Actuator Command Filtering for Safe Remote Process Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In process engineering systems, especially in petrochemical and power plants, improper use of external control panels can lead to safety-critical states and unauthorized access, risking system damage or unintended shutdowns due to improper operation or malicious control commands.
Innovation Solution
A communication device with an admissibility checker and separate data memory stores permissible actuator commands, ensuring only authorized and predefined commands are transmitted to actuators, preventing unsafe activations and protecting against unauthorized access or malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If external control panels are used to access and control actuators in process engineering systems, then ease of operation and remote control capability are improved, but system safety and protection against unauthorized access deteriorate due to risks of improper operation and malicious commands
Solution Approach 1:
The communication device acts as an intermediary between the external control panel and the actuator. It receives control commands from the external control panel, verifies their admissibility against stored permission criteria, and only transmits approved commands to the actuator. This mediator function enables remote control while protecting system safety by filtering out unauthorized or malicious commands.
Solution Approach 2:
The communication device performs preliminary verification of control commands before they reach the actuator. By checking whether received commands match admissible command patterns stored in its data memory, the system preemptively blocks potentially harmful commands, preventing safety issues before they can occur rather than reacting after damage happens.
2Adaptability or versatility
If decentralized process control functions are implemented using Fieldbus devices, then device independence and control distribution are improved, but vulnerability to unauthorized access and improper operation increases
Solution Approach 1:
The communication device implements local security verification at each actuator's communication interface. Instead of relying on centralized control security, each decentralized actuator has its own communication device that independently verifies incoming commands against locally stored admissibility criteria. This local quality approach allows decentralized control while maintaining security at each distribution point.
3Productivity
If actuator commands can be freely transmitted from external control panels, then operational flexibility and responsiveness are improved, but risk of system damage and unintended shutdowns increases
Solution Approach 1:
The communication device converts the potential harm of unrestricted command transmission into a benefit by using the same communication channel for both fast responsive control and security verification. The rapid command transmission capability is preserved for authorized commands, while the verification process filters out harmful commands, thus converting the risk of fast unrestricted control into the benefit of fast verified control.
Data Source
Figure 1
AI summary
The invention relates to a communication device for carrying out a control interaction between an electronic operating system and an actuating system, for example a control valve, a pump or the like, in order to adjust a processing fluid flow of a process plant, such as a chemical plant, particularly a petrochemical plant, a food-processing plant, a power plant or the like, which comprises an electronic control and/or regulating system for actuating the actuating system according to an actuating system command, the electronic control and/or regulating system being designed to implement a pre-determined function particularly for actuating the actuating system, according to a pre-defined actuating system command, such as an actuating normal value. Said communication device comprises a first communication interface for receiving electrical signals, such as actuating system commands, from an electronic operating system, a second communication interface for sending electrical actuating system commands to the actuating system, and an electronic reliability checker with a data store in which a series of reliable actuating system commands is stored, the reliability checker being designed to cause the second communication interface to either send no actuating system commands or to send one of the reliable actuating system commands to the actuating system, according to an electrical signal received by means of the first communication interface.