WO2009068055A1 - System and method for state protection - Google Patents

Abstract

The invention relates to a method and data processing system for state protection of a real and/or virtual automation system. In order to allow the simplest possible reproduction of states of an automation system, the invention proposes that the real and/or virtual automation process be controlled using at least one first virtual controller (1) on real hardware and that a first process image (4) of the first virtual controller (1) be generated and written into a permanent image memory (5).

Description

 description

System and method for condition assurance

The invention relates to a method and a data processing system for condition assurance of a real and / or virtual automation system. The invention can be used both in the planning of production or process automation systems, as well as during operation of said systems.

In automation technology, programmable controllers are usually used to control the processes, which are connected via their inputs and outputs with a large number of sensors and actuators. The controllers of these programmable logic controllers, for example, read sensor values at their inputs and, in response to these input values and a control program stored in the memory of the PLC, determine output values which they output at the outputs of the programmable logic controller. to provide actuators available. These automation controllers have two types of memory - volatile and nonvolatile memory.

In the non-volatile memory, which is for example a flash memory, configuration data is stored, which was explicitly provided by the developer of the controller for backup. This data can be duplicated when the controller is backed up to an alternate disk. In this way, the data of the flash memory are then reproducible on a second system.

For example, the process image of the controller is stored in the volatile memory. The term process image of a controller here and throughout the document and as generally used in automation technology is the image of the signal states of the inputs and outputs of the said Controllers understood. If automatic or manual changes, such as software updates, are to be carried out on an automation system, it is often desirable to return to the last functional state after the update in the event of problems. This also applies in the event that production formats or plant configurations change in order to react to changed production orders.

One way to return to a last functional state is also helpful in a planning phase of an automation plant when working with experimental setups. Regardless of whether these experimental setups are real installations or a simulation model used in plant simulation for planning the automation system, such an option is required to carry out various tests based on the same initial condition.

Accordingly, the invention has the object to enable the simplest possible reproduction of states of an automation system. This can be either a real existing automation system or a virtual automation system, which exists only as a digital model in a simulation environment.

The object is achieved by a method for condition assurance of a real and / or virtual automation system, in which a real and / or virtual automation process is controlled with at least one first virtual controller on a real hardware and a first process image of the first virtual controller is generated and written to a non-volatile image memory.

Furthermore, the object is achieved by a computer program product which contains program code means for carrying out such a method, if said computer program Product is executed on one or more data processing systems.

In addition, the object is achieved by a data processing system for condition assurance of a real and / or virtual automation system, with

- At least a first virtual controller for controlling a real and / or virtual automation process and - means for generating a first process image of the first virtual controller and for storing the first process image in a non-volatile image memory.

Advantageous embodiments of the invention can be found in the dependent claims.

In the invention, the technique of virtualization is used to control the automation process. The automation process can be both a real automation process in which real existing sensors are read in with the virtual controller and real existing actuators are controlled. However, the virtual controller may also be embedded in a pure simulation environment within which it interacts with a simulation model of the components of the automation system. In addition, application of the virtual controller in a so-called hardware-in-the-loop simulation is possible, in which simulation models interact with real hardware components.

The virtual controller has access to a non-volatile image store. In these, for example, the controller writes its complete process image after being activated by a corresponding user command. In this way, the state of the automation system, if it is controlled or read by the said first virtual controller, permanently stored in the image memory, as it exists at the moment of writing the image. Such an intermediate state can therefore in hindsight on the basis of stored process image can be restored at any time. As a result, for example, a time-consuming restart of the system in reality or in a simulation can be avoided. If, after the first process image has been written, a system malfunction occurs, a complete image of the automation system can be transferred to a test facility, a so-called shadow system, even in an offline phase. This provides the opportunity to carry out an analysis of the causes independent of the actual productive plant, which significantly extends the range of action in troubleshooting.

The use of at least one first virtual controller and the backup of the process image in a non-volatile memory also provide advantages with regard to the portability of the controller function. For example, the first virtual controller can be easily transferred to other hardware if the system load on the real hardware increases too much. The first process image stored in the image memory can easily restore the associated system status.

Two modes are conceivable when generating and saving the process image. On the one hand, in an advantageous embodiment of the invention, the first process image is generated and in the

Image memory while the first virtual controller is in an active mode of operation. In this case, the first virtual controller is in an online mode and carries out the work while the system is running.

Also conceivable is an embodiment of the invention in which the first process image is generated and written to the image memory, while the first virtual controller is in a passive mode of operation. Such an offline mode requires that the controller has been disabled to do so

Save image. The decision on the mode to be used is based on the type of application and the given function support. Expediently, the image data, regardless of whether it was generated online or offline, is enriched with further metadata. An example of such metadata could be, for example, the time of creation of the image.

In order to be able to approach an intermediate state which is considered to be functional on the real hardware within a test series, an embodiment of the invention is advantageous in which the first process image stored in the image memory is loaded onto the real hardware and restored there, and the first virtual controller from the first State of the restored first process image is restarted. In this way, it is possible to repeatedly start various attempts within the automation system from the state represented by the first process image. In this case, it may also be expedient to store the resulting states of these experiments also in the image memory in order to be able to follow the different experimental procedures with their results in hindsight.

By using the visualization technique results in a very good portability of the control software used. This advantage is further enhanced by a further advantageous embodiment of the invention in which hardware metadata are stored in a memory which describe minimum requirements for the real hardware for controlling the automation process with the first virtual controller.

In this case, it can be checked in a further advantageous embodiment based on the hardware metadata whether another real hardware meets the minimum requirements and, if so, that stored in the image memory first process image is loaded on the other real hardware and restored there and the first virtual controller from the state of the restored first process image is restarted on the further real hardware. If an alternative hardware to the real hardware is first identified on the basis of the hardware data, then the image or the first process image can be transferred to this additional hardware and be restored there. Such a configuration can be used for example for deployment purposes. In this case, for example, the automation system is initially constructed and tested virtually in an engineering office, ie as a simulation model. After the successful virtual test, the first generated in the simulation

Process image copied from the image memory to an image storage of a real existing system and restored there. This is an example of a further advantageous embodiment in which a virtual automation system is simulated with the real hardware and a virtual automation process is controlled with the first virtual controller and the further hardware is a controller of a real automation system and a real automation process with the first virtual Controllers is controlled, the virtual automation system is a simulation model for the real automation system.

The technology of virtualization makes it possible to use several virtual controllers working in parallel. Accordingly, an advantageous embodiment of the invention is characterized in that the automation process is controlled by a second virtual controller and during control of the automation process, a second process image of the second virtual controller is generated and written to the non-volatile image memory, wherein the first process image a first controller identifier is stored in the image memory, which uniquely identifies the first controller, and a second controller identifier is stored in the image memory for the second process image, which uniquely identifies the second controller. In order to ensure the detectability of the virtual controller, each virtual controller is therefore provided with a unique controller identifier. Such a unique identifier can be assigned, for example, by a central controller recognition administration. The controller ID is entered in the respective image in order to ensure the assignability between the virtual controller and the image or process image. The administration of the process images is done in an advantageous embodiment of the invention with the aid of a particularly separate image management, which stores the process images in the image memory and can restore them to a target hardware.

It is desirable u.U. not only the storage of independent, individual images of automation devices in the image memory, but also a memory image of complete related system configurations, e.g. consist of several controllers, drives and operator control and monitoring systems. In an advantageous embodiment of the invention, this is made possible by allocating a common configuration identifier to the first and second virtual controllers, storing the configuration identifier in the image memory, and restoring the first and second process images by sending the configuration identifier to the image manager. By sending the common configuration identifier of multiple virtual controllers not only individual machines but also a consistent state of an entire complex automation system can be restored.

In this case, the image management hierarchically subordinates the first and second controller identification of the configuration identifier in a further advantageous embodiment of the invention, so that it can be seen that the configuration identifier is assigned to these two controller identifiers.

When using multiple virtual controllers, another embodiment of the invention is advantageous in which the resources of the real hardware are distributed to the virtual controllers via a hypervisor.

Since high-speed real-time requirements are generally placed on automation devices, another embodiment of the invention is advantageous in which a real-time capable hypervisor is used to distribute the resources.

In the following the invention will be described and explained in more detail with reference to the embodiments illustrated in the figures.

Show it:

1 shows a schematic representation of a system for securing the state of a real and / or virtual automation system and

2 shows a method for reproducing a system state.

1 shows a schematic representation of a system for condition assurance of a real and / or virtual automation system. The system environment comprises a first virtual controller 1, a second virtual controller 2 and a third virtual controller 3 having access to a flash memory 17. With the aid of these virtual controllers 1,2,3, depending on the application, a real automation system is controlled or else the control of real automation components is simulated. Accordingly, in the latter case, there is a virtual automation process that is modeled within the simulation environment using suitable simulation models for the automation components installed in the automation system. The system also includes a hypervisor, also referred to as a Virtual Machine Monitor (VMM), which is responsible for distributing the resources of the physical hardware on which the virtual controllers are deployed. The- This hypervisor runs as a standard hypervisor or as a real-time hypervisor, depending on the application. If the virtual controllers 1, 2, 3 take on the function of automation controllers, the hypervisor is designed as a real-time hypervisor in order to be able to meet the real-time conditions demanded in automation technology. On the other hand, if the virtual controllers 1,2,3 fulfill the task of operating and monitoring devices, a standard hypervisor can generally be used.

In addition to the virtual controllers 1, 2, 3, another virtual machine is implemented on the real target hardware, which functions as a management unit 10. This management unit 10 ensures the management of the entire system environment. The task of the management unit 10 is e.g. to start and stop the virtual controllers 1,2,3, to initiate and restore backups, and to issue status information.

In order to ensure recognizability, each virtual controller 1,2,3 is provided with a unique controller identifier 11,21,31. These controller IDs 11, 21, 31 originate from a central ID administration 12.

The system further comprises an image memory 5 in which the virtual controllers 1, 2, 3 can store their associated process images 4, 7, 8. In order to be able to reassign these process images 4, 7, 8 or their images to the virtual controllers 1, 2, 3, the container identifications 11, 21, 31 are entered into the associated images in addition to the images, if these are stored in the image memory 5 be filed. The images are stored by a separate image management 9 on an external memory and described in detail by associated metadata. An example of such metadata could be the time an image was created.

In addition to the virtual controllers 1,2,3 also the hardware on which the virtual controller 1,2,3 is implemented are assigned a unique ID. With the aid of this hardware ID 13, hardware metadata stored in a particularly external memory 6 can be identified, which describe the minimum requirements for a real hardware environment, which are met to control the automation process with the virtual controllers 1, 2, 3 have to. On the basis of this hardware metadata, an alternative hardware configuration can be determined on which the process images stored in the memory 5 can be replicated. The hardware metadata describe virtualization requirements such as processor speed and memory as well as automation specifics such as whether a controller can reach certain IO sensors via its connected fieldbus or which cycle time must be ensured for program execution and data exchange.

The backup of one of the virtual controllers 1, 2, 3 can be started by an operator via the management unit 10 or, alternatively, can be started time-controlled or event-controlled by an automation integrated in the management unit 10. As soon as this happens, a connection to the image management 9 is established and the corresponding command is transmitted.

The image manager 9 then creates an empty image, identifies it with the corresponding controller identifier 11, 21, 31 and assigns it the start time as metadata, in addition to which the image is created. Finally, the data of all memory areas of the affected virtual controller 1,2,3 are transferred into the image thus created. This transmission can be done in two different modes. In offline mode, it is required that the corresponding virtual controller 1,2,3 has been deactivated. On the other hand, in an online mode, the image can be created while the system is running and thus also with active virtual controllers 1,2,3. The decision on the mode to be used is based on the application type and the given function support. Once all data of the virtual controller 1,2,3 has been saved, the image is enriched with further metadata and stored on the image memory 5.

The image management 9 can not only store independent individual process images of automation devices but also complete associated system configurations, which consist of several controllers, drives, operating and monitoring systems, etc. In this case, a common configuration identifier is assigned to such a related system configuration. The individual components of this configuration are further characterized by individual identifiers, these individual identifiers being hierarchically subordinate to the configuration identifier. In this way, the resulting identification pattern reflects the configuration of the automation system.

If the operator triggers the restoration of a process image stored in the image memory 5 via the management unit 10, the controller identifier, the time of creation of the process image and the target controller are sent to the image manager 9. With the aid of the information obtained, the image management 9 loads the process image from the image memory 5 and subsequently restores it on the real target device. Upon completion of the transfer, the status is transmitted from the image manager 9 to the management unit 10. The management unit 10 reports the result report to the operator and, if an online backup was previously made, starts the associated virtual controller in the state at the time of image creation. Recovery can also be offline or online. In online mode, the automation device, eg the control or the operating and monitoring device, does not have to be put into the stop state. Instead, the virtualized process image is loaded during operation. In contrast to today's virtual machines, the management unit 10 also controls the defined chaining of the process image into the current controller cycle in an automation-specific manner. FIG. 2 shows a method for reproducing a plant state. FIG. 2 shows two system environments 14 whose basic structure corresponds in each case to the system already presented in FIG. However, the first system environment 14 shown in FIG. 2 above is a simulation model of an automation system, while the second system environment 15 shown in FIG. 2 below represents a real automation system. 2 shows how the teaching according to the invention can be used for software deployment. For example, the virtual system shown above can initially be designed and simulated in an engineering office. As already shown with reference to FIG. 1, the process images of the virtual controllers 1, 2, 3 used can be stored in an image memory 5. If the tests using the virtual system are positive, the images of the virtual system are copied from the image memory to another image memory 16 of the real system. Finally, another management unit of the real investments can also restore the image as already described under FIG. 2 and thus move the real installation into the state of the virtual installation at the time of image generation. In this way, the commissioning of the real system can be significantly accelerated after a virtual commissioning in the engineering office.

Claims

claims 1. A method for state assurance of a real and / or virtual automation system, in which a real and / or virtual automation process with at least a first virtual controller (1) is controlled on a real hardware and a first process image (4) of the first virtual controller (1 ) and written to a non-volatile image memory (5). The method of claim 1, wherein the first process image (4) is generated and written to the image memory (5) while the first virtual controller (1) is in an active mode of operation. The method of claim 1, wherein the first process image (4) is generated and written to the image memory (5) while the first virtual controller (1) is in a passive mode of operation. 4. The method according to any one of the preceding claims, wherein the stored in the image memory (5) first process image (4) is loaded on the real hardware and restored there and the first virtual controller (1) from the state of the restored first process image (4) out is restarted. 5. The method according to any one of the preceding claims, wherein hardware metadata are stored in a memory (6) which describe minimum requirements for the real hardware for controlling the automation process with the first virtual controller (1). 6. The method according to claim 5, wherein the hardware metadata is used to check whether another real hardware meets the minimum requirements and, if this is the case, the first process image (4) stored in the image memory (5) is loaded onto the further real hardware. is restored and there, and the first virtual controller (1) from the state of the restored first process image (4) is restarted on the other real hardware. 7. The method of claim 6, wherein a virtual automation system is simulated with the real hardware and a virtual automation process with the first virtual controller (1) is controlled and the further hardware is a controller of a real automation system and a real automation Process is controlled with the first virtual controller (1), wherein the virtual automation system is a simulation model for the real automation system. 8. The method according to any one of the preceding claims, wherein the automation process with a second virtual controller (2) is controlled and during the control of the automation process generates a second process image (7) of the second virtual controller (2) and in the non-volatile image memory (5). is written, wherein the first process image (1) a first controller identifier (11) in the image memory (5) is stored, which uniquely identifies the first controller (1), and the second process image (2) a second controller identifier (21) in the image memory ( 5) which uniquely identifies the second controller (2). 9. The method of claim 8, wherein the process images (4,7,8) are stored by means of an image management (9) in the image memory (5) and restored to a target hardware. 10. The method according to claim 9, wherein the first and second virtual controllers (1, 2) are assigned a common configuration identifier, the configuration identifier is stored in the image memory (5) and a restoration of the first and second process images (4,7) is effected by sending the configuration identifier to the image management (9). 11. The method of claim 10, wherein the image management (9) hierarchically subordinates the first and second controller recognition (11, 21) of the configuration identifier. 12. The method according to any one of claims 8 to 11, wherein the resources of the real hardware are distributed to the virtual controller (1,2) by means of a hypervisor. 13. The method of claim 12, wherein a real-time hypervisor is used to distribute the resources. 14. Data processing system for condition assurance of a real and / or virtual automation system, with at least one first virtual controller (1) for controlling a real and / or virtual automation process and Means for generating a first process image (4) of the first virtual controller (1) and for storing the first process image (4) in a non-volatile image memory (5). A computer program product comprising program code means for performing a method according to any one of claims 1 to 13 when said computer program product is executed on one or more data processing systems.