Sandbox Safety Program Updates for Industrial Control Systems
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing safety programs in industrial systems require updates, but updating them poses a risk of compromising system safety.
Innovation Solution
An industrial system with a sensor, actuator, and update device that evaluates update information in a sandbox environment to ensure safety, using a rolling update mechanism with automated acceptance tests and digital signatures to apply updates without risk.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the safety program is updated directly in the production environment, then new functionality or error corrections can be applied, but system safety may be compromised
Solution Approach 1:
The patent applies preliminary action by evaluating update information in a sandbox environment before applying it to the production safety program. The update is first tested in a controlled virtualized environment that mimics the production system, allowing potential safety issues to be detected before they affect the actual safety-critical system. This resolves the contradiction by enabling updates (improving adaptability) while maintaining safety through pre-validation (preserving reliability).
Solution Approach 2:
The patent introduces a sandbox environment as an intermediary between the update source and the production safety program. This virtualized sandbox acts as a mediator that isolates the production system from direct update application, allowing updates to be tested and validated without directly impacting system safety. The sandbox serves as a buffer that enables updates while protecting the integrity of the safety program.
2Reliability
If the safety program is updated with new functionality or corrections, then the safety system becomes more effective, but the complexity of ensuring safety during updates increases
Solution Approach 1:
The patent applies segmentation by dividing the safety program into virtualized containers that can be independently updated and tested in the sandbox environment. Each safety function can be updated separately without affecting the entire system, reducing the complexity of managing updates while maintaining comprehensive safety coverage. This allows effective safety updates (improving reliability) while managing complexity through modular updates (reducing device complexity).
Solution Approach 2:
The patent creates a copy of the production environment in the form of a sandbox that replicates the safety program's behavior. By evaluating updates in this copied environment first, the system can validate effectiveness without directly modifying the production system. This reduces the complexity of ensuring safety during updates by allowing thorough testing in a duplicate environment before applying changes to the actual safety program.
3Productivity
If the safety program is updated in place, then system downtime is minimized, but the risk of safety errors during update application increases
Solution Approach 1:
The patent applies preliminary action by completing all update validation and testing in the sandbox environment before applying updates to the production safety program. This ensures that updates are thoroughly vetted for safety before they are deployed, reducing the risk of safety errors during update application. The system can then apply updates with minimal downtime since the validation work was done beforehand, resolving the contradiction between productivity and reliability.
4Reliability
If comprehensive testing is performed on update information, then safety risks are reduced, but the time required for updates increases
Solution Approach 1:
The patent performs comprehensive testing of update information in the sandbox environment as a preliminary step before production deployment. By completing thorough validation, security checks, and functionality testing in the virtualized sandbox first, the system ensures update safety while enabling faster production updates since the time-consuming testing is already completed. This resolves the contradiction by shifting the time investment to the preliminary sandbox phase rather than during production updates.
Data Source
AI summary
An industrial system comprises: a sensor and/or an actuator; a safety apparatus configured to execute a safety program for controlling the sensor and/or the actuator; and an update device configured: to obtain update information; to evaluate the update information; based on the evaluation, to determine whether the update information can be applied to the safety program; and, based on the determination, either to apply the update information to the safety program or to discard the update information.