Patent Application
20250110465
The invention relates to method for operating a piece of cycle-oriented control software for controlling a process.
Control systems that are commonplace nowadays are based upon a hardware platform, a special electronic substructure, specifically a programmable logic controller (PLC). Where, in recent times, virtual control systems or software control systems come into consideration, a hardware system for their execution is also required, although the hardware can now be completely abstracted. This means that the soft PLC being executed no longer needs to the device upon which it is running.
As before, these devices can be dedicated control devices, such as multifunctional control platforms, industrial PCs or even edge computing platforms. Increasingly, however, they are to be found in control networks of machine operators and systems operators, or even cloud computing platforms are made use of. What is decisive is the abstraction of the hardware by containers or hypervisors. The soft PLC is “deployed” thereon using standard means or is orchestrated using a tool, where an installation, as in the case of software-based control, is no longer needed.
The invention belongs within the specialist domain of safety-oriented control systems, in particular as software. Programmable logic controllers must be configured in accordance with the requirements of the norm EN 61508 such that they fulfil a functional safety standard. In safety-oriented systems, such as programmable logic controllers for critical processes that contain electrical, electronic or programmable electronic components, the failure of which poses a significant risk to persons or the environment, they must be configured to guarantee a particular degree of safety. Examples of applications that require enhanced safety are the following: nuclear power stations, control technology for systems of significance in safety technology, railway applications, telecommunications technology, signaling technology and data processing systems, chemical processes, and also, for example, small systems such as a punching machine for punching out sheet metal parts.
With current fail-safe control systems (for example, SIMATIC S7-1511 F), it must be ensured, during a start-up after a mains off/on and/or stop/run transition, that the starting up always occurs with the initial values and not with the current values of the last safety program cycle (for example, before the mains off) (referred to below as a cold start).
EP 2 284 771 B1 and EP 2 241 953 B1 describe that in each cycle of a fail-safe control system, a safe time is formed from two timers (standard timer and fail-safe timer, or F timer). This is achieved by the formation of the time difference between two cycles (S-Diff and F-Diff) and subsequent comparison of the time differences with a pre-determined tolerance.
It is an object of the invention to provide a method for operating a segment of cycle-oriented control software for controlling a process, wherein the control software is caused to execute on a computer system within a runtime environment, where in order to secure a system time of the computer system, a further safety time independent of the system time is requested in each cycle, and where a first time difference is formed from the system time of the current cycle and the system time of the previous cycle and a second time difference is formed from the safety time of the current cycle and the safety time of the previous cycle and a comparison of the time differences with a pre-determined tolerance is carried out and, in the event that the deviation of the time differences exceeds the tolerance, an error signal is generated.
Thus, the elapsed time between the current and the previous cycle is established via the difference between the two timers.
The difference of the standard timer is given by SDIFF=S_TIM−S_TIM_ALT and the difference of the F timer is given by FDIFF=F_TIM_ALT−F_TIM, and preferably, it is possible to work here with a backward-running counter.
Using a forward-running counter, the old time can also be subtracted from the new time.
Subsequently, a check is performed to determine whether the established difference values lie within the permitted tolerance range.
With conventional fail-safe control systems, the behavior of the two timers in the “mains off” state was known because both the timers were situated on one device and were defined by the manufacturer of fail-safe control systems.
With the introduction of a virtual software control system (soft-PLC), the second time is retrieved from an external time source and thus has an undefined behavior during a “mains off”.
It is also an object of the present invention to ensure the safety of a system with a virtual control system.
These and other objects and advantages are achieved in accordance with the invention where, upon a start-up of the runtime environment, a random number is generated, this random number is stored in a storage region and, upon every further request for the safety time, the generated random number is added to the requested safety time, where at the start of a new cycle in the control software, the deviation between the time differences is calculated in a control component, and in each cycle the storage region is accessed by the control component and, before the calculation of the time differences, the random number is subtracted out of the safety time in the control component again, for the eventuality that a new start-up of the runtime environment has occurred. This can be diagnosed upon the tolerance being exceeded, because the second time difference now has an offset which is given by the safety time with a new random number of the current cycle and the safety time with the old random number of the previous cycle.
A method now therefore exists for recognizing whether, during a start-up after a mains off/on, it is ensured that the starting up always occurs with the initial values and not with the current values of the last safety program cycle (for example, before the mains off). This is because when the mains fails, the computer system also drops out and when the mains returns, the runtime environment is started up again, although thereby the control software is started anew, now there is the assurance that in the safety program, the cold start mechanism has also been performed.
If the cold start mechanism is functioning, then the random number is subtracted out in the difference calculation from the second cycle onward.
If the cold start mechanism fails, then the calculation is performed with two different random numbers in the first cycle (for example, once with the random number before “mains off” and once with the new random number after “mains on”) and thus the execution of the safety program is stopped.
The control software is operated as a fail-safe control system with a safety program and a standard user program and unwanted influencing of the safety program can be revealed.
The cold start mechanism is implemented on the computer system during a start-up of the fail-safe control system after a power failure and it is ensured by the cold start mechanism that the start-up always occurs with initial values and not with current values from the last cycle, where in the event that the cold start mechanism has failed, this is recognized during the difference calculation in the control component when the tolerance is exceeded, so that a failure of the cold start mechanism is recognized.
The safety time is read out by a hardware component installed in the computer system, in particular by a network card. After the request for the safety time, this is converted to an integer value in that a standard frequency of 32.768 kHz is replicated.
No intervention of any kind is made into the formation of the standard times. Two mutually independent timers operate and each is generated by a different quartz crystal.
The task is also allowed to run by a computer system comprising a runtime environment, configured as a segment of cycle-oriented control software for control of a process as a fail-safe control system, a random number generator, a processor with a system time, a hardware component with an external time source for providing a safety time, and a storage region, where the computer system is configured to implement the inventive method.
In an advantageous manner, the computer system is configured as a multifunctional control platform or as an industrial PC or as an edge computing platform or a cloud computing platform.
On the computer system, the control software is configured as a fail-safe control system with a safety program and a standard user program.
The fail-safe control system has a cold start mechanism that is configured to perform a start-up of the fail-safe control system after a power failure on the computer system, where the cold start mechanism is configured to pre-configure the fail-safe control system with initial values and not with current values of the last cycle, and further includes a control component configured to recognize a failure of the cold start mechanism via the difference calculation based on the tolerance being exceeded.
Other objects and features of the present invention will become apparent from the following detailed description considered in conjunction with the accompanying drawings. It is to be understood, however, that the drawings are designed solely for purposes of illustration and not as a definition of the limits of the invention, for which reference should be made to the appended claims. It should be further understood that the drawings are not necessarily drawn to scale and that, unless otherwise indicated, they are merely intended to conceptually illustrate the structures and procedures described herein.
The drawings show an exemplary embodiment, in which:
With reference to
A processor 5 of the computer system makes the system time SZ available. The safety time eZQ is read out by a hardware component 4, in particular a network card NIC installed in the computer system 1. A requestor 9 in the runtime environment FW provides for a continual requesting of the safety time eZQ. In order to secure the system time SZ, a first time difference S-Diff is formed from the system time SZ of the previous cycle Zn-1 and a second time difference F-Diff is formed from the safety time eZQ of the current cycle and the safety time eZQ of the previous cycle Zn-1. A comparison of the time differences S-Diff, F-Diff is performed with a predetermined tolerance TOL and, in the event that the deviation of the time differences S-Diff, F-Diff exceeds the tolerance TOL, an error signal is generated.
Thus, the elapsed time between the current and the previous cycle is now established via the differences between the two timers. In order now to recognize whether during a start-up after a mains off/on, it is ensured that the starting up always takes place with the initial values IW and not with the current values AW of the last safety program cycle (for example before the mains off), during a start-up of the runtime environment FW, a random number ZZ is generated. This random number ZZ is stored in a storage region 2 and, upon every further request of the safety time eZQ, the random number ZZ is added to the storage region 2. At the start of a new cycle Zn in the control software Soft-PLC, in a control component F-CRT, the storage region 2 is accessed and before the calculation of the time differences S-Diff, F-Diff, the random number ZZ is again subtracted out of the safety time eZQ in the control component F-CRT. The random number ZZ is generated via the random number generator 3. The converter 10 provides for the addition of the random number ZZ to the externally requested safety time eZQ.
With the fail-safe control system of the prior art, it has previously always been possible to ensure that the behavior of the two timers in the “mains off” state is different, because both were situated on one device and the timers were defined by the manufacturer.
If, however, it is desired to realize a control with a piece of control software Soft-PLC on any desired platform, then the second time can be retrieved, for example, from a network card NIC, but this network card NIC has an undefined behavior during a “mains off”. In order further to ensure a failure of a cold start mechanism KM, with this solution, the random number ZZ is added to the value of the safety time eZQ. This random number ZZ is formed once on each start-up, for example, after a power failure.
When the cold start mechanism KM is functioning, during the difference calculation of the times, the random number ZZ is subtracted out, if the cold start mechanism KM has failed. The calculation occurs with two different random numbers ZZ in the cycle Z, once with the random number ZZ before a “mains off” and once with the new random number ZZ after a “mains on”. The execution of the safety program F-PROG can therefore be stopped, because this is an indicator that the cold start mechanism KM has failed and the current values AW have not been reset to initial values IW.
The computer system 1 also has additional reserved hardware 6 specifically for the fail-safe control system F-CPU.
In
During a cold start, it is necessary, in particular, for a fail-safe control system F-CPU, that starting occurs with initial values IW. Thereafter, the actual safety program F-PROG starts from a safety OB, F-OB, different safety components F1, F2, F-CRT . . . to Fn are gradually called. All these safety components provide for the functional safety required of the fail-safe control system F-CPU. In the control component F-CRT, in order to secure the system time SZ to the safety time eZQ, a random number ZZ is added. As such, if the cold start mechanism KM has failed, then calculation occurs later with an old value in the storage region 2 and the failure of the cold start mechanism KM would be revealed. In the safety program F-PROG, in the standard user program S-PROG, a standard basis timer unit 17 is made available for the calling of an GB1.
The method comprises generating a random number ZZ upon a start-up of the runtime environment FW, as indicated in step 710. In accordance with the method, the generated random number ZZ is stored in a storage region 2 and added to the storage region 2 upon every further request for the safety time eZQ.
Next, a deviation between the time differences S-Diff, F-Diff, is calculated in a control component F-CRT at the start of a new cycle Zn in the control software Soft-PLC, as indicated in step 720.
Next, the storage region 2 is accessed by the control component F-CRT during each new cycle Zn, as indicated in step 730. Here, the random number ZZ is subtracted out of the safety time eZQ in the control component F-CRT again before the calculation of the time differences S-Diff, F-Diff, for the eventuality that a new start-up of the runtime environment FW has occurred, where the new start-up of the runtime environment FW is diagnoseable based on the tolerance TOL being exceeded, because the second time difference F-Diff has an offset V that is given by the safety time eZQ with a new random number ZZ of the current cycle Zn and the safety time eZQ with the old random number ZZ of the previous cycle Zn-1.
Thus, while there have been shown, described and pointed out fundamental novel features of the invention as applied to a preferred embodiment thereof, it will be understood that various omissions and substitutions and changes in the form and details of the methods described and the devices illustrated, and in their operation, may be made by those skilled in the art without departing from the spirit of the invention. For example, it is expressly intended that all combinations of those elements and/or method steps that perform substantially the same function in substantially the same way to achieve the same results are within the scope of the invention. Moreover, it should be recognized that structures and/or elements and/or method steps shown and/or described in connection with any disclosed form or embodiment of the invention may be incorporated in any other disclosed or described or suggested form or embodiment as a general matter of design choice. It is the intention, therefore, to be limited only as indicated by the scope of the claims appended hereto.
| Number | Date | Country | Kind |
|---|---|---|---|
| 23200351 | Sep 2023 | EP | regional |
