Monitoring system for a programmable logic controller

Abstract

The invention relates to a monitoring system for a first programmable logic controller for controlling a technical system, said first programmable logic controller with a first program consisting of a plurality of modules, comprising: • a first check unit configured to form a first checksum via at least one transfer value and / or the state of a first module of the first program, • a second check unit configured to form a second checksum via at least one transfer value and / or the state of a second module, corresponding to the first module, of a second program of a second programmable logic controller, which is operated in parallel with the first programmable logic controller, said second program corresponding to the first program, • an analysis unit which is designed to compare the first checksum with the second checksum and output a comparison result, and • an output unit which is designed to output a warning message for the first programmable logic controller if the first checksum and the second checksum differ from each other.

Description

[0001] Description

[0002] Monitoring system for a programmable logic controller

[0003] The invention relates to a monitoring system and a computer-implemented method as well as a computer program product for monitoring a programmable logic controller.

[0004] Targeted attacks, such as cyberattacks, component defects, and / or firmware compilation errors, can alter processes in a programmable logic controller (PLC). Control system malfunctions can lead to machine downtime. Furthermore, a faulty control system poses a significant security risk.

[0005] It is therefore an object of the present invention to detect deviations in the program sequence of a programmable logic controller.

[0006] The problem is solved by the measures described in the independent claims. Advantageous embodiments of the invention are described in the dependent claims.

[0007] According to a first aspect, the invention relates to a monitoring system for a first programmable logic controller for controlling a technical system, wherein the first programmable logic controller comprises a first program from a plurality of building blocks, and the monitoring system comprises:

[0008] • a first test unit configured to generate a first checksum over at least one input value and / or a state of a first block of the first program,

[0009] • a second test unit configured to generate a second checksum over at least one input value and / or a state of a second block corresponding to the first block of a second program of a second programmable logic controller (PLC), wherein the second PLC operates in parallel with the first PLC and the second program corresponds to the first program, • an analysis unit configured to compare the first checksum with the second checksum and output a comparison result, and

[0010] • an output unit configured to issue a warning message to the first programmable logic controller if the first checksum and the second checksum differ.

[0011] An advantage of the present invention is that a programmable logic controller (PLC) can be monitored during operation, i.e., during program execution, and deviations from the target state can be detected concurrently with the operation. For this purpose, checksums, for example, hash values, of the processes are stored and compared. Thus, defects in system components, malfunctions, or attacks can be specifically located and detected.

[0012] In an advantageous embodiment, the second programmable logic controller can be implemented virtually on a computing unit.

[0013] Preferably, the first programmable logic controller (PLC) is mirrored on a computing unit (CPU), and this virtual second PLC can then be used to monitor the first PLC.

[0014] In another embodiment, the monitoring system can include a simulation unit that is set up to simulate the technical system by means of a computer-aided simulation.

[0015] For example, the simulation of the technical system can be controlled with the second programmable logic controller, and return values ​​from the simulation can be used for monitoring.

[0016] In another embodiment, the analysis unit can be configured to compare the first and second checksums for a defined period of the program.

[0017] This has the advantage that any offset due to latency in the connection or processing speed, etc., can be compensated for.

[0018] In another embodiment, the first and second checksums can be calculated using the Luhn algorithm. In yet another embodiment, if there is more than one function call in a function block, the first and second checksums can be calculated by concatenating the input values ​​of the respective function calls.

[0019] According to a second aspect, the invention relates to a computer-implemented method for monitoring a first programmable logic controller for controlling a technical system, wherein the first programmable logic controller comprises a first program from a plurality of building blocks, with the method steps:

[0020] • Forming a first checksum over at least one input value and / or a state of a first building block of the first program,

[0021] • Forming a second checksum over at least one input value and / or a state of a second block corresponding to the first block of a second program of a second programmable logic controller (PLC), wherein the second PLC is operated in parallel with the first PLC and the second program corresponds to the first program,

[0022] • Comparing the first checksum with the second checksum,

[0023] • Outputting a comparison result, and

[0024] • Issue a warning message to the first programmable logic controller if the first checksum and the second checksum differ.

[0025] In another embodiment, the monitoring of building blocks of a first program can be carried out according to a hierarchy structure of these building blocks.

[0026] Preferably, a comparison is performed at a higher-level program level. In the event of a deviation, the underlying level is then examined. In this way, a faulty component can be specifically identified. Preferably, the monitoring is performed iteratively.

[0027] Furthermore, the invention relates to a computer program product that can be directly loaded into a programmable computer, comprising program code segments that, when the program is executed by a computer, cause it to perform the steps of a method according to the invention. A computer program product can, for example, be provided or delivered from a server in a network on a storage medium such as a memory card, USB stick, CD-ROM, DVD, a non-volatile / permanent storage medium, or in the form of a downloadable file.

[0028] Exemplary embodiments of the monitoring system and method according to the invention are shown in the drawings and are explained in more detail below. The drawings show:

[0029] Fig. 1: shows a first embodiment of the monitoring system according to the invention for a first programmable logic controller;

[0030] Fig. 2: shows a second embodiment of the monitoring system according to the invention for a first programmable logic controller; and

[0031] Fig. 3: shows an embodiment of a computer-implemented method according to the invention for monitoring a programmable logic controller.

[0032] Corresponding parts are marked with the same reference symbols in all figures.

[0033] In particular, the following embodiments merely show exemplary implementation possibilities of how such implementations of the teaching according to the invention could look, since it is impossible and also not helpful or necessary for understanding the invention to name all these implementation possibilities.

[0034] Furthermore, a person skilled in the art, with knowledge of the method claim(s), will of course be aware of all the possibilities for realizing the invention that are customary in the prior art, so that in particular there is no need for a separate disclosure in the description.

[0035] Figure 1 shows a first embodiment of a monitoring system 100 according to the invention for monitoring a first programmable logic controller PLC1.

[0036] The first programmable logic controller (PLC) SPS1 is configured to control a technical system TS. For this purpose, a first program P runs on the first PLC SPS1, which contains a large number of blocks / function blocks with a hierarchical program structure. Monitoring by the monitoring system 100 can be performed according to this hierarchical structure.

[0037] The technical system TS can, for example, be a machine in an automation system, such as a production plant.

[0038] The monitoring system 100 is coupled to the first programmable logic controller PLC1, so that the monitoring system 100 can monitor the first program P.

[0039] The monitoring system 100 comprises a first test unit 101, a second test unit 102, an analysis unit 103, and an output unit 104. Preferably, the monitoring system 100 includes at least one processor. The monitoring system 100 can be implemented on an edge device, a consumer PC, a server, or in the cloud.

[0040] To monitor the program flow of the first programmable logic controller (PLC) SPS1, a second programmable logic controller (PLC) SPS2 is operated in parallel. Specifically, the second programmable logic controller (PLC) SPS2 is operated independently of the first programmable logic controller (PLC) SPS1; that is, preferably, no coupling or data exchange takes place between the two programmable logic controllers (PLCs) SPS1 and SPS2.

[0041] The second programmable logic controller (PLC) SPS2 contains exactly the same program P* as the first programmable logic controller (PLC) SPS1; that is, the second program P* corresponds to the first program P. The second programmable logic controller (PLC) SPS2 can, in particular, be coupled to a simulation of the technical system, so that the simulation provides the input values.

[0042] The second programmable logic controller (PLC2) can be implemented as a physical second controller or virtually.

[0043] The first check unit 101 is configured to generate a first checksum HW_PB over at least one input value and / or a state of a first block of the first program P. For example, a hash value can be calculated. The second check unit 102 is configured to generate a second checksum HW_PB* over at least one input value and / or a state of a second block of the second program P* that corresponds to the first block.

[0044] Consequently, the first checksum HW_PB and the second checksum HW_PB* are each generated by corresponding function blocks of the respective program P, P*. The checksums can be generated, for example, using the Luhn algorithm. If there is more than one function call in a function block, the first checksum HW_PB and the second checksum HW_PB* can each be generated by concatenating the values ​​passed to the respective function calls.

[0045] The first checksum HW_PB is then compared with the second checksum HW_PB* in analysis unit 103, and a comparison result CR is output to output unit 104. Preferably, the first checksum HW_PB and the second checksum HW_PB* are compared for a defined period of the program. The comparison result CR indicates either a match or a discrepancy. In the event of a discrepancy between the second checksum HW_PB* and the first checksum HW_PB, an error in the sequence program of the first programmable logic controller (PLC1) can be assumed.

[0046] The output unit is configured to output the comparison result CR. If the first checksum HW_PB and the second checksum HW_PB* differ, a warning message WS is issued for the first programmable logic controller (PLC1). The warning message WS can also include an error message. Furthermore, the warning message WS can also trigger the immediate termination of program P.

[0047] Figure 2 shows a second embodiment of a monitoring system 100 according to the invention for monitoring a programmable logic controller (PLC) 1, which is suitable for controlling a technical system TS. A first program P, comprising a plurality of blocks / function blocks, runs on the programmable logic controller (PLC) 1 to control the technical system TS.

[0048] Monitoring system 100 is coupled to programmable logic controller (PLC) SPS1. Alongside PLC SPS1, a second programmable logic controller (PLC) SPS2 is implemented virtually on a processing unit (CPU). The virtual PLC SPS2 operates concurrently with PLC SPS1 and comprises a program P* that exactly corresponds to the first program P of the (real) PLC SPS1. Preferably, the mirrored program P* of the virtual PLC SPS2 can run simultaneously with the program P of PLC SPS1.

[0049] The monitoring system 100 comprises a first test unit 101, which is configured to generate a first checksum HW_PB over at least one input value and / or a state of a first block of the program P of the programmable logic controller PLC1. The first test unit 101 can also be implemented as an extension of the program P of the programmable logic controller PLC1.

[0050] The monitoring system 100 can also include a simulation unit 105, which is configured to simulate the technical system TS by means of a computer-aided simulation. Preferably, the simulation unit 105 is coupled to the virtual programmable logic controller (PLC) 2, so that the simulation can be controlled by the PLC 2. Accordingly, the PLC 2 receives input and output values ​​from the simulation.

[0051] The program / sequence program P contains various blocks, such as DBs, FCs, and FBs. All these blocks have a different number and types of input values. The types of input values ​​can be, for example, Boolean, Float, or Integer. Additionally, internal flow variables may also be present. A checksum can be calculated for each block.

[0052] One possible approach is as follows:

[0053] • Input values ​​can be converted into numerical values, such as Boolean: true 1, false 0. Values ​​of type "String" can be converted according to the alphabetical principle, for example: A -> 1, B -> 2; etc.

[0054] • Multiple input values ​​can be concatenated to create a unique numerical value, such as: Inputs: i1 = true, i2 = false; Outputs: o1 = true, o2 = “abc”; temp_flag = 6 concatenated results in the numerical value 1011236. • A checksum can also be calculated for a range, for example using the Luhn algorithm.

[0055] Furthermore, the monitoring system 100 includes a second test unit 102, which is configured to generate a second checksum HW_PB* over at least one input value and / or a state of a second block corresponding to the first block of a second program P* of a second programmable logic controller (PLC2). Input values ​​and / or return values ​​can be provided by the simulation unit 105.

[0056] Thus, the same process / program is implemented in the virtual programmable logic controller PLC2, and a checksum is generated from the individual calls.

[0057] Subsequently, the respective checksums HW_PB, HW_PB* of the real and virtual programmable logic controller PLC1, PLC2 can be read out, e.g. via MQTT, OPCua, etc., and stored in a database and transferred from there to the analysis unit 103.

[0058] In the analysis unit 103 of the monitoring system 100, the first checksum HW_PB is compared with the second checksum HW_PB*, and a comparison result CR is provided. Preferably, a set of checksums from both sources is compared for a defined period, which may depend, for example, on the connection latency, CPU performance, etc. As soon as identical checksums are found in memory for each block, it can be assumed that neither of the two programmable logic controllers (PLCs) PLC1 and PLC2 has been hacked or modified.

[0059] The monitoring system 100 also includes an output unit 104, which is configured to issue a warning message if the first checksum HW_PB and the second checksum HW_PB* differ. If the first checksum HW_PB and the second checksum HW_PB* match, the comparison result CR can be output.

[0060] Preferably, monitoring can be performed iteratively for the program's components. To optimize monitoring, it can be carried out according to a hierarchical structure of the components. For example, a checksum can be calculated only for higher-level components. In the event of a deviation, only the corresponding cycle can then be investigated further.

[0061] Figure 3 shows an embodiment of a computer-implemented method according to the invention for monitoring a first programmable logic controller for controlling a technical system, wherein the first programmable logic controller comprises a first program from a plurality of building blocks.

[0062] The procedure comprises the following steps:

[0063] In a first step S1, a first checksum is generated over at least one input value and / or a state of a first building block of the first program.

[0064] In a second step S2, or in parallel to the first step, a second checksum is generated using at least one input value and / or a state of a second block corresponding to the first block of a second program of a second programmable logic controller (PLC). The second PLC operates in parallel with the first PLC. The second program preferably corresponds exactly to the first program.

[0065] Preferably, the first and second checksums can be generated in a block by concatenating the input values ​​of the respective function calls when there is more than one function call.

[0066] In the next step, the first checksum is compared with the second checksum. Preferably, this comparison is performed for a defined period of the program.

[0067] The comparison result is then output in the next step, S4.

[0068] If the first checksum differs from the second checksum (step S5), a warning message is issued for the first programmable logic controller (PLC). If they match (step S6), the test result is displayed.

[0069] Preferably, the method can be carried out iteratively with steps S1 to S6 for different defined time periods. All described and / or illustrated features can be advantageously combined within the scope of the invention. The invention is not limited to the described embodiments.

Claims

Patent claims 1. Monitoring system (100) for a first programmable logic controller (PLC1) for controlling a technical system (TS), wherein the first programmable logic controller (PLC1) comprises a first program (P) from a plurality of blocks, and the monitoring system (100) comprises: • a first test unit (101) configured to form a first checksum (HW_PB) over at least one input value and / or a state of a first block of the first program, • a second test unit (102) configured to generate a second checksum (HW_PB*) over at least one input value and / or a state of a second block corresponding to the first block of a second program (P*) of a second programmable logic controller (PLC2), wherein the second programmable logic controller (PLC2) is operated in parallel with the first programmable logic controller (PLC1) and the second program (P*) corresponds to the first program (P), • an analysis unit (103) configured to compare the first checksum (HW_PB) with the second checksum (HW_PB*) and output a comparison result (CR), and • an output unit (104) configured to output a warning message (WS) to the first programmable logic controller (PLC1) if the first checksum (HW_PB) and the second checksum (HW_PB*) differ, wherein the first checksum (HW_PB) and the second checksum (HW_PB*) are formed by concatenating the input values ​​of the respective function calls in the case of more than one function call in a block.

2. Monitoring system (100) according to claim 1, wherein the second programmable logic controller (PLC2) is virtually implemented on a computing unit (CPU).

3. Monitoring system (100) according to one of the preceding claims, further comprising a simulation unit (105) configured to simulate the technical system (TS) by means of a computer-aided simulation.

4. Monitoring system (100) according to one of the preceding claims, wherein the analysis unit (103) is configured to compare the first checksum (HW_PB) and the second checksum (HW_PB*) for a defined period of the program.

5. Monitoring system (100) according to one of the preceding claims, wherein the first checksum (HW_PB) and the second checksum (HW_PB*) are formed using the Luhn algorithm.

6. Computer-implemented method for monitoring a first programmable logic controller (PLC1) for controlling a technical system (TS), wherein the first programmable logic controller (PLC1) comprises a first program (P) from a plurality of blocks, with the following method steps: • Forming (S1) a first checksum (HW_PB) over at least one input value and / or a state of a first block of the first program, • Forming (S2) a second checksum (HW_PB*) over at least one input value and / or a state of a second block corresponding to the first block of a second program of a second programmable logic controller, wherein the second programmable logic controller is operated in parallel with the first programmable logic controller and the second program corresponds to the first program, • Compare (S3) the first checksum (HW_PB) with the second checksum (HW_PB*), • Output (S4) a comparison result (CR), and • Output (S5) a warning message for the first programmable logic controller if the first checksum and the second checksum differ, whereby the first checksum (HW_PB) and the second checksum (HW_PB*) are formed by concatenating the input values ​​of the respective function calls in the case of more than one function call in a block.

7. Method according to claim 6, wherein the monitoring of building blocks of a first program is carried out according to a hierarchy structure of these building blocks.

8. Computer program product that can be directly loaded into a programmable computer, comprising program code segments suitable for performing the steps of the method according to claim 6 or 7.

Images