Method, data processing system, computer program product, and computer-readable medium

Abstract

The invention relates to a method, in particular a computer-assisted method, for the in particular platform-independent running of a security-oriented user program on a computing device, the method comprising the following steps: - generating a program code (2), which contains security-oriented instructions; - executing the program code (2) in a runtime environment (3), wherein the runtime environment (3) contains a sandbox (4) by means of which rules for executing the program code (2) are defined.

Description

[0001] Description

[0002] Method, data processing system, computer program product and computer-readable medium

[0003] The present invention relates to a method, in particular a computer-based method, for running a safety-related application program on a computer system, particularly in a platform-independent manner. The invention further relates to a data processing system and a computer program product. Finally, the invention relates to a computer-readable medium.

[0004] Industrial plants that could pose a hazard in the event of a malfunction must be equipped with safe control systems. The requirements for such a control system are regulated, for example, in EN 62061 – "Safety of machinery – Functional safety of safety-related electrical, electronic and programmable electronic control systems". This means that, depending on the potential hazard posed by the respective industrial plant, a safety level must be selected, and the control system designed accordingly.

[0005] The publication by Ray Partha Pratim: "An Overview of WebAssembly for IoT: Background, Tools, State-of-the-Art, Challenges, and Future Directions", Future Internet, Vol. 15, No. 8, reveals the use of WebAssembly (WASM) for automation solutions.

[0006] The publication DE 102020 111051 A1 - Scheidl et al. “ARRAYMENT, SOFTWARE PROGRAM AND COMPUTER-IMPLEMENTED METHOD FOR EXECUTING A RELOADABLE PROGRAM ON AN EMBEDDED SYSTEM OF A VEHICLE” demonstrates the application of WASM in the field of motor vehicles.

[0007] Suitable hardware includes safety-related controllers, such as programmable logic controllers (PLCs). Specifically, these can be SSPLs or F-PLCs. The hardware and firmware of such a controller can be tested according to standards such as EN 61508.

[0008] To operate such a control system, the plant manufacturer or the

[0009] Plant operators must create a corresponding safety-related application program. Such an application program, in which program code is executed, can run on different computing nodes (replicas). Accordingly, such a safety-related application program can run in parallel. If different results occur at the various computing nodes, it can be assumed that an error has occurred, and the corresponding computer system can be shut down.

[0010] It is also possible to execute the corresponding application program in a diverse manner. This means that the application program is executed using multiple mathematically coded execution paths, i.e., different calculation methods are performed. Only if identical results are obtained on all calculation paths can an error be ruled out with a high degree of probability.

[0011] These approaches have generally proven effective. However, it is sometimes perceived as a disadvantage that safety-related application programs are mostly platform-specific. A platform here refers to a processor architecture and / or a computer architecture and / or software characteristics, particularly the operating system. For example, each manufacturer of safety-related controllers may provide its own platform on which safety-related application programs can run. This makes switching from one manufacturer to another difficult. Furthermore, integrating new components into an industrial plant using a controller from a different manufacturer can be both time-consuming and prone to errors.

[0012] Against this background, the object of the present invention is to provide an alternative method for running a safety-related application program on a computer system. Preferably, the method should enable platform-independent execution of a safety-related application program.

[0013] This problem is solved in a procedure of the type mentioned above by comprising the following steps:

[0014] - Generating program code that contains safety-related instructions;

[0015] - Execution of the program code in a runtime environment, wherein the runtime environment contains a sandbox through which rules for the execution of the program code are defined, and that the execution of the program code is diverse.

[0016] The invention is based on the fundamental idea of ​​executing the program code in a processor-independent execution environment for the user.

[0017] This eliminates platform dependency. In other words, the program code can be executed platform-independently. The sandbox serves primarily to protect against manipulation. Preferably, the sandbox is secured in such a way that all data exchange is only possible via predefined rules and interfaces.

[0018] The described process or product can be further developed through advantageous embodiments, which are outlined below. The various embodiments can also be implemented in meaningful combinations.

[0019] The platform-independent execution of a safety-related application program significantly simplifies the addition of further components from different manufacturers to an industrial plant. The time required for integrating such components is considerably reduced, and the susceptibility to errors and malfunctions is also minimized. The combination of control components from different manufacturers is simplified while maintaining the required level of safety.

[0020] The runtime environment can be provided for various CPU architectures, such as x86, Arm, RiscV, ESP32, as well as for various operating systems, such as Linux, Free RTOS, Zephyr.

[0021] The runtime environment can be a runtime environment based on the WebAssembly runtime (WAMR).

[0022] In a further embodiment, the computer system can include a CPU, in particular a lock-step CPU. In this case, CPU-specific program code can be generated and executed. A lock-step CPU is preferably characterized by the presence of several identical or similar CPU cores. In this case, error detection can take place through the parallel execution of the program code. This means that the program code runs in at least two independent CPU cores or compute nodes, and the results are then compared. If the results differ, this indicates a hardware error. In a specific embodiment, the individual CPU cores or processors can be operated with a slight time offset of a few clock cycles. This allows a common cause of the fault to manifest itself in different states and can thus be identified by comparing the results.

[0023] The computer system can contain multiple compute nodes (replicas). This design is based on the consideration of increasing the security level by allowing the program code to run in parallel on two, in particular, identical compute nodes. Preferably, the execution is not staggered, but synchronous, unlike in a lock-step CPU.

[0024] In a further development, the program code can be generated by compiling source code. Compilation is preferably characterized by translating the source code into a language that can be executed by the computer. In other words, the source code can be converted into an executable file.

[0025] It is possible that the source code is annotated with safety-related instructions before compilation. This means that during compilation, it is determined how certain instructions are to be translated. In other words, specific instructions can be annotated, which means that certain data is included in the source code. These can be, in particular, safety-related instructions. This approach can also be referred to as "coded processing."

[0026] The program code can be bytecode or CPU-specific code. This means that the source code is translated into generally available bytecode or into program code tailored to the specific computer system. In this case, it is also referred to as CPU-specific or instrumented code. Preferably, bytecode represents a collection of instructions in binary form. Bytecode can essentially be an intermediate code that does not represent direct machine code. Such bytecode is preferably easier to interpret than source code.

[0027] The method according to the invention can be characterized in that, for the execution of the program code, it is interpreted, in particular interpreted according to the safety-related instructions. During interpretation, the program code is preferably not translated into machine code, but executed directly by a so-called interpreter during runtime.

[0028] In a specific implementation, the program code can be executed on a lock-step CPU. It is also possible for the program code to be executed replicated. This means that the program code is executed multiple times in parallel or with a slight time offset from each other in order to detect errors.

[0029] During program code execution, the runtime environment can generate safety-related instructions. In other words, the existing bytecode or CPU-specific program code may contain safety-related instructions during execution. This could involve, for example, the control of components in industrial plants, such as motors (especially actuators), valves, sensors, and / or similar devices.

[0030] Program execution can include just-in-time (JIT) compilation. In other words, the program code can be compiled into corresponding machine code at the moment it is executed. This compilation can be specific to the computer's architecture. In other words, generated program code, such as bytecode, can be compiled by the runtime environment to the specific CPU architecture of the computer.

[0031] Alternatively, program code execution can involve ahead-of-time (AOT) compilation. AOT compilation is preferably characterized by taking place in a runtime environment before the program code is executed, thus minimizing the overhead required for execution. In other words, AOT compilation preferably compiles the program code into corresponding machine code before execution in a runtime environment, which then simply needs to be executed. The compilation can be performed specifically for the CPU of the computer system.

[0032] Safety instructions can be generated during compilation. Specifically, these safety instructions can be bytecode or, particularly in the case of AOT compilation, CPU-dependent opcodes. Preferably, these safety instructions serve to execute the rules through the sandbox. In other words, this ensures that the rules defined by the sandbox are implemented. Alternatively, if necessary, especially if the computer system has a single CPU, the runtime environment can generate or add additional safety instructions for the specific CPU architecture during execution, according to the principle of coded processing.

[0033] In a further embodiment of the method according to the invention, the program code can be executed redundantly on multiple computing nodes. It is also possible for the program code to be executed diversely. In this case, different computation paths exist, which, however, must lead to the same result if the system is error-free. If different results are obtained, this indicates an error.

[0034] The sandbox can contain rules for accessing memory, accessing drivers, and / or communication.

[0035] To meet normative requirements regarding redundancy and diversity, the principle of "coded processing" is known to be used – see, for example, the "Programming Guide Safety for SIMATIC S7-1200 / 1500" – https: / / cache.industry.siemens.com / dl / files / 255 / 109750255 / att Programming Guideline-Safety-Je.pdf (see p. 39). In this principle, the safety program is processed twice by a single processor. For this purpose, the compiler generates a diverse (coded) safety program during compilation, which is referred to as the backup program. In the first program run, the user's unmodified safety program is processed. Then, the backup program is processed. Subsequently, the results are checked. If the execution is correct, the safe outputs are written. Should the check fail (e.g., due to data corruption), the execution unit enters a stop state and creates an entry in the diagnostic buffer. In a variant of the invention proposed here, the two program versions are executed simultaneously or with a slight time delay on different processors or processor cores (processor nodes).

[0036] It is advantageous for at least one program version to work with coded variables, as described, for example, in the publication EP 3 104276 A1 - Witte et al. “Procedure in a computer system, computer program and data processing system” for a singular program execution. In particular, coding the variables with parameters is proposed, e.g., using the well-known ANBD coding.

[0037] A particularly advantageous variant arises when, in the case of diverse (multiple) program execution, especially on different processor cores or processors or processor nodes, different parameters for variable encoding are used in the two program versions.

[0038] The present invention further provides a data processing system comprising means for carrying out a method as previously described.

[0039] Furthermore, the invention provides a computer program product comprising instructions which, when the program is executed by a computer, cause it to execute the inventive method as described above.

[0040] Finally, the invention comprises a computer-readable medium comprising instructions which, when executed by a computer, cause it to execute a method according to the invention as described above.

[0041] For further details of the invention, reference is made to the dependent claims and to the following description of an exemplary embodiment with reference to the drawing.

[0042] The drawing shows:

[0043] Figure 1 shows a schematic representation of a method according to the invention.

[0044] Figure 1 shows a computer-aided method for running a safety-related application program on a computer system in a platform-independent manner.

[0045] As can be seen in Figure 1 above, a source code 1 is first provided, from which a program code 2 is generated by compilation. During compilation, the source code 1 is annotated, i.e., enriched, with safety-related instructions.

[0046] The program code 2, which is present here as bytecode, is executed in a runtime environment 3. The runtime environment 3 contains a sandbox 4, which defines rules for the execution of the program code 2. In this case, the program code 2 is executed on a computer system, specifically a lock-step CPU 5. For this purpose, the program code 2 is interpreted, in particular according to the safety-related instructions. When the program code 2 is executed, the runtime environment 3 generates corresponding safety-related instructions based on the rules defined by the sandbox 4.

[0047] In this way, a safety-oriented user program, which was previously usually platform-dependent, can be transformed by using a platform-dependent runtime environment 3, which, however, is not visible or perceptible to the user as such.

[0048] Although the invention has been illustrated and described in detail by the preferred embodiment, the invention is not limited by the disclosed examples and other variations can be derived by the person skilled in the art without leaving the scope of protection of the invention.

[0049] Regardless of the grammatical gender of a particular term, persons with male, female or other gender identities are included.

Claims

Patent claims 1. Method, in particular a computer-based method, for the platform-independent execution of a security-related application program on a computer system, comprising the following steps: - Generating program code (2) containing safety-related instructions; - Execution of the program code (2) in a runtime environment (3), wherein the runtime environment (3) contains a sandbox (4) by which rules for the execution of the program code (2) are defined, characterized in that the execution of the program code (2) is diverse.

2. Method according to claim 1, characterized in that the execution of the program code (2) takes place in at least two computation paths, wherein the principle of coded processing is applied in at least one of the computation paths.

3. Method according to claim 1 or 2, characterized in that the computer system contains a CPU, in particular a lock-step CPU (5), and / or that the computer system contains multiple compute nodes - replicas.

4. Method according to one of the preceding claims, characterized in that the program code (2) is generated by compiling a source code (1).

5. Method according to claim 4, characterized in that the source code (1) is annotated with safety-related instructions before compilation, and / or that the program code (2) is a byte code or a CPU-specific code.

6. Method according to one of the preceding claims, characterized in that, in order to execute the program code (2), the program code (2) is interpreted, in particular in accordance with the safety-related instructions.

7. Method according to claim 6, characterized in that the program code (2) is executed on a lock-step CPU (5), and / or that the program code (2) is replicated and executed, and / or that when the program code (2) is executed, the runtime environment (3) generates safety-relevant instructions.

8. Method according to one of the preceding claims, characterized in that the execution of the program code (2) comprises a Just-In-Time compilation - J IT - wherein, in particular, the compilation is specific to the architecture of the computer system.

9. Method according to one of the preceding claims, characterized in that the execution of the program code (2) comprises an Ahead-Of-Time compilation - AOT.

10. Method according to claim 9, characterized in that the compilation is performed specifically on the CPU of the computer system.

11. Method according to claim 9 or 10, characterized in that safety-related instructions are generated during compilation.

12. Method according to one of claims 9 to 11, characterized in that the execution environment (3) generates safety-related instructions.

13. Method according to one of the preceding claims, characterized in that the execution of the program code (2) is redundant on multiple computation nodes, and / or that the sandbox (4) contains rules for accessing memory, for accessing drivers and / or for communication.

14. Data processing system comprising means for carrying out a method according to any of the preceding claims.

15. Computer program product comprising instructions which, when the program is executed by a computer, cause it to execute the method according to any one of claims 1 to 13.

16. Computer-readable medium comprising instructions which, when executed by a computer, cause it to execute a method according to any one of claims 1 to 13.

Images