PLC Failover Architecture Using Randomized Binaries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional resilient programmable logic controller (PLC) architectures are vulnerable to correlated failures, where a failure in one PLC can cause the backup to fail as well, and lack protection against cyber attacks, as they use identical binaries.
Innovation Solution
Implementing a failover architecture with multiple banks of PLCs, where each bank executes different randomized binaries, allowing one bank to take over from another while ensuring that only one PLC crashes at a time, and using randomized binaries to prevent correlated failures and enhance cyber security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional resilient PLC architectures use identical binaries for redundancy, then failover capability is provided, but correlated failures can occur where both PLCs crash simultaneously
Solution Approach 1:
The patent applies local quality by making each PLC instance have unique characteristics through randomized binary execution. Instead of all PLCs being identical, each instance executes slightly different binary code with randomized parameters, creating local differences that prevent correlated failures while maintaining the same control function.
Solution Approach 2:
The patent changes parameters by introducing randomization to binary execution parameters. The system generates randomized parameter sets for each PLC instance, including randomized memory addresses, data block offsets, and execution timing parameters. This parameter variation ensures that a cyber-attack or failure affecting one PLC does not affect others with different parameters.
2Device complexity
If PLCs use identical binaries for redundancy, then system simplicity is maintained, but protection against cyber attacks is compromised
Solution Approach 1:
Each PLC instance is given unique local quality through randomized parameter generation. The system creates distinct parameter sets for each PLC including randomized memory layouts, data block offsets, and execution parameters. This local differentiation provides cyber attack protection while maintaining overall system simplicity through automated parameter generation.
Solution Approach 2:
The system performs preliminary action by pre-generating multiple sets of randomized parameters and storing them in the PLC instances before execution. This advance preparation ensures that when failover is needed, the standby PLC already has its unique randomized parameters ready, eliminating the need for complex real-time parameter generation during failure scenarios.
3Reliability
If multiple banks of PLCs with randomized binaries are implemented, then resilience against correlated failures is improved, but device complexity increases
Solution Approach 1:
The patent applies segmentation by dividing the PLC system into multiple independent banks, where each bank contains PLC instances with unique randomized parameters. This segmentation isolates failures to specific banks or instances, preventing correlated failures from propagating system-wide. The modular bank structure makes the complexity manageable through clear separation of concerns.
Solution Approach 2:
The system uses copying by creating multiple PLC instances that replicate the same control function but with randomized parameter variations. Instead of developing complex unique control logic for each PLC, the system copies the base control binary and applies parameter randomization. This copying approach maintains functional consistency while introducing the diversity needed to prevent correlated failures.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of performing failover for programmable logic controllers (PLCs) in an automation environment and controlling a physical system includes an input/output module receiving sensor inputs from field devices and creating a copy of the sensor inputs for a first group of PLC in a first PLC bank. The input/output module transfers the copy the sensor inputs to each PLC in the first group of PLCs and receives processing results from each PLC in the first group of PLCs in response to transferring the copy of the sensor inputs. The input/output module determines whether there are any inconsistencies between the processing results received from each PLC in the first group of PLCs. If there are any inconsistencies between the processing results received from each PLC in the first group of PLCs, a failover control process is initiated by sending a failover control message to a second input/output module.