Industrial Control Code Isolation for Safety-Classified Program Calls
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial control software often contains both safety-relevant and safety-irrelevant components, where the latter can potentially jeopardize the safety classification of the former if called within a safety-relevant element, posing a challenge for programmers to ensure compliance with safety regulations.
Innovation Solution
A method and system for modifying industrial control programs by identifying calls from safety-relevant program elements to safety-irrelevant elements and replacing these calls with auxiliary program elements compliant with the safety classification, thereby preventing undesired backlash and maintaining the safety classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If safety-irrelevant program elements are integrated into industrial control software, then functionality and versatility are improved, but safety classification compliance deteriorates due to potential backlash effects
Solution Approach 1:
The patent segments the industrial control software into safety-relevant and safety-irrelevant program elements, allowing each to be developed and maintained independently. This segmentation enables the integration of versatile safety-irrelevant functionality while maintaining safety classification compliance by preventing unauthorized interactions between different security domains.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of a compiler that automatically analyzes program calls and inserts protective measures. This intermediary monitors and controls interactions between safety-relevant and safety-irrelevant elements, allowing them to coexist without compromising safety classification while maintaining full functionality.
2Reliability
If programmers manually ensure safety compliance in industrial control software, then safety classification is maintained, but programming complexity and time consumption increase
Solution Approach 1:
The patent implements a self-service approach where the compiler automatically performs safety compliance checks and inserts protective code without requiring manual programmer intervention. The system serves itself by using automated static analysis to identify potential safety violations and generate appropriate countermeasures, significantly reducing programming complexity while maintaining safety classification.
Solution Approach 2:
The patent applies preliminary action by performing safety analysis and inserting protective measures during the compilation phase before the software is deployed. This advance preparation ensures safety compliance is built into the software structure from the outset, eliminating the need for complex manual safety verification during programming and testing.
3Adaptability or versatility
If calls from safety-relevant to safety-irrelevant program elements are allowed, then program functionality is improved, but the risk of safety classification violation increases
Solution Approach 1:
The patent applies preliminary anti-action by proactively identifying and neutralizing potential safety violations before they can occur. The compiler performs static analysis to detect calls from safety-relevant to safety-irrelevant elements and automatically inserts protective measures such as access control checks or isolation mechanisms, preventing harmful effects while allowing necessary functionality.
Solution Approach 2:
The patent introduces an intermediary control mechanism that mediates calls between safety-relevant and safety-irrelevant program elements. This intermediary layer verifies the safety and appropriateness of each call before allowing execution, enabling functional versatility while systematically preventing safety classification violations through automated enforcement.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for modifying an industrial control program is provided, the industrial control program comprising a first program element having a safety classification and a second program element not having the safety classification. The method comprises: identifying, in program source code of the first program element, a call to the second program element, and generating a modified program source code, comprising replacing, in the program source code, the call to the second program element by an auxiliary program element, the auxiliary program element being compliant with the safety classification.