configuration can be set up and the configuration can be loaded and activated / executed on this simulation environment for testing purposes. Furthermore, it is possible for the simulation environment to form another hardware configuration attestation so that the conformity of the hardware configuration attestation of the electronic computing device and the hardware configuration attestation of the simulation environment can be checked. This allows a reliable check to be made as to whether the corresponding configuration is compatible with the attested device configuration.

[0026] Furthermore, it has proven advantageous if a reference device configuration is compared with the device configuration using the configuration device to check the device configuration. For this purpose, the configuration device can, for example, have a corresponding database with the reference device configurations. The identified device configuration is then compared with the reference device configuration and, if there is a match, the configuration data can be transmitted accordingly. In particular, the configuration is only loaded onto the electronic computing device if the configuration is compatible with the hardware configuration confirmed by the hardware configuration attestation. This can be done, for example, by checking the match between the entries in the hardware configuration attestation and a reference hardware configuration assigned to the configuration.Furthermore, it is possible for the project planning facility to check whether the device configuration confirmed by the Hardware Configuration Attestation is included in a positive list of reference device configurations.

[0027] The method presented is, in particular, a computer-implemented method. Therefore, a further aspect of the invention relates to a computer program product with program code means which, when the program code means are processed by the electronic computing device, cause an electronic computing device to carry out a method according to the preceding aspect.

[0028] The invention therefore also relates to a computer-readable storage medium with at least one computer program product according to the preceding aspect.

[0029] Yet another aspect of the invention relates to an automation system for operating a technical system, having at least one electronic computing device and a project planning device, wherein the automation system is designed to carry out a method according to the preceding aspect. In particular, the method is carried out by means of the automation system.

[0030] Advantageous embodiments of the method are to be regarded as advantageous embodiments of the computer program product, the computer-readable storage medium, and the automation system. The automation system has material features for this purpose in order to be able to carry out corresponding method steps.

[0031] A computing unit / electronic computing device can be understood, in particular, as a data processing device that contains a processing circuit. The computing unit can therefore, in particular, process data to perform computing operations. This may also include operations for performing indexed access to a data structure, for example, a look-up table (LUT).

[0032] The computing unit can in particular contain one or more computers, one or more microcontrollers and / or one or more integrated circuits, for example one or more application-specific integrated circuits (ASICs), one or more field-programmable gate arrays (FPGAs), and / or one or more single-chip systems (SoCs). The computing unit can also contain one or more processors, for example one or more microprocessors, one or more central processing units (CPUs), one or more graphics processing units (GPUs) and / or one or more signal processors, in particular one or more digital signal processors (DSPs). The computing unit can also contain a physical or virtual network of computers or other of the aforementioned units.

[0033] In various embodiments, the computing unit includes one or more hardware and / or software interfaces and / or one or more memory units.

[0034] A memory unit can be a volatile data memory, for example a dynamic random access memory (DRAM) or a static random access memory (SRAM), or a non-volatile data memory, for example a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory or flash EEPROM, a ferroelectric random access memory (FRAM), a magnetoresistive random access memory,MRAM (magnetoresistive random access memory) or phase-change random access memory, PCRAM (phase-change random access memory).

[0035] For use cases or application situations that may arise during the method and which are not explicitly described here, it may be provided that, in accordance with the method, an error message and / or a request to enter user feedback is issued and / or a default setting and / or a predetermined initial state is set.

[0036] Regardless of the grammatical gender of a particular term, persons with male, female or other gender identities are included.

[0037] Further features of the invention emerge from the claims, the figures and the description of the figures. The features and combinations of features mentioned above in the description as well as the features and combinations of features mentioned below in the description of the figures and / or shown in the figures can be encompassed by the invention not only in the respectively specified combination, but also in other combinations. In particular, the invention can also encompass embodiments and combinations of features that do not have all the features of an originally formulated claim. Furthermore, the invention can encompass embodiments and combinations of features that go beyond the combinations of features set out in the references to the claims or deviate from them.

[0038] The sole figure FIG shows a schematic block diagram according to an embodiment of an automation system with a technical system.

[0039] The invention is explained in more detail below using specific embodiments and associated schematic drawings. In the figures, identical or functionally equivalent elements may be provided with the same reference numerals. The description of identical or functionally equivalent elements may not necessarily be repeated for different figures.

[0040] The figure FIG shows a schematic block diagram according to an embodiment of an automation system 10 for a technical system 12. The technical system 12 can, for example, be designed in the form of a production machine for producing a product. The automation system 10 has at least one electronic computing device 14 as a configurable device and a projecting device 16. The electronic computing device 14 can, for example, communicate with the technical system 12 via corresponding communication lines, both wired and wireless, and can, for example, also be located on the technical system 12. For this purpose, the electronic computing device 14 can, for example, have an I / O module (input / output module) 18. In the following exemplary embodiment, the technical system 12 has, for example, two sensors 20 and two actuators 22.The sensors 20 and the actuators 22 are coupled to the electronic computing device 14 via the I / O module 18.

[0041] Here and below, a module can be understood as a hardware module or a software module. In particular, a module can also consist of hardware and a software part implemented on the hardware. A software module can be understood as a part of the software code that is functionally connected and combined into a single unit. A software module can comprise or implement multiple processing steps and / or data structures. A method step for providing a software module can be understood as comprising providing a corresponding software code in computer-readable form on a computer-readable storage medium.

[0042] In the following exemplary embodiment, the electronic computing device 14 further comprises a USB module 14, a device identification module 26, a device attestation module 28, a communications module 30, and a processor system 32. The processor system 32, in turn, comprises a corresponding control function 34 for the technical system 12.

[0043] In the present embodiment, the project planning device 16 has in particular an attestation verification module 36, an authorization verification module 38, a database 40 and a project data provision module 42.

[0044] In particular, FIG shows an embodiment of the method for operating the technical system 12 by means of the automation system 10. A device configuration 44 of the technical system 12 and / or the electronic computing device 14 is identified by means of the electronic computing device 14. A device attestation is determined as a function of the identified device configuration 44 by means of the electronic computing device 14. The device attestation 46 is transmitted to the project planning device 16 for planning a project for the technical system 12 by means of the electronic computing device 14, ie by loading a project (project planning data 48) from the project planning device 16 to the control unit (computing device 14). The device attestation 46 is

[0045] Depending on the project to be carried out, the project planning device 16 is used to check the project planning data 48 for the project and this is transmitted to the electronic computing device 14 depending on the check carried out by the project planning device 16.

[0046] In particular, it is provided that, depending on the device certification 46, potential projects to be implemented are identified and the potential projects to be implemented are made available for selection by a person. Furthermore, after the project planning data 48 have been transmitted to the electronic computing device 14, a change to the device configuration 44 on the technical system 12 can be blocked. Furthermore, a warning message can be generated when the device configuration 44 is changed. Furthermore, it can be provided that the device configuration 44 is monitored by means of the electronic computing device 14 during the operation of the technical system 12. For this purpose, it can further be provided that a mechanical connection on the technical system 12 and / or on the electronic computing device 14 is locked and / or blocked by means of the electronic computing device 14.

[0047] In particular, it can further be provided that the device attestation 46 is generated in a cryptographically protected manner.

[0048] Furthermore, it can be provided that a device component on the technical system 12 is identified based on a device-specific identifier of the device component. Furthermore, a device component can be identified based on a device-component-specific parameter of the device component.

[0049] Furthermore, it can be provided that the project planning data 48 are only transmitted to the electronic computing device 14 if the project is compatible with the device configuration 44.

[0050] Furthermore, it can be provided that a simulation of the device configuration 44 is carried out depending on the project to be implemented using the project planning device 16 for checking the device configuration 44. Alternatively or additionally, a reference device configuration, for example, provided on the database 40, can be compared with the device configuration 44 using the project planning device 16 for checking the device configuration 44.

[0051] In particular, the figure FIG shows the electronic computing device 14, for example in the form of an IoT device, a control unit, a programmable logic controller PLC or an IPC with a local or remote I / O interface with a changeable hardware configuration.

[0052] The electronic computing device determines the device configuration 44, i.e., which device components are connected to the electronic computing device 14, and confirms this in the form of a cryptographically protected device attestation 46. The device components can be, for example, sensors 20 and actuators 22 connected to the electronic computing device 14 via the local I / O module 18 or via a remote I / O interface, plugged-in or connected expansion modules, technology modules, or configuration modules. The electronic computing device 14 forms a cryptographically protected data structure that describes the determined device configuration 44 and makes it available via the communication module 30, e.g., an OPC UA server. The data structure can also be referred to as "hardware configuration attestation," in particular the device attestation 46.In one variant, this can additionally also include information about the components permanently installed in the electronic computing device 14.

[0053] A device component can preferably be identified using an identifier, for example, a serial number. The device component can preferably be cryptographically authenticated, for example, via the USB module 24 or via PCI interfaces. It is also possible to identify the device component using "soft" properties, particularly in the context of the component fingerprint, for example, using electronic parameters that are subject to production fluctuations. The issued device certification 46 preferably contains information about how the respective device component was identified or authenticated.

[0054] The device attestation 46 is transmitted to the project planning device 16, for example in the form of a SAT tool (SAT: SIMATIC Automation Tool from Siemens), TIA Portal (TIA Portal: Totally Integrated Automation Portal from Siemens), Common Device Management System or the like, and checked. A project planning is only loaded onto the electronic computing device 14 if the project planning is compatible with the device configuration 44 confirmed by the device attestation 46, and if the device attestation 46, i.e. its cryptographic checksum, is valid. This can be done, for example, by checking the conformity of the entries in the device attestation 46 with a reference hardware configuration assigned to the project planning.However, it is also possible that, based on the device attestation 46 of a confirmed hardware configuration, a corresponding simulation is set up and the configuration is loaded and activated / executed on this simulation environment for testing purposes. Furthermore, it is possible for the simulation environment to form another device attestation 46 so that the conformity of the device attestation 46 of the electronic computing device 14 and the device attestation 46 of the simulation environment can be verified. In one variant, the actual device attestation 46 is not transmitted directly to the configuration device 16, but rather to the certification authority (certification authority or its registration authority), which provides the device with a device certificate containing the information confirmed by the device attestation 46.The electronic computing device 14 can then authenticate itself to the project planning device using this device certificate, which includes the device attestation 46, and in doing so also confirm the device attestation 46 via the project planning device 16.

[0055] The electronic computing device 14 can use the device attestation 46 created when loading a project to monitor that the device configuration 44 remains unchanged as long as the project is loaded or when it is being executed, particularly in the so-called operating mode, i.e., when the electronic computing device 14 has activated the control functionality according to this project. In the event of a deviation, i.e., a change to the device configuration 44, an error operating mode can be activated or a warning message can be provided.

[0056] Furthermore, as a result of the check, a so-called Commissioning Data Hardware Configuration Compatibility Attestation can be created, which confirms that a specific configuration, in particular the configuration data 48, is compatible with the specific device configuration 44 of the electronic computing device 14. This can be checked, for example, by the configuration device 16 before a configuration is loaded onto the electronic computing device 14. To do this, the configuration device 16 can authenticate a device and check the conformity of the authenticated device identities with the device identity contained in, referenced in, or confirmed in the device attestation 46. It is also possible for this to be checked by the electronic computing device 14 before the assigned configuration is accepted or activated by the electronic computing device 14.Furthermore, the electronic computing device 14 and the configuration device 16 can, for example, generally record in the form of a log audit entry with which device certification 46 a specific configuration was loaded or activated together.

[0057] The figure FIG shows in particular the electronic computing device 14 with the identification module 26 for determining the currently existing device configuration 44, i.e. the sensors 20 and actuators 22 connected to the I / O interface (I / O module 18) and the USB devices connected to the USB module 24. The determined device configuration 44 is transmitted to the device attestation module 28, which forms the cryptographically protected device attestation 46. The device attestation 46 is then transmitted to the configuration device 16, in particular as a commissioning system, and checked by it, in particular by the attestation verification module 36. Furthermore, the configuration device 16 checks whether a specific configuration is permissible for this device configuration 44, in particular via the authentication verification module 38. If the selected configuration is permissible, it is transmitted to the electronic computing device 14.In this case, the configuration device 16 preferably checks whether the device / device component authenticated during the transmission of the configuration corresponds to the device to which the device attestation 46 refers.

[0058] It is also possible for the configuration device 16 to first determine a list of configurations that are permissible for the device configuration 44 confirmed by the device attestation 46. This list of permissible configurations can then be used to select one of these permissible configurations for transmission to the electronic computing device 14. Accordingly, a user can be shown which configurations are not permissible.

[0059] Furthermore, it is possible to seal the device configuration 44 of the electronic computing device 14 confirmed by the device attestation 46, i.e. temporarily, e.g. until the seal is lifted / revoked, and thus block changes to the device configuration 44. The blocking can be achieved by logical or mechanical protection. For example, with a loaded / active configuration, the electronic computing device 14 can monitor that the attested device configuration 44 remains unchanged; in particular, this can be done automatically or on the instruction of the configuration device 16. The configuration device 16 repeatedly and currently monitors the device attestation 16 created by the electronic computing device 14 by checking in order to check whether the expected device configuration 44 is still present. Furthermore, the electronic computing device 14 can have a mechanical connection, e.g.a plug or socket, mechanically lock, via which a replaceable hardware component or a cabling is connected to it. This prevents or at least makes it more difficult to change the device configuration 44. The electronic computing device 14 further locks a cover flap or lid or the like, which prevents physical access to the hardware components. Furthermore, the electronic computing device 14 and / or the configuration device 16 can lock a control cabinet or a rack in which the electronic computing device 14 is installed in order to prevent physical access to the device components of the electronic computing device 14.

[0060] Furthermore, it is possible for a technical system 44 to include a plurality or a multiplicity of computing units 14. Several or all of the computing units 14 can each determine a device configuration 44, create an associated device attestation 46, and transmit it to the configuration device 16. The configuration device 16 can then check the multiple device attestation 46 individually and further check the combination of the multiple device attestation 46. If the checks result in a positive result, the configuration device 16 provides the configuration data 48 associated with the respective computing device 14 to the plurality or multiplicity of computing units 14.

Claims

Patent claims 1. A method for operating a technical system (129) by means of an automation system (10), comprising the steps: - Identifying a device configuration (44) of the technical system (12) by means of an electronic computing device (14) of the automation system (10) in the form of a hardware configuration, which preferably indicates which hardware components and / or device components are connected to the electronic computing device; - generating a device certification (46) depending on the identified device configuration (44) by means of the electronic computing device (14); - transmitting the device certification (46) to a project planning device (16) of the automation system (10) for planning a project for the technical system (12) by means of the electronic computing device (14); - checking the device certification (46) depending on the project to be carried out by means of the project planning device (16); and - transmitting project planning data (48) for the project to the electronic computing device (14) depending on the verification by means of the project planning device (16).

2. Method according to claim 1, characterized in that potential projects to be carried out are determined as a function of the device certification (46) and the potential projects to be carried out are made available for selection by a person.

3. Method according to claim 1 or 2, characterized in that after the transmission of the project planning data (48) to the electronic computing device (14), a change to the device configuration (44) on the technical system (12) is blocked.

4. Method according to claim 3, characterized in that If the device configuration (14) changes, a warning message is generated.

5. Method according to claim 3 or 4, characterized in that the device configuration (44) is monitored by means of the electronic computing device (14) during operation of the technical system (12).

6. Method according to one of claims 3 to 5, characterized in that a mechanical connection on the technical system (12) and / or the electronic computing device (14) is locked and / or blocked by means of the electronic computing device (14).

7. Method according to one of the preceding claims, characterized in that the device certification (46) is generated in a cryptographically protected manner.

8. Method according to one of the preceding claims, characterized in that a device component on the technical system (12) is identified on the basis of a device-specific identifier of the device component.

9. Method according to one of the preceding claims, characterized in that a device component is identified on the basis of a device component-specific parameter of the device component.

10. Method according to one of the preceding claims, characterized in that the project planning data (48) are only transmitted to the electronic computing device (14) if the project is compatible with the device configuration (44).

11. Method according to one of the preceding claims, characterized in that by means of the projecting device (16) for checking the device configuration (44) a simulation of the device configuration (44) is carried out as a function of the project to be carried out.

12. Method according to one of the preceding claims, characterized in that a reference device configuration is compared with the device configuration (44) by means of the configuration device (16) for checking the device configuration (44).

13. Computer program product with program code means which cause an electronic computing device (14) to carry out a method according to one of claims 1 to 12 when the program code means are processed by the electronic computing device (14).

14. A computer-readable storage medium comprising at least one computer program product according to claim 13.

15. Automation system (10) for operating a technical system (12), with at least one electronic computing device (14) and a project planning device (16), wherein the automation system (10) is designed to carry out a method according to one of claims 1 to 12.

Images