WO2016188731A1

WO2016188731A1 - Machine maintenance in the beverage industry

Info

Publication number: WO2016188731A1
Application number: PCT/EP2016/060388
Authority: WO
Inventors: Johann Zistler; Gerhard Zanner
Original assignee: Krones Ag
Priority date: 2015-05-22
Filing date: 2016-05-10
Publication date: 2016-12-01
Also published as: DE102015209499A1

Abstract

The invention relates to an apparatus for controlling remote maintenance access to a machine in the beverage industry. An enquiry for approval of remote maintenance of a machine component is received. An approval module allows an approval to be granted, wherein the granted approval identifies a determined remote unit and a determined machine component of the machine for remote maintenance and preferably indicates a time for the remote maintenance. It may be necessary for an enquiry to comply with a predefined approval process. An activation module for activating or blocking a communication link between the determined remote unit and the determined machine component for remote maintenance based on the granted approval is configured such that activation activates a communication link only between the determined remote unit and the determined machine component. The remote maintenance can be performed only for the at least one machine component of the machine by the at least one remote unit by means of the activated communication link.

Description

Machine maintenance in the beverage industry

The present invention relates to a device for controlling a remote maintenance access to a machine in the liquid food filling industry, in particular the beverage industry according to the preamble of claim 1 and a method for controlling a remote maintenance access to such a machine according to the preamble of claim 8.

State of the art

In the beverage industry, remote maintenance or remote service for remote maintenance of machinery or machine components is typically performed by means of a data connection over an external network, such as the Internet. Access to the machine or the machine component takes place, for example, by means of a virtual private network (VPN) tunnel, which provides a secure connection between the machine or the machine component and a terminal for carrying out the remote maintenance. The terminal is typically a computer of the employee performing the remote maintenance, for example, at the manufacturer of the machine or other remote remote maintenance platform. The VPN tunnel is automatically set up by the remote maintenance platform. The connection is established without restriction and does not require any active steps on the part of the machine or a user of the machine. The only prerequisite for establishing the connection is a network connection of the machine or of the machine component, which typically can only be physically separated by pulling out the network plug on the machine or on a network router. Nevertheless, situations may occur in which (for a limited time) remote maintenance access to the machine is undesirable or needs to be prevented, for example, to ensure the safety of personnel during a local maintenance process on the machine. However, physically disrupting the network connection by disconnecting the hardware or network cables of the machine or router to prevent remote maintenance access to the machine may affect the functionality of that machine, particularly if the machine is dependent on network communication for its operation. While the possibility of remote access to machines for the operator of the machines has the advantage that the manufacturer in the case of problems or configuration changes are often faster and cheaper to solve by remote maintenance, so there are also safety concerns, for example, in terms of safety of employees, that are in close proximity to a machine that is being remotely accessed. Furthermore, there are security concerns regarding possible unwanted access to the machine, such as a hacker attack by third parties, or with regard to an undesired outflow of information from production data. task

It is thus the object of the invention to provide an improved apparatus and method for controlling remote maintenance access to a machine in the liquid food filling industry, in particular the beverage industry, particularly with regard to a possibility of controlling and controlling remote maintenance accesses via an external network User of the machine.

solution

This object is achieved according to the invention by a device for controlling a remote maintenance access to a machine in the liquid food filling industry, in particular the beverage industry according to claim 1 and a method for controlling remote access to a machine in the liquid food filling industry, in particular the beverage industry Claim 8 solved. Advantageous embodiments and further developments are the subject of the dependent claims.

An embodiment of the invention relates to a device for controlling a remote maintenance access to a machine in the liquid food filling industry, in particular the beverage industry. The machine comprises at least one machine component. The machine component is configured to establish a communication link with at least one remote unit for remote servicing of the at least one machine component of the machine. The communication link between the remote unit and the machine may be via an external network such as the Internet. The device is configured to receive a request for permission to remotely service at least one particular machine component. The apparatus may further include an approval module for granting a remote maintenance approval. The granted approval identifies a particular remote unit and machine component of the remote maintenance machine. Preferably, a time for the remote maintenance can be specified, so that the approval is valid only in a certain period or for a certain period of time. The request can already have one desired or proposed machine component and a remote unit. equivalent.

The apparatus may further include an activation module for enabling or blocking a communication link between the particular remote unit and the particular remote maintenance machine component. Activation or blocking is based on the granted approval. In this case, the activation module is configured such that enabling a communication connection is only possible between the particular remote unit and the particular machine component. Remote maintenance for the at least one machine component of the machine can then be carried out by means of a remote access session using the reased communication connection. Thus, the operator or user of the system has at all times control over who accesses which machine and when. Furthermore, by means of predefined approval processes and / or predefinable groups of machine components, to which approval processes may relate, according to a further embodiment it is possible to grant approvals more easily and without error, in order to simplify the process of granting approval for the support Remote maintenance to simplify and error-prone to make.

According to a further embodiment, one or more approval processes may be defined for the at least one machine component. Such an approval process may predefine several pieces of information, such as a unique identifier (identifier), a designation of the approval process, a list of firm contacts, the option to add more contacts as needed, or an adjustment whether the appropriate approval process has been granted permanently and none requires further explicit issuing by the operator of the facility. The definition of an approval process may also include a definition of a machine component or a group of machine components. For example, it may be specified that a remote maintenance access authorization is granted only if it complies with a predefined approval process. This further increases the security of the remote maintenance process.

According to another embodiment, the approval further comprises a period for the remote maintenance. The activation module allows the communication connection for remote maintenance only during this period. Such a period can for example a list of fixed values, but also be set manually. For example, only a fixed duration, such as 2h, 6h, 12h, 72h, etc., can be specified, or even the beginning and the end of the period. Advantageously, no time is specified, so that the authorized user must make the setting explicitly, whereby accidental approval can be prevented.

According to a further embodiment, the period of approval granted may also be changed after the grant. Such a change may be made explicitly by an authorized user to the operator of the machine via an interface of the device for controlling the remote maintenance access, and / or the period is terminated as soon as a connection to the remote maintenance is terminated, for example by having a service person of the After completion of a session for remote maintenance, the manufacturer of the machine terminates the communication connection, which can be done by logging out of the machine component or by terminating a computer control software that was used to perform the remote maintenance. Furthermore, an administrator may be authorized to interrupt the communication connection.

According to a further embodiment, the license for the remote maintenance further comprises at least one condition. The remote maintenance is then actually enabled only after fulfillment of this condition. An example of such a condition is that an acknowledgment of the remote maintenance by a user must be made directly on the machine by means of a Human Machine Interface (HMI) for which the remote maintenance is conditionally approved on at least one machine component. This could be necessary, for example, to meet occupational safety requirements of persons who are in the immediate vicinity of the machine. Furthermore, it may be desirable for a particular person, such as a technician or engineer of the customer operating the machine, to be on-site at the machine during remote servicing, and that remote servicing may not begin until the particular person is actually there , and / or after, for example, a cover has been opened. Thus, for example, observations can be made on the machine or the machine component, for example by detecting visually or by hearing whether or how electrical or mechanical elements of the machine behave.

According to a further embodiment, after receiving a request, the device sends a request approval message about the request to at least one designated person. In such an approval process, the person or their contact information, such as an email address, may be specified. To one Inadvertent approval, for example, by preventing an automatic e-mail response, the notification may include an authorization key in a predefined format by which the request and / or the approval process, ie the type of remote maintenance and on which machine components the remote maintenance is to be performed uniquely identifiable is. This approval key may be included in a notification about the request that can be sent to authorized persons in such a way that it is not immediately valid. Instead, it is necessary for the person to first modify the approval key in response to the request approval message to cause the approval to be granted upon receipt of the response with a valid approval key from the device. This modifier can be done manually, for example by copying several separate parts and then assembling the copied parts into the valid approval key. Accordingly, in response to an incoming request, the device or the responsible contact person, for example, sends an e-mail which, in accordance with a configurable template, contains one or more placeholders for, for example, the name of the responsible contact person at the operator of the machine, the name of an employee of the manufacturer , a commission number and / or the name of the machine or machine component or a desired duration for the release period. Furthermore, the email may contain the approval key, which may consist of at least 24 alphanumeric characters. For example, this approval key may be divided into multiple parts in the email about the received request, whereby the approval request and / or an underlying, predefined approval process is uniquely identifiable. However, the approval key in this format is not valid to grant an approval. The partitioning may be done by one or more readable tags according to another embodiment, or it may be necessary to add or change one or more particular characters of the approval key. When an approval is granted, the multi-part or otherwise non-valid approval key must first be manually converted to a contiguous, valid approval key, such as by removing the tags. Only one such contiguous key is valid, that is, only if the contact's response email has actually been edited to contain a valid, ie contiguous, approval key will the approval be granted by the Approval module. According to another embodiment, one or more approval processes may be configured for the machine. An approval process is a definition that defines who can access which machine component remotely over a communication link from a remote unit. A defined approval process makes it possible for remote maintenance to be controlled, ie with the knowledge and consent of the operator of the machine. Such a preconfigured approval process may include the name (s) of the contact (s) at the manufacturer of the machine that may be responsible for performing remote maintenance, and the at least one machine component affected by remote maintenance according to such a preconfigured approval process. Furthermore, the approval process may include the authorized representative (s) with the operator of the machine who are authorized to grant an approval for that machine component. Optionally, persons may also be deposited in the approval process who are to be informed about a corresponding request for approval of remote maintenance, but who are not authorized to approve it. As an additional option, it is possible that in the approval process also the control commands, which are permitted within the framework of the corresponding remote maintenance, are defined. This can be done by a positive selection of permissible commands and / or controllable functions of the machine component. Alternatively, only certain commands or functions can be disabled as inadmissible, which are then blocked or filtered by the activation module. For example, it is possible to prevent a robot arm from being controlled by commands sent as part of remote maintenance, which is not permitted due to security guidelines. Or it can be prevented that a pump or a ventilation device is switched on or off by a remote maintenance, which may also be undesirable for security reasons. Thus, different approval processes with different possibilities with regard to the executable actions can also be defined for a specific machine component. An approval process can be defined, created or changed via the user interface of the device. Optionally, an approval process can also be created or edited directly via the HMI of a machine or machine component. This is advantageous because the approval process is then determined directly on-site at the appropriate machine, for example, it is also easily possible to select the permissible or impermissible functions, without overlooking anything. In order to facilitate the definition of approval processes for more than one machine component or also for several machines, which respectively comprise one or more machine components, approval processes for defined groups of machines and / or Machine components are set. An option to edit the definition of groups of machine components can be made via a user interface via drag and drop. All machine components of the industrial plant are contained in the user interface and can be moved between the groups. A group includes an editable label. If a group no longer contains any machine components, it will be removed. If a symbolic representation of a machine component is dragged to a "Create New Group" field, releasing (dropping) will create a new group with the appropriate component, saving it explicitly and saving changes automatically, if possible That contact persons are also added manually for an approval process, this is an option that can be selected, for example, by a checkbox For each plant that includes one or more machines, a special approval process can be defined that can not be deleted and no contact persons For this approval process, the approval is permanently valid If, in accordance with this embodiment, an approval is granted according to a defined approval process, the granted approval can be stored with the list of machinery components used in the approval process in the Group were included. The approval process can also refer to a group of machine components. This ensures that a permit, which, for example, only applies for a later period, can not be changed by a change in the group between the granting and the start of the activation.

According to a further embodiment, the apparatus further comprises a means for logging, which details with respect to the machine or machine component, the device from which the remote maintenance takes place, information on actually transmitted data and control commands, a descriptive text to the carried out remote maintenance or information on the operating state of Machine component or machine, etc. are recorded.

According to a further embodiment, the authorization after receiving the request can only be granted by the licensing device during a predefined period of time. This can ensure that a no longer required remote maintenance is not inadvertently released due to an outdated request.

Another embodiment of the invention relates to a method for controlling remote access for remote maintenance of a machine in the beverage industry. The Machine can in this case set up a communication link with at least one remote unit for the remote maintenance of at least one machine component of the machine. In particular, the communication link between the remote unit and the machine can be established via an external network. The method includes receiving a request for approval of remote maintenance access to at least one machine component of the machine, and granting the approval of the remote maintenance access. The granted approval identifies a particular remote unit and the at least one machine component of the machine for remote maintenance access. Furthermore, the granted approval may include a time for remote maintenance access. Based on the granted approval, a communication link between the particular remote unit and the at least one machine component is blocked or unlocked. The communication link is thereby enabled only between the particular remote unit and the at least one machine component identified in the granted license. A remote maintenance for the at least one machine component of the machine by the at least one remote unit can only be carried out by means of an activated communication connection.

Further features and advantages of the invention will be explained below with reference to the exemplary figures. Show it:

FIG. 1 shows a system having a device for controlling a remote maintenance access to a machine in the beverage industry, by which remote access from a manufacturer or service provider over a network to machinery and / or machine components is enabled at an operator thereof;

FIG. 2 shows a procedure by means of which a customer or a manufacturer can obtain a license for remote maintenance;

FIG. 3 shows states of one or more (communication) sessions that are run as part of an approved remote maintenance, during which, for example, an employee of the manufacturer communicatively connects to one or more machine components at the operator of the machine via a network;

FIG. 4 shows a method sequence for the control of a remote maintenance access from the receipt of a request for the granting of a license, including identification of a specific remote unit and a specific machine component of the machine, and optionally a time for the remote maintenance, until the activation of the communication connection according to the approval.

Here, the embodiments of the invention will be described with reference to a remote maintenance access to one or more machines in the beverage industry. However, the described embodiments and examples are not limited to the beverage industry, but generally relate to the bottling industry and the filling of liquid or flowing goods, such as liquid foods such as edible oils or sauces. Figure 1 shows an exemplary embodiment of a system 100 in which a device 150 for controlling remote maintenance access to a machine 132 in the beverage industry may be employed. The device 150 is located at a location of the operator of the machine, which is often a customer 130 of the manufacturer 110, and is controlled by one or more predefined contact persons at the operator. The device 150 controls communication to the outside of, for example, a location of an operator on which the machine is installed, in a precisely controlled manner. The contact persons at the customer can see incoming inquiries that have been received, for example, from a reception module 154, and, if necessary, arrange for the approval to be granted. For this purpose, the defined contact persons of the operator of the machine can connect to the device 150 via a device which makes available a user interface 152 and specify further details for a communication for carrying out the remote maintenance according to the request and optionally also according to predefined, stored specifications and then grant a permit. The determination of the details is carried out by means of an approval module 156, whereby, for example, settings relating to the communication connection can be stored and checked for correctness according to predefinable rules. The settings include an identification of a remote unit, from which the remote maintenance is to be made by means of a remote access, as well as an identification of the exact machine or of at least one specific machine component, for which the remote maintenance is required. Such settings, the at least one identification of a source address from which the remote maintenance is performed, and an identification of one or more destination addresses of the at least one particular machine component may be preconfigured and stored as an approval process. It may be necessary for a communication connection to be released for remote maintenance only if the settings correspond to one of the predefined approval processes. Furthermore, a time can be specified in which the remote maintenance can take place, whereby the approval has a time-limited validity. For the time limited Validity can be specified as a period, or instead of the period with a start time and an end time, only a validity period can be set, the time for the validity then running from the start of a session of an actual remote access. As further described below, the approval may also be associated with one or more conditions. The identification of the engine 132 and / or the at least one machine component 134 may include one or more destination addresses and / or one or more particular physical or logical access interfaces 136, such as Internet Protocol (IP) ports. The destination address (s) can be determined by one or more IP addresses or by identification numbers such as a globally unique device identification number or a device identifier. A machine that does not include any other (logical) machine components may be considered as a machine component. Furthermore, the authorization comprises a determination of a source address, from which, ie from which user or from which device the communication for remote maintenance may take place. This can be done by setting an IP address of the manufacturer or service provider 110, or by setting a specific IP address or an identification number of a unit such as a computer 114 or a virtual machine of a service employee. Under certain circumstances, a service employee of the manufacturer may also be found at a different IP address than the manufacturer's IP address, for example if the relevant service employee with a corresponding mobile unit 112 such as a notebook is outside his company location. Another possibility can be the identification of the source address via a determination of a particular service employee or service team, for example by means of a specific access identifier or a specific login name. Remote maintenance is done by means of a communicative connection via a network 120 such as the Internet.

The communication from the device 150 via the network 120 outside, for example, an internal network 138 at the location of the operator 130 can be encrypted, for example via a Virtual Private Network (VPN) or Internet Protocol Security (IPsec) or by means of Security Sockets Layer ( SSL). For example, one embodiment of the enablement module 158 may include a Network Address Translation (NAT) router that is dynamically configured to allow communication only between the particular device at the manufacturer and the particular machine components at the customer, with the NAT router dynamically configured can be that an access is released only at the beginning of a defined period of time, and is locked again at the end of the defined period of time. According to the Open Systems Interconnection Model, the OSI model, the activation can take place on the transport layer (layer 4) or a higher layer.

The user interface 152 of the device 150 may include, for example, a selection of the following features. The user interface 152, or parts of the device 150 that interact with users and requests, may also be referred to as a management platform. Received and as yet unprocessed requests for remote machine tool 134 approval are displayed, where a request may include, for example, an accompanying text for illustration, and the user interface 152 provides the ability to concretely set the approval or even reject the approval. Remote maintenance only takes place between the manufacturer's source address specified in the license and the destination address (s) of the machine 132 or machine components 134 at the operator of the machine, because the activation module 158 only communicates between source address and destination Address (s). Optionally, this activation can also be done only as a time-terminated communication session or session. The user interface 152 may accept approved and scheduled, i. show future sessions and, optionally, allow a subsequent change of these scheduled sessions. Furthermore, one or more currently active sessions can be displayed; Here, too, a subsequent change of details, for example by one of the predefined contact person is possible at any time. If it turns out that a remote maintenance takes longer, the period can be extended. Or a permit and the corresponding active session can be shortened or terminated immediately if required. Furthermore, already finished sessions can be displayed. Remote maintenance sessions can be logged and a recorded log can be displayed in whole or in part. Furthermore, rejected requests or invalid requests or inappropriate access attempts can be logged.

On a dashboard or on the user interface (such as the HMI) of the machine 132 or the machine component 134, the last remote maintenance sessions can be displayed; active sessions can be highlighted in the display. Depending on the design of the user interface, for example, the last 5 sessions can be displayed, or a scrollable list can be displayed. Within the scope of an approved remote maintenance access, several sessions can take place, for example several completed sequences of starting a session, executing commands and terminating the session and the connection, or by several sessions carried out in parallel, for example with several software tools. According to another embodiment, the remaining time of a permit is displayed to the manufacturer or service provider 110. Before the time has elapsed, an operator of a current session, such as a service agent, may be alerted to the near end of the remote maintenance period. This can be done for example by a pop-up on the screen of the operator, and / or an SMS can be automatically sent to the operator. Such information may occur at a predefined time prior to the end of the period, for example, 15 minutes before the end of the period. A pop-up should not be accidentally closed, and it should not intercept keystrokes, which would disrupt the operator's workflow. If the time has expired, the communication connection is disconnected.

According to one embodiment, the license for the remote maintenance may further include a condition, wherein the remote maintenance is actually enabled only after fulfillment of this condition. Such a condition may be, for example, that the machine 132 or machine component 134 must be in a particular operating condition. Further, a condition may require confirmation of remote maintenance by a user via the user interface at the machine 132 or machine component 134 before the remote service can actually begin. The user who confirms the remote maintenance on the user interface does not have to be the same as the user who granted the remote maintenance approval. For example, an engineer or line manager may release a remote maintenance; a technician on the running machine 132 is informed by the user interface of the machine and must confirm remote access at the user interface, which may be important for reasons of safety at work. Another scenario may be for an engineer to release the remote maintenance through the user interface 152 of the device 150, where the service employee's access should not start until the engineer is actually at the machine 132, and the engineer may spend some time on the machine Distance to the machine needed. Thus, for example, it can be ensured that no critical process is currently running on the machine 132, or there may be an observation and / or telephone feedback to the service person during the remote maintenance access. According to a further embodiment, one or more machines 132 and / or one or more machine components 134 with corresponding responsible contact persons at the customer as well as at the manufacturer can be defined by the user interface 152 or by the device 150 for different remote maintenance options. Furthermore, it can be defined that approvals include parameters that allow for predefined groups of machine components 134 and / or certain actions that occur in the Within the scope of a corresponding remote maintenance. Such approval requirements can be set up and processed by authorized employees of the customer. It may also be possible for one or more given approvals to be permanent and not changeable by the customer's employees. The device 150 may check an incoming request to see if the request corresponds to one of the predefined approvals; if not, the request can be automatically rejected. In the case of an automatic rejection, both the person who made the request and the authorized employees of the customer can be notified; if necessary, such a request can nevertheless be processed, so that after the establishment of correct and valid parameters an approval is granted. When an approval is granted, a remote service approval notification may be transmitted by means of one or more transmission protocols from the device 150 to a predefined address associated with a person performing the remote maintenance. Transmission protocols may include, for example, e-mail, SMS, MMS, a message to computer software used for remote access for the purpose of remote maintenance, a web page, or a message sent to an app on a smartphone. According to a further embodiment, persons who are responsible, for example, for a machine 132 or machine component 134, can also be notified to the customer, since these persons can be different from the persons who are authorized to issue approvals. Optionally, communication may also be sent in a suitable format between the machine 132 or the machine components 134 for which remote maintenance is to be performed; this may be necessary, for example, to allow conditional approval where the enabling device 158 needs to check information about the operating state of the machine 132 or the machine component 134, or an acknowledgment for an HMI associated with the machine 132 or machine component 134 to query the actual start of the activation. Such activation can be done by a simple confirmation, or by entering a security code or similar. respectively. Such a security code can be predefined or defined for a specific authorization for remote maintenance in the parameters.

The device 150 may be implemented in the form of hardware modules, software modules, or a combination of hardware and software modules.

According to another embodiment, a request for remote maintenance may originate from a device within the customer's internal network 138, where machine 132 or machine component 134 is located. Furthermore, a request can be made directly via a User interface to the machine 132 or machine component 134. Furthermore, a request can be made via the user interface 152 of the device 150. In addition to such cases in which the request is initiated by the operator of the machine, a request can also be made by the manufacturer or a service provider 110, for example, if a preventive remote maintenance makes sense due to a data point evaluation, and / or if, for example, a software update for a Machine 132 or machine component 134 is to be performed. A request may be made by one or more transmission protocols, including, for example, e-mail, SMS, MMS, a message from computer software, a website, a message generated by an app on a smartphone, and so on. A request may contain information about a desired period for carrying out the remote maintenance. The approval can be granted for the desired period or for a different period. As a special case, it is also possible that a permit is issued permanently, ie that the corresponding permit is valid indefinitely.

According to another embodiment, the device 150 may include a means for logging, wherein one or more of the following information is logged. The identification of the machine 132, the identification of the manufacturer or service provider 110, an identification of the employee performing remote maintenance, identification of the particular device outside the internal network 138 from which the remote maintenance communication is made, the source IP address, an identification of the at least one machine component 134 for which the remote maintenance is performed, the destination IP address, an identification of the access interface 136, the specified time period for the remote maintenance, the times in which communication has actually occurred, the types of remote maintenance, the communication volume in both directions, at least parts of the total communication, time of receipt of the request, information about the device from which the request originated, time of approval of the request, information about the device from which the request was approved, information about the user who the Authorization, information on remote maintenance attempts in which the access was unsuccessful, a description text to a remote maintenance performed, or information on the operating state of the machine component 134 or the machine 132, etc ..

According to a further embodiment preconfigured approvals in approval processes may include certain possible remote maintenance types with defined control possibilities. The activation module 158 restricts the communication connection to one or more defined machine components 134 of the machine 132, and / or to one or more physical or logical access components. interfaces or ports 136 of the machine components 134. Optionally, the activation device can additionally limit the communication to certain functions that can be performed during remote maintenance. For example, a calibration routine may be disabled, or certain parameters of the machine may not be changed in the context of remote maintenance. Furthermore, certain control commands may be disabled, such as control commands with which the movement of a robot arm or actuation of a valve is controlled; For example, such control commands may not be allowable under remote access because of security policies, and thus may be advantageously blocked by the device 150. A request may be directed to the device 150. The device can then send a notification, for example in the form of an e-mail, to the person or persons responsible who can approve the request. This is possible if the request contains enough information to be assigned by the device, for example, to a predefined approval process, or if the request contains information about the contact person. If certain machine components are identified in the request, but for which different approval processes are defined, which may also have different contact persons, then all contact persons can be notified that are suitable according to the possible approval processes. In such a case, the granting of approval requires a more precise definition of the machine components and / or the approval process, ie the actions that may be carried out in the context of remote maintenance. A notification e-mail may include an indication of a desired approval period. However, it may be necessary to always enter the period of actual approval manually and in a specific format. For approval, the recipient may respond to a notification e-mail, this response being sent back to the device, which then makes the appropriate settings to enable the communication link for remote maintenance. Optionally, the device may also send another notification to the person or persons who are to perform the remote maintenance. Inquiries may also be viewed, edited and approved via the user interface 152, for example by an authorized user logging into the user interface. A request can also be made directly via the user interface, for example, when an authorized employee is made aware of a desired remote maintenance by telephone or by email or by other means. The notifications sent by the device are based on predefined templates for the text contained in corresponding emails.

FIG. 2 shows an exemplary process via which a remote maintenance access can be authorized. A request for remote maintenance approval is received 202 by the device 150. In accordance with information included in the request, it may be decided whether approval is required for the requested remote service 204. For example, the request may include an identification of a particular service , preconfigured approval process included. If approval is required, the request is processed further and some necessary settings for the communication link for remote maintenance can be set. In particular, at least one particular machine component and a particular remote unit are determined. The particular remote unit may be, for example, a computer-based device located, for example, outside an internal network of the operator of the machine and configured to communicatively connect to the at least one particular machine component 134 via the device 150 via at least one network 120 in order to carry out a remote maintenance session - if granted and valid. Typically, an authorized operator of the machine operator will review, if necessary, edit and approve a request for approval by interaction through a user interface 152 or by exchanging notifications such as emails with the device 150. For example, after receiving a request, the device 150 may generate an email that is sent to the authorized employees as defined by the approval process. In a reply to this e-mail or via the user interface, further settings, such as the period and / or conditions for the remote maintenance and / or the machine components and the permitted commands can be made. At least parts of such settings can be stored permanently in the preconfigured approval process. If the remote maintenance approval has been processed 206 and the defined settings have been saved, the manufacturer or service provider may be notified of the granted approval and the time period, for example, by sending a notification by e-mail or SMS. Remote maintenance is then enabled by enabling 208 the communication link according to the permit, ensuring that communication is only possible between the at least one particular machine component and the particular remote unit. After activation, a remote maintenance can begin 210, ie a service employee of the manufacturer can, for example, start a session and thus carry out the remote maintenance. FIG. 3 shows an exemplary sequence of remote maintenance in the form of a state diagram after it has been approved and activated. A communication link is initiated from a device of the manufacturer or service provider, and the system is in the "no session" state 302. Then, a remote maintenance session is started 310 with a suitable software tool, which places the system in the "active session" state 304 passes. Optionally, for the establishment of the communication connection and / or for the start of the remote maintenance session, a login with security mechanisms such as a login name and a password for authentication may be necessary. Within the scope of an active remote maintenance session 304, the at least one specific machine component can be accessed, data can be read out and transferred, parameters of the machine component can be changed, commands can be issued, etc. A logging of the remote maintenance can also be made during the session by means of the software tool for remote maintenance. The remote maintenance accesses used, ie the machine components accessed, the executed control commands, the duration of the access or a freely written documentation may be included in the protocol. The activation module can check whether the approval has already expired, for example because the remote maintenance period has expired, or because the approval has been changed or revoked by the customer. Upon expiration of the approval, the system enters 314 inactive session 306. Further, an administrator may be entitled to put an active active session in the "inactive" state 314. Device 150 may interrupt the communication connection to the machine component - Access to the machine component (s) is now no longer possible, but completion of, for example, a documentation of the remote maintenance can still be performed.If necessary, the manufacturer may ask for an extension of the license, if the remote maintenance has not yet been completed Extension is a resumption 318 of the session possible after the activation module 158 has re-enabled the communication link according to the amended approval.Otherwise, the system goes, for example after a specified time in the state "no session" 302 via 316. The active S ession can also be completed 312 while the approval is still valid. In this case, the session is terminated, ie, the system goes to the "no session" state 302, but the communication link remains enabled from device 150. As long as an granted approval exists (yet), switching to an active session 304 is by starting a new session 310. After a predefined period of time in the state of the inactive session 306 the system can go into the state "no session" 302, whereby the remote maintenance session is completed, ie it is no longer possible to resume the session.

FIG. 4 shows an embodiment of a method for controlling remote access for remote maintenance of a machine, which may include one or more machine components. In step 402, a request for a remote maintenance approval is received from one or more machine components. This request is checked 404, for example, whether it refers to an authorized representative of the manufacturer and a machine component at the operator of the machine, for which a remote maintenance is provided in principle. This can be done by comparing the details from the request with predefined approval processes. A predefined approval process can also be identified by an approval key that is included in the request. If a request for remote maintenance approval is correct 406, then actual remote maintenance settings are completed, which in turn may be done according to a predefined approval process. Then, a request approval message is sent for approval to one or more of the employees who are authorized to approve the approval process or machine components. The request approval message may be an email. At least one of these authorized employees must then confirm the approval by responding to the request approval message to ensure control by the operator of the machine. The grant may require that a period for remote maintenance be explicitly set and / or an approval key must be manually changed by the employee to a valid form. The request approval message includes an approval key that is modified in a predetermined manner so that the modified approval key is not immediately valid to confirm the grant of a permit. This prevents that, for example, an auto-responder function can already lead to the granting of a license. Furthermore, conditions, the permissible commands or the type of access can be determined, which can be done by changing or selecting a specific approval process, for example, if there are several approval processes with different access rights for the at least one machine component. After approval 410, an optional confirmation with details regarding the remote maintenance to the manufacturer or the corresponding employees who are to carry out the remote maintenance can be sent 412. Also, the author of the request can be informed about the approval or rejection. If necessary, it may be necessary to wait 416 for the specified validity period of the approval. before the communication is unlocked 418. Optionally, it may also be necessary for conditions on the part of the machine or machine to be met before the communication is enabled. If an approval is modified to become invalid, or if the specified period expires, the communication will be interrupted. The employee who performs the remote maintenance is informed about all his active and inactive sessions, so that the remote maintenance can be completed as efficiently and fully documented as possible. Optionally, the employee can also see which approvals have been granted. The employee is warned before the approval expires. The device 150 may also be configured to periodically retrieve an e-mail account in which responses to approval e-mails are received. Alternatively, the emails may also be transferred to the device 150 by a push process. To avoid duplicate processing of emails, a processed email can be marked as read. Processing involves searching for the approval key for an active approval request. The search for the approval key should be done with a certain amount of fault tolerance. Notifications sent to the originator of the remote maintenance request or to the manufacturer performing the remote maintenance do not include an approval key to avoid repetitive responses through an auto-responder feature. If multiple approvals arrive at a request that has been independently granted by multiple authorized persons, the device can either manage multiple independent approvals, or it can be determined which license is actually valid. This may be the first granted approval so all other approvals are ignored or a later arriving approval may override and replace an earlier approval. The corresponding persons can be informed immediately.

It is further noted that features mentioned in the embodiments described above are not limited to these specific combinations, but are also possible in any other combinations as further embodiments.

Claims

claims

Apparatus (150) for controlling remote maintenance access to a machine (132) in the liquid food filling industry, in particular the beverage industry, wherein the machine is configured to communicate with at least one remote unit (110, 112, 114) for remotely maintaining at least one machine component (134) of the machine, wherein the communication link between the remote unit and the machine comprises an external network (120), characterized in that the device is configured to receive a request for permission of remote maintenance access to at least one machine component of the machine, the device comprises an approval module (156) for granting the approval of the remote maintenance access, the granted approval identifying a particular remote unit and the at least one machine component of the remote maintenance access engine, and more particularly indicates a time for the remote maintenance access; the device comprises an activation module (158) for enabling or blocking a communication link between the particular remote unit and the at least one machine component based on the granted approval, the activation module being configured such that the communication link is only between the particular remote unit and the at least one remote unit unlock a machine component identified in the granted approval; and wherein remote maintenance for the at least one machine component of the machine is feasible only by means of an enabled communication link and only by a remote unit identified in an issued approval.

The apparatus of claim 1, wherein the granted approval indicates a period for the remote maintenance access for performing the remote maintenance, and wherein the activation module (158) is configured to enable the communication connection only during the period.

3. The apparatus of claim 2, wherein the device is further configured to change the period of granted approval, and to change the period of granted approval so that the time period after termination of the remote maintenance communication connection also ends.

The apparatus of any one of claims 1 to 3, wherein the approval further comprises a condition requiring confirmation by a user of the remote maintenance access by means of a human machine interface, HMI, of the machine (132), and wherein the activation module ( 158) is configured to enable remote maintenance access only after the condition has been met.

The apparatus of any of claims 1 to 4, wherein the approval module (156) is further configured to grant the approval only upon receipt of a valid acknowledgment message, the valid acknowledgment message comprising an authorization key associated with the request and previously submitted by the user The device (150) is further configured to send the request approval message for the received request to the at least one predetermined recipient, the request approval message including the approval key such that the approval key in at least two parts separated from each other and the approval key from these at least two separate parts of the request approval message can be reassembled, and wherein the confirmation message as Antwo At least one predetermined recipient is received on the request approval message from the device.

6. The device according to claim 1, wherein at least one approval process is predefined, which specifies a specific remote unit and at least one specific machine component (134) for a remote maintenance access, and wherein the approval process specifies functions that are executable during remote maintenance access and / or that are blocked during remote maintenance access.

The apparatus of any one of claims 1 to 6, wherein the approval module (156) is configured to grant approval for the request only within a predefined period of time after receipt of the request.

A method of controlling a remote maintenance access to a machine (132) in the liquid food filling industry, in particular the beverage industry, wherein the machine is configured to communicate with at least one remote unit (110, 112, 114) to remotely maintain at least one machine component (134). the machine, and wherein the communication link between the remote unit and the machine comprises an external network (120), the method comprising:

Receiving (402) a request for approval of remote maintenance access to at least one machine component of the machine;

Granting (410) the approval of the remote maintenance access, wherein the granted approval identifies a particular remote unit and the at least one machine component of the remote maintenance access machine, and more particularly, further indicating a time for remote maintenance access;

Enabling (418) or blocking a communication link between the particular remote unit and the at least one machine component based on the granted approval, wherein the communication link is enabled only between the particular remote unit and the at least one machine component identified in the granted approval ; and wherein remote maintenance for the at least one machine component of the machine is feasible only by means of an enabled communication link and only by a remote unit identified in an issued approval.

The method of claim 8, wherein the granted approval indicates a period of remote maintenance access for performing the remote maintenance, and wherein the communication connection is enabled only during the time period.

10. The method of claim 9, further comprising:

Changing the period of the granted approval, whereby the period is changed so that the period of the granted approval also ends after termination of the communication connection of the remote maintenance.

11. The method of claim 8, wherein the approval further comprises a condition requiring confirmation of the remote maintenance access by a user, and wherein the remote maintenance access is enabled only upon satisfaction of the condition.

12. The method according to any one of claims 8 to 11, wherein the method further comprises:

Sending a request approval message for the received request to at least one predetermined recipient, wherein the request approval message includes an approval key such that the approval key is divided into at least two separate parts and the approval key can be reassembled from these at least two separate parts of the request approval message , and wherein the approval key is associated with the received request,

Receiving an acknowledgment message in response to the sending of the request approval message, wherein granting (410) of the approval occurs only if the received acknowledgment message comprises the composite approval key.

13. The method of claim 8, wherein at least one approval process is predefined that specifies a particular remote unit and at least one particular machine component for remote maintenance access, and wherein the approval process specifies functions executable during the remote maintenance access and / or blocked during remote maintenance access. Method according to one of claims 8 to 13, wherein the approval for the received request can be given only within a predefined period of time after the receipt of the request.