DE102021112165A1 - Memory comparisons of a programmable logic controller - Google Patents

Abstract

A method for memory comparisons of a programmable logic controller includes generating a first memory dump of a memory of the programmable logic controller, the first memory dump corresponding to a first state of the programmable logic controller at a first point in time, the first memory dump having a first plurality of variable identifiers of a control project for the programmable logic controller and each of the first plurality of variable identifiers has an associated first value, wherein each of the first plurality of variable identifiers has a memory location statically allocated in the memory. In addition, the method includes generating a second memory dump of the memory of the programmable logic controller, the second memory dump corresponding to a second state of the programmable logic controller at a second point in time, the second point in time differing from the first point in time, the second memory dump having a second plurality of variable identifiers of the control project and a second value associated with each of the second plurality of variable identifiers, wherein each of the second plurality of variable identifiers in the memory is statically allocated a memory location. The method also includes comparing the second values to the first values.

Description

technical field

The disclosure relates to programmable logic controllers (PLCs) for controlling machines and systems, in particular to techniques for memory comparisons of a programmable logic controller by generating a first memory dump and a second memory dump at different points in time.

background

Industrial control environments are ubiquitous in modern manufacturing and typically include at least one programmable logic controller (PLC) unit running a control program suitable for controlling an associated machine or facility and/or exchanging instructions and data with the associated machine or facility . The control program running on the programmable logic controller may take the form of ladder logic (also known as ladder logic) instructions or compiled machine code. It is often generated from source code written in a high-level programming language, e.g. B. an object-oriented programming language. The source code can be written by the user in a programming environment that is physically remote from the programmable logic controller and is accessible over a network such as a computer. B. the Internet or a dedicated industrial control network, can be connected to the programmable logic controller.

If a programmable logic controller gets into an unexpected state, for example an exception, then it is customary in the prior art to store a memory dump of the data from the programmable logic controller (so-called “coredump”). Such a memory dump can be triggered by the firmware of the programmable logic control unit, by the user or by the application itself and can be stored either on the programmable logic control unit or on the programming PC of the programming environment.

In addition to the pure data memory, other information can also be saved in the memory dump, for example the current stack, the current program counter, log information or trace buffer, i.e. saved historical data of variables.

Such a memory dump can usually be loaded into a programming system for the source project for interpretation. The variable values are then loaded from the memory dump and presented in the programming system as if the programmer were connected online to the programmable logic controller.

In practice, however, it is often very difficult to correctly interpret the data obtained from the memory dump. Because a large project can easily contain several megabytes of data, and it is then a challenge even for a specialist to identify the data that is the cause of a specific (error) status on the programmable logic controller.

So-called memory profiling tools known from the prior art, such as dotMemory from Jetbrains, or the integrated debugger from Microsoft Visual Studio, offer the user the option of generating and comparing heap dumps. The main purpose is to measure the memory consumption of an application. The user can use it to determine how many objects of a certain class exist at a certain point in time. Typically, the user uses such programs to find out which objects are particularly common and/or which objects are particularly large.

summary

Against the background of the prior art, the object of the present disclosure is to provide improved techniques for analyzing a memory of a programmable logic controller.

This object is achieved by a method for memory comparison of a programmable logic controller according to claim 1 and by a device for memory comparison of a memory program miscible control according to claim 10 solved. The dependent claims relate to advantageous developments.

In a first aspect, the disclosure relates to a method for memory comparison of a programmable logic controller. The method includes generating a first memory dump of a memory of the programmable logic controller, the first memory dump corresponding to a first state of the programmable logic controller at a first point in time, the first memory dump having a first plurality of variable identifiers of a control project for the programmable logic controller and for each of the first said plurality of variable identifiers having an associated first value, each of said first plurality of variable identifiers having a memory location statically allocated in said memory. In addition, the method includes generating a second memory dump of the memory of the programmable logic controller, the second memory dump corresponding to a second state of the programmable logic controller at a second point in time, the second point in time differing from the first point in time, the second memory dump having a second plurality of variable identifiers of the control project and a second value associated with each of the second plurality of variable identifiers, wherein each of the second plurality of variable identifiers in the memory is statically allocated a memory location. The method also includes comparing the second values to the first values.

The method according to the invention makes it possible in a simple and robust manner to form a difference between memory dumps of a memory of the programmable logic control unit. This allows the user to determine the difference between two project states of the control project. For example, the method allows a faulty state to be compared with a reference state, which represents an unproblematic state of the programmable logic controller, or a state of the programmable logic controller after a change or action can be compared with a reference state before the corresponding change or action.

Such a method can also be used for tests in order—possibly also automatically—to check the effects of a program part of a control project and to verify whether the program part only modifies the expected data. Such a comparison can be particularly helpful if unexpected memory locations are modified via a pointer or via an index access in an array. In this way, the user is provided with improved techniques for analyzing a memory of a programmable logic controller.

A control project within the meaning of the disclosure can in particular include a control program for the programmable logic control unit, in particular in the form of source code or in the form of a compiled code. The control project can also include a function block and/or a function and/or global variables and/or local variables.

A variable identifier within the meaning of the disclosure can be any identifier or any identifier that is suitable for designating or identifying a variable of the control project, in particular a variable of a control program of the control project.

According to one embodiment, the first plurality of variable identifiers and/or the second plurality of variable identifiers are or correspond to variables of the control project for the programmable logic controller, in particular variables of a control program and/or a function block and/or a function for the programmable logic controller.

According to an embodiment, the first plurality of variable identifiers and/or the second plurality of variable identifiers are instance paths of variables of the control project or correspond to instance paths of variables of the control project.

In embodiments of the disclosure, the variables of the control project can be program-internal variables of a control program for the programmable logic controller and/or process parameters that are assigned to an industrial process controlled by the programmable logic controller or to a system controlled by the programmable logic controller. The variables can take on any values, for example integer values or real values or truth values.

According to one embodiment, the programmable logic control unit can be communicatively coupled to a controlled system or is coupled and is set up to transmit control commands to the controlled system as a function of a control project, in particular as a function of a control program of the control project, and/or to transmit parameters from the controlled system, which correspond to a state of the controlled system, e.g. process parameters.

In one embodiment, the first plurality of variable identifiers and/or the second plurality of variable identifiers may at least partially correspond to a state of the controlled plant or the parameters.

In some embodiments, the entirety of the process-internal and/or external parameters that characterize the programmable logic control unit and/or the system coupled to the programmable logic control unit at a defined point in time can be referred to as the state of the programmable logic control unit.

According to one embodiment, the second point in time is after the first point in time.

In this way, the solution according to the disclosure allows a representation of a development over time of the memory of the programmable logic control unit.

In one embodiment, the second plurality of variable identifiers may correspond to the first plurality of variable identifiers or may include or be a subset of the first plurality of variable identifiers.

The user can read from this how individual variable identifiers, possibly selected according to predetermined criteria, change or develop.

Within the meaning of the present disclosure, the memory can be any memory element which is set up to temporarily or permanently store the values assigned to the first plurality of variable identifiers and the second plurality of variable identifiers.

The memory can in particular comprise a global memory and/or a stack memory.

The memory may be integrated into the programmable logic controller in some embodiments. In other embodiments, the memory may be located in a separate memory unit that is communicatively coupled to the programmable logic controller but is physically separated from it, for example, located in a programming environment for the programmable logic controller or an external memory bank.

In the context of the present disclosure, a statically allocated memory position can be understood in some embodiments as a memory position of the variable identifiers in the memory that remains constant over time within the control project, i.e. does not change, for example, while a control program of the control project is running. For example, corresponding storage locations in the memory can be permanently assigned by a compiler when the control project is compiled.

A core dump, as used herein, may refer to a set of data read from memory. The memory dump can include raw data and/or post-processed data.

In particular, the generation of the first memory dump and/or the generation of the second memory dump can include post-processing of data read from the memory.

Comparing the second values to the first values may include generating a difference list.

The difference list may include those variable identifiers for which the second value differs from the first value and the corresponding first and second values and/or a difference between the corresponding first and second values.

The method can also include outputting the difference list.

In an embodiment, the method includes displaying a result of the comparison of the second values with the first values, in particular on a visual display.

This enables the user to quickly check deviations in the stored data.

In particular, in some embodiments, displaying the result of the comparison may be limited to variable identifiers where the second value differs from the first value.

The result can be displayed on a visual display of the programmable logic controller and/or on a visual display of a programming environment and/or a visual display spatially separate therefrom.

According to one embodiment, generating the first memory dump includes determining the first plurality of variable identifiers.

Generating the first dump may also include determining the memory locations associated with the first plurality of variable identifiers in memory.

Furthermore, generating the first memory dump can also include reading out the values of the first plurality of variable identifiers at the memory positions associated with the first plurality of variable identifiers in the memory.

Generating the first dump may also include post-processing the values of the first plurality of variable identifiers in some embodiments.

In one embodiment, determining the first plurality of variable identifiers includes selecting a first plurality of variables of the control project, in particular selecting a first plurality of variables from a program code of a control program for the programmable logic controller.

In some embodiments, determining the first plurality of variable identifiers may include creating instance paths associated with a first plurality of variables of the controller project.

In one embodiment, the memory positions assigned to the first plurality of variable identifiers in the memory are determined by means of an assignment table, in particular by means of an assignment table created when the control project is compiled.

In this way, the solution according to the disclosure enables a simple and rapid association between the variable identifiers and their storage positions in the memory.

The assignment table can include the first plurality of variable identifiers or instance paths and memory positions or memory offsets assigned to the first plurality of variable identifiers or instance paths, in particular memory positions or memory offsets uniquely assigned to the first plurality of variable identifiers or instance paths.

Accordingly, generating the second snapshot may include determining the second plurality of variable identifiers.

Generating the second dump may also include determining the memory locations associated with the second plurality of variable identifiers in memory.

According to one embodiment, generating the second memory dump can also include reading out the values of the second plurality of variable identifiers at the memory positions associated with the second plurality of variable identifiers in the memory.

Generating the second dump may also include post-processing the values of the second plurality of variable identifiers in some embodiments.

The determination of the second plurality of variable identifiers can include a selection of a second plurality of variables of the control project, in particular a selection of a second plurality of variables from a program code of a control program for the programmable logic controller.

Determining the second plurality of variable identifiers may include creating instance paths associated with a second plurality of variables of the controller project.

According to one embodiment, the memory positions assigned to the second plurality of variable identifiers in the memory can be determined by means of an assignment table, in particular by means of an assignment table created when the control project is compiled.

The assignment table can include the second plurality of variable identifiers or instance paths and memory positions or memory offsets assigned to the second plurality of variable identifiers or instance paths, in particular memory positions or memory offsets uniquely assigned to the second plurality of variable identifiers or instance paths.

In one embodiment, the method can include running a control program of the control project on the programmable logic controller between the first point in time and the second point in time.

In this way, the solution according to the disclosure makes it possible to monitor changes in the variables when the control program and/or the controlled system coupled to the programmable logic controller are running.

Changes to a control project, in particular changes to a control program of the control project, can optionally also be carried out at runtime on a programmable logic controller. In this context, the solution according to the disclosure can also make it possible to compare a status before a project change with a status after a project change.

According to one embodiment, the method includes modifying the control project, in particular a control program of the control project, in order to obtain a modified control project for the programmable logic control unit between the first point in time and the second point in time.

The method may further comprise running a control program of the control project on the programmable logic controller before the first time and/or running a modified control program of the control project on the programmable logic controller between the first time and the second time.

In particular, the first plurality of variable identifiers may correspond to the controller project and the second plurality of variable identifiers may correspond to the modified controller project.

In some embodiments, the second values can also be compared to the first values in an automated manner, for example in routine tests to check the effects of a program part of the control project.

According to one embodiment, the first point in time and/or the second point in time can therefore be determined automatically.

The method according to the disclosure for memory comparison was described above with reference to the comparison between only two points in time. However, the revelation is not limited thereto, but may comprise a continued comparison of the states of the programmable logic controller over any plurality of consecutive points in time. In this way, time series analyzes or statistical analyzes can be carried out, for example, in order to track and possibly record the development of the state of the stored-program control unit over a longer period of time or under different operating conditions.

In one embodiment, the method therefore includes generating a third memory dump and possibly further subsequent memory dumps of the memory of the programmable logic controller, the third memory dump corresponding to a third state of the programmable logic controller at a third point in time, which differs from the first point in time and the second point in time , in particular after the first point in time and the second point in time, the third memory dump comprising a third plurality of variable identifiers of the control project and an associated third value for each of the third plurality of variable identifiers, with a storage position for each of the third plurality of variable identifiers in the memory is statically allocated.
The embodiment can also include a comparison of the third values with the first values and/or the second values, for example in the form of corresponding difference lists.

Performing a memory comparison over a continued plurality of consecutive points in time is an independent aspect of the present disclosure.

In a second aspect, the disclosure therefore relates to a method for memory comparisons of a programmable logic controller, comprising generating a plurality of memory dumps of a memory of the programmable logic controller at successive points in time, each memory dump corresponding to a corresponding state of the programmable logic controller at the corresponding point in time, wherein each memory snapshot comprises a plurality of variable identifiers of a control project for the programmable logic controller and a value assigned to each of the plurality of variable identifiers, wherein a memory location in the memory is statically allocated to each of the variable identifiers. The method also includes comparing the values corresponding to the successive points in time with one another and/or with predetermined reference values.

The predetermined reference values can be target values, for example, which correspond to a normal state or an error-free state of the programmable logic control unit or of the controlled system coupled to the programmable logic control unit.

The plurality of memory dumps can include any number of memory dumps, in particular at least two memory dumps or at least three memory dumps.

In one embodiment, the method includes allowing a control program of the control project to run on the programmable logic controller between two consecutive points in time.

In one embodiment, the comparison of the values corresponding to the successive points in time can comprise a statistical analysis of the values, in particular a time series analysis.

In one embodiment, the method can also include an (automatic) comparison of difference lists generated at different points in time.

Each of the difference lists can, for example, correspond to a comparison of the state of the programmable logic control unit or of a system controlled by the programmable logic control unit at a fixed point in time with a reference state.

In a third aspect, the disclosure relates to a computer program or a computer program product with computer-readable instructions, the computer-readable instructions being set up to, when executed in a computer, in particular in a computer coupled to a programmable logic controller, a method with one or all of the features described above.

In a fourth aspect, the disclosure relates to an apparatus for memory comparison of a programmable logic controller. The device comprises a readout unit which is set up to access a memory of a programmable logic control unit and to generate a first memory dump at a first point in time and a second memory dump of the memory of the programmable logic control unit at a second point in time, which differs from the first point in time. The first memory dump corresponds to a first state of the programmable logic controller at the first point in time, the first memory dump comprising a first plurality of variable identifiers of a control project for the programmable logic controller and an assigned first value for each of the first plurality of variable identifiers. The second memory dump accordingly corresponds to a second state of the programmable logic controller at the second point in time, the second memory dump comprising a second plurality of variable identifiers of the control project and a second value assigned to each of the second plurality of variable identifiers. Each of the first plurality of variable identifiers and the second plurality of variable identifiers has a memory location statically allocated in memory. The device also includes a comparison unit, which is set up to compare the second values with the first values.

The device according to the disclosure according to the fourth aspect can be configured to carry out a method with one or all of the features as described above with reference to the first and second aspects.

In one embodiment, the readout unit and the comparison unit are designed as separate, spatially and/or functionally separate units. In other embodiments, the readout unit and the comparison unit can be designed as an integrated unit.

According to one embodiment, the readout unit and/or the comparison unit can be integrated into the programmable logic control unit. In other embodiments, the readout unit and/or the comparison unit can be integrated into a programming unit which is communicatively coupled to the programmable logic controller.

In one embodiment, the device comprises a display unit which is set up to display a result of the comparison of the second values with the first values.

In one embodiment, the display unit can be separated spatially and/or functionally from the readout unit and/or the comparison unit. In other embodiments, however, the display unit can be integrated into the readout unit and/or the comparison unit.

According to one embodiment, the display unit is integrated into the programmable logic control unit. In other embodiments, the display unit can be integrated into a programming unit, which is communicatively coupled to the programmable logic controller.

In one embodiment, the readout unit and/or the comparison unit and/or the display unit can be embodied as hardware. In another embodiment, the readout unit and/or the comparison unit and/or the display unit can be designed at least partially as software or firmware.

According to one embodiment, the readout unit is set up to determine the first plurality of variable identifiers and/or to determine the memory positions associated with the first plurality of variable identifiers in the memory and/or to read out the values of the first plurality of variable identifiers at the first plurality of variable identifiers in memory locations associated with the memory.

In one development, determining the first plurality of variable identifiers can include selecting a first plurality of variables of the control project, in particular selecting a first plurality of variables from a program code of a control program for the programmable logic controller.

In one development, the determination of the first plurality of variable identifiers can include the creation of instance paths that are assigned to a first plurality of variables of the control project.

Accordingly, according to one embodiment, the readout unit can be used to determine the second plurality of variable identifiers and/or to determine the memory positions associated with the second plurality of variable identifiers in the memory and/or to read out the values of the second plurality of variable identifiers at the second plurality of variable identifiers in memory locations associated with the memory.

According to one embodiment, the determination of the second plurality of variable identifiers can include a selection of a second plurality of variables of the control project, in particular a selection of a second plurality of variables from a program code of a control program for the programmable logic controller.

Determining the second plurality of variable identifiers may include creating instance paths associated with a second plurality of variables of the controller project.

According to one embodiment, the memory positions assigned to the first plurality of variable identifiers in the memory are determined by means of an assignment table, in particular by means of an assignment table created when the control project is compiled.

According to a fifth aspect, the disclosure relates to a device for memory comparisons of a programmable logic controller, comprising a readout unit which is set up to access a memory of a programmable logic controller and to generate a plurality of memory dumps of a memory of the programmable logic controller at successive points in time, wherein each memory snapshot corresponds to a corresponding state of the programmable logic controller at the corresponding point in time. In this case, each memory dump comprises a plurality of variable identifiers of a control project for the programmable logic controller and a value assigned to each of the plurality of variable identifiers. Each of the variable identifiers has a memory location statically allocated in memory. The device also includes a comparison unit, which is set up to compare the values corresponding to the successive points in time with one another and/or with predetermined reference values.

character list

• 1 in schematischer Darstellung eine Steuerungsumgebung zeigt, in der ein Verfahren und eine Vorrichtung zum Speichervergleichen gemäß einer Ausführungsform eingesetzt werden können;
• 2 in schematischer Darstellung eine Vorrichtung zum Speichervergleichen gemäß einer Ausführungsform zeigt; und
• 3 ein Flussdiagramm eines Verfahrens zum Speichervergleichen gemäß einer Ausführungsform zeigt.

The characteristics and numerous advantages of the solution according to the invention can best be understood by reading a detailed description of preferred embodiments with reference to the attached drawings, in which:

• 1 12 shows a schematic representation of a control environment in which a method and apparatus for memory comparisons according to an embodiment may be employed;
• 2 FIG. 12 shows a schematic representation of an apparatus for memory comparison according to an embodiment; FIG. and
• 3 12 shows a flow diagram of a method for memory comparison according to an embodiment.

Detailed description

Examples of a method and apparatus for memory comparison of a programmable logic controller are described below with reference to an exemplary industrial control environment 10 involving the control of a gantry crane 12 using programmable logic controller software. However, this example is for illustrative purposes only, and in general, the techniques of the present disclosure may be used to control any type of process, including but not limited to the control of industrial machinery, robotics, chemical manufacturing processes, or lighting control applications.

As in 1 1, the industrial control environment 10 of the exemplary embodiment includes a gantry crane 12, which may be a crane used in a factory environment to move heavy goods in an assembly shop by means of a moveable hook assembly 14, the actuators of which are controlled by control software to be controlled.

The industrial control environment 10 also includes a programmable logic controller (PLC) 16 connected to the gantry crane 12 via a control line 18, z. B. a wired or wireless connection, connected. In other examples, the programmable logic controller 16 may be integrated into the controlled machine, such as the gantry crane 12 .

The programmable logic controller unit 16 may include a processing unit 20, such as. a CPU, to execute an industrial control program of a control project, e.g. B. in the form of a compiled program for controlling the hook assembly 14 of the gantry crane 12. For this purpose, the programmable logic controller 16 includes a communication interface 22 which is connected to the processing unit 20 and is suitable for communicating with the gantry crane 12 via the control line 18 . For example, the processing unit 20 may instruct the gantry crane 12 to operate the actuators to move the hook assembly 14 along a predetermined path, which instructions may be provided via the communications interface 22 and the control line 18 . The communication interface 22 can also receive sensor signals that relate to an operation of the gantry crane 12 via the control line 18 and provide corresponding feedback to the processing unit 20 . Such sensor signals may relate to sensors that indicate a position of the hook assembly 14 on the gantry crane 12, for example.

As in 1 As further illustrated, the programmable logic controller unit 16 also includes a memory unit 24 which is connected to the processing unit 20 . In particular, the memory unit 24 can include an assigned or allocated data area in order to store programs, function blocks, functions, data or data structures of the control project that are necessary for operating the industrial control unit 16 or the gantry crane 12 . Furthermore, the data area can also include sensor data provided by the gantry crane 12 via the control line 18 , for example sensor data which relate to a measured position of the hook assembly 14 of the gantry crane 12 controlled by the control program. In particular, the storage positions of these objects in the storage unit 24 can be allocated statically, so that the storage positions do not change during the execution of the control program in the processing unit 20 and possibly also do not change when the control project is modified.

1 Figure 12 shows memory unit 24 as a monolithic memory block. In other embodiments, storage unit 24 may be distributed across multiple storage blocks in different storage locations.

The industrial control environment 10 may further include a programming environment 26 that communicates with the communications interface 22 of the programmable logic controller 16 over a network 28, such as. B. a factory intranet or the Internet is connected. Programming environment 26 may include, for example, a desktop PC or other computing device, and may be used by a programmer to design and generate industrial control software, e.g., in the form of a high-level control program such as C, C++, or C#.

The programming environment 26 can in particular include a programming interface 30 such. B. a programming editor or a graphical editor that allows a programmer to create a control project for the programmable logic controller unit 16, wherein the control project can be, for example, a control project according to the industry standard 61131-3 and in particular a control program in a high-level programming language, global variables, Function blocks and functions with local variables. The programming environment 26 may further include a programming memory unit 32 and a programming processor unit 34 coupled to the programming interface 30 . The programming storage unit 32 can store functions, function blocks or variables that can be used by the programmer when creating the control project. The programming processor unit 34 may provide the processing resources to operate the programming interface 30 and create the controller project.

In some embodiments, the programming environment 26 may additionally include a compiler unit 36 that may convert the control project including the high-level language control program into a compiled machine code control program. The compiled control program may then be made available to the programmable logic controller 16 over the network 28 and may be stored on the storage unit 24 and executed on the processing unit 22 to control the operation of the gantry crane 12 .

In other embodiments, the programming environment 26 provides the programmable logic controller 16 with the controller project including the controller program in the programmer high-level language is available over the network 28, and the programmable logic controller 16 includes a compiler unit (not shown) that compiles the control project into machine code.

In particular, compiler unit 36 can be set up to statically define the memory positions or memory addresses of the objects and variables of the control project during compilation, for example in the form of memory offsets with respect to an original address of memory unit 24.

With further reference to the 1 and 2 The industrial control environment 10 also includes a memory comparison device 38 with a readout unit 40 and a comparison unit 42.

The readout unit 40 is communicatively coupled to the memory unit 24 and set up to access the memory unit 24 and at a first point in time a first memory dump and at a second point in time, which differs from the first point in time, a second memory dump of the memory unit 24 of the programmable logic controller 16 to generate. The first memory dump corresponds to a first state of the programmable logic controller 16 at the first point in time, the first memory dump comprising a first plurality of variable identifiers of the control project for the programmable logic controller 16 and an associated first value for each of the first plurality of variable identifiers. Correspondingly, the second memory dump can correspond to a second state of the programmable logic controller 16 at the second point in time, the second memory dump comprising a second plurality of variable identifiers of the control project and an associated second value for each of the second plurality of variable identifiers. A memory location is statically allocated in memory unit 24 to each of the first plurality of variable identifiers and the second plurality of variable identifiers.

The respective memory dump can include, for example, all variables of the control project together with the parameter values or sensor values assigned to them, as they are stored in the allocated data area of the memory unit 24 at the corresponding first point in time or second point in time.

Comparison unit 42 is communicatively coupled to readout unit 40 and set up to compare the second values with the first values, for example to identify possible deviations between the corresponding parameter values or sensor values between the first point in time, which can represent a reference point in time, and a point in time after the first point in time lying second point in time, in which the programmable logic controller 16 has changed its state compared to the reference point in time, systematically.

In this way, the technology according to the disclosure makes it possible to combine a first project status with a first memory dump, to combine a second project status with a second memory dump and to generate a difference list from these two statuses. This difference list can then be presented to the user or interpreted automatically.

For example, the first state at the reference time can relate to an unproblematic situation in the programmable logic controller 16, while the second state relates to an incorrect state after an action has been carried out. The difference list can help the user or programmer to understand and eliminate the error.

The comparison unit 42 can process the comparison results locally at the industrial control unit 16 or display them locally there. In other embodiments, the comparison unit 42 can be coupled to the network 28 via the communication interface 22 in order to provide the results of the comparison to a user via the network 28, for example for display and/or further processing in the programming environment 26.

In some embodiments, memory compare device 38, as shown in FIG 2 shown, comprise a display unit 44 which is arranged to display the result of the comparison of the second values with the first values. The display unit 44 can be arranged both locally in or on the programmable logic controller 16 and also spatially separate from it, for example arranged in or on the programming environment 26 .

the 1 and 2 show the readout unit 40, the comparison unit 42 and the display unit 44 as separate, communicatively coupled units. This representation is only an example. In other Embodiments, two or more of these units 40, 42, 44 can be integrated with each other. In addition, each of these units 40, 42, 44 can be implemented as hardware, software or firmware.

3 FIG. 12 illustrates a memory comparison method according to the disclosure using a flowchart. In a first step S10, a first memory dump of a memory of the programmable logic control unit is generated, the first memory dump corresponding to a first state of the programmable logic control unit at a first point in time. The first memory snapshot comprises a first plurality of variable identifiers of a control project for the programmable logic controller and a first value assigned to each of the first plurality of variable identifiers, a memory position being statically allocated to each of the first plurality of variable identifiers in the memory.

In a second step S12, which can be subordinate to the first step S10, a second memory dump of the memory of the programmable logic control unit is generated, the second memory dump corresponding to a second state of the programmable logic control unit at a second point in time, the second point in time being different from the first timing differs. The second memory dump includes a second plurality of variable identifiers of the control project and a second value associated with each of the second plurality of variable identifiers, wherein a memory location is statically allocated to each of the second plurality of variable identifiers in the memory.

In a third step S14, which can follow the second step S12, the second values are compared with the first values.

In some embodiments, the method can run automatically, in particular controlled by computer-readable instructions that are executed on a computer coupled to the programmable logic controller 16 , for example on the processing unit 20 or the programming processor unit 34 .

The techniques of the method according to the disclosure are illustrated below using a concrete example for a control program based on the widespread industry standard 61131-3. This standard defines global variables as well as programs, function blocks, and functions with local variables. In addition, the 3rd edition of the standard introduces methods for function blocks that behave like functions with a special input (the THIS pointer to the function block instance). Typically, global variables and variables in programs are allocated globally in memory, such as memory unit 24 . Function blocks are comparable to a class in other programming languages like Java or C#. Function blocks cannot be used directly, but instances of function blocks are created. Such an instance is a variable of the function block type, and the variable in turn can be declared anywhere, i.e. in a program, as a global variable or in another function block. Functions and methods themselves do not hold any states between two calls. Typically, variables are only valid during the call and are created on the stack. As previously stated, the variables within a function block are typically assigned a local offset that is the same for the same variable in each instance of the function block.

The global variables are all allocated to one or more memory areas of memory unit 24 . In this case, the compiler, for example the compiler unit 36, usually assumes 0 as the start address of the memory areas during compilation. During compilation, the compiler then generates relocation information for each access in the code to such an address. This relocation information is loaded onto the controller with the program, and access in the code is adapted there to the real address.

               PROGRAM PLC_PRG
               VAR
                   test1 : DINT := 0;
                   inst1 : FB;
                   inst2 : FB;
               END_VAR
                     inst1(in1 := 3, in2 := 9, out1 => test1);
                     inst2(in1 := 0, in2 := 8, out1 => g_test);
               END_PROGRAM
               VAR_GLOBAL
                    g dummy : DINT := 99;
                    g_arr : ARRAY [1..5] OF DINT := [11, 22, 33, 44, 55];
                    g_test : DINT;
               END_VAR
               FUNCTION FUN : DINT
               VAR_INPUT
                     in : DINT;

                    wert : DINT;
               END_VAR
               FUN := g_arr[in];
               g arr[in] := wert;
               END_FUN
               FUNCTION_BLOCK FB
               VAR_INPUT
                     in1 : DINT;
                     in2 : DINT;
               END_VAR
               VAR_OUTPUT
                    out1 : DINT;
               END_VAR
               out1 := FUN(in1, in2);
               END_FUNCTION_BLOCK

To illustrate the method according to the disclosure, let's assume a small example project that the user creates in the programming environment 26 and that contains a function block (FUNCTION_BLOCK) with local variables (in1, in2, out1), a program (PROGRAM) with local variables (test1 , inst1, inst2), a function (FUNCTION) with local variables (in, value) and two global variables (VAR_GLOBAL):

 PROGRAM PLC_PRG
               VAR
test1 : DINT := 0;
                   inst1 : FB;
                   inst2 : FB;
               END_VAR
                     inst1(in1 := 3, in2 := 9, out1 =>test1);
                     inst2(in1 := 0, in2 := 8, out1 =>g_test);
               END_PROGRAM
               VAR_GLOBAL
                    g dummy : DINT := 99;
                    g_arr : ARRAY [1..5] OF DINT := [11, 22, 33, 44, 55];
                    g_test : DINT;
               END_VAR
               FUNCTION FUN : DINT
               VAR_INPUT
                     in : DINT;

                    value : DINT;
               END_VAR
               FUN := g_arr[in];
               garr[in] := value;
               END_FUN
               FUNCTION_BLOCK FB
               VAR_INPUT
                     in1 : DINT;
                     in2 : DINT;
               END_VAR
               VAR_OUTPUT
                    out1 : DINT;
               END_VAR
               out1 := FUN(in1, in2);
               END_FUNCTION_BLOCK

The project serves as an illustration and contains a serious programming error that leads to an unexpected change in the variable g_dummy when the program is run and which the techniques presented here can make it easier to find.

For example, the compiler unit 36 can assign the following addresses for the variables in this project: Table 1: Offset table for the variables of a program variable offset Size (32 bit integer) location PLC_PRG.test1 0 4 global PLC_PRG.inst1 4 12 global PLC_PRG.inst2 16 12 global g_dummy 28 4 global g_arr 32 20 global g_test 52 4 global FUN.in 0 4 Locally in Fun (on Stack) FUN.value 4 4 Locally in Fun (on Stack) FUN.FUN (implicit for return) 8th 4 Locally in Fun (on Stack) FB.ini 0 4 Local in FB (like instance) FB.in2 4 4 Local in FB (like instance) FB.out 8th 4 Local in FB (like instance)

During translation, compiler unit 36 generates the executable code, transmits this offset table together with the generated machine code via network 28 to stored-program control unit 16, and stores the offset table in memory unit 24 as additional information about the generated machine code.

The offset table makes it possible to determine the associated variable values from a memory dump of the memory unit 24 . In the following, we refer to an access to a variable within an instance as the instance path to the variable and use the "." notation of the industry standard IEC 61131 for component access, for example PLC_PRG.inst2.in2. In principle, an instance path can be as deep as you like.

 public string GetInstancePathForAddress(int nOffset)
 {
    return GetInstancePathForAddress(nOffset, globalvariables, "");
 }

  
 private string GetInstancePathForAddress(int nOffset, VariableList
 variables, string stInstancepathIn)
 {
    foreach (Variable var in variables)
    {
        if (var.Offset <= nOffset && var.Offset + var.Size >
 nOffset)
        {
          stInstancepath = stInstancepathIn.Empty ? var.Name :
 stInstancepath + "." + var.Name;
          if (IsStructuredType(var.Type))
          {
            GetInstancePathForAddress(nOffset - var.Offset,
 GetVariableList(var.Type) );
          }
        }
    }
      return "";
 }

To get to the memory location from this instance path, it is sufficient to add the offsets of the individual components according to the offset table. In the PLC_PRG.inst2.in2 example, the result is 20. Conversely, a memory location in the memory unit 24 can be used to easily deduce the instance path that is at this location. For example, the following algorithm can be used in C# code:

 public string GetInstancePathForAddress(int nOffset)
 {
    return GetInstancePathForAddress(nOffset, globalvariables, "");
 }

  
 private string GetInstancePathForAddress(int nOffset, VariableList
 variables, string stInstancepathIn)
 {
    foreach (variable var in variables)
    {
        if (var.Offset <= nOffset && var.Offset + var.Size >
 n offset)
        {
          stInstancepath = stInstancepathIn.Empty ? var.Name :
 stInstancepath + "." + var.name;
          if (IsStructuredType(var.Type))
          {
            GetInstancePathForAddress(nOffset - var.Offset,
 GetVariableList(var.Type) );
          }
        }
    }
      return "";
 }

This assignment also works correspondingly for variables on the stack. Each stack frame can be viewed as a separate variable space.

For example, for purposes of the present disclosure, a core dump may be thought of as a plurality of lists of bytes, where one list corresponds to global memory and another list is provided for each function in the call stack.

A complete table of all instance paths can be generated from the memory dump and the matching offset table with the generated variable offsets of the associated source code program. In the example discussed above, you could set a breakpoint at the call of inst2 in the PLC_PRG program and create a memory dump if processing stops at this point stays. There are no stack variables at this point, so the global memory is sufficient for our consideration.

For better readability, we assume the memory is sorted in Big Endian mode and display it 4-byte by 4 bytes. The following memory should be loaded: Table 2: Sample memory dump of an application's heap memory offset value 0 0x00000021 4 0x00000003 8th 0x00000009 12 0x00000021 16 0x00000000 20 0x00000000 24 0x00000000 28 0x00000063 32 0x0000000B 36 0x00000016 40 0x00000009 44 0x0000002C 48 0x00000037 52 0x00000000

In turn, a table of all instance paths in the global memory of the application can be generated from Table 1 by opening all instances completely. In addition, a memory area according to Table 2 can be assigned to each of these instance paths. If one interprets the content of the memory according to the type of the instance path (here all types are DINT), then from the memory dump at the first time t ₁ one gets a table with values for each global instance path in the program: Table 3: first table from memory dump for the comparison instance path offset value t ₁ PLC_PRG.test1 0 33 PLC_PRG.inst1.in1 4 3 PLC_PRG.inst1.in2 8th 9 PLC_PRG.insti.out 12 33 PLC_PRG.inst2.in1 16 0 PLC_PRG.inst2.in2 20 0 PLC_PRG.inst2.out 24 0 g_dummy 28 99 g_arr[1] 32 11 g_arr[2] 36 22 g_arr[3] 40 9 g_arr[4] 44 44 g_arr[5] 48 55 g_test 52 0

We can now create a second table of values from a corresponding dump at a later time t ₂ > t ₁ and take the difference between the two tables to determine and analyze the differences. In our example, we carry out a single step by calling inst2 in PLC_PRG so that processing stops at the end of the program, and repeat the steps described above for creating Table 3. Table 4 results: Table 4: second table from memory dump for comparison instance path offset value t ₂ PLC_PRG.test1 0 33 PLC_PRG.inst1.in1 4 3 PLC_PRG.inst1.in2 8th 9 PLC_PRG.insti.out 12 33 PLC_PRG.inst2.in1 16 0 PLC_PRG.inst2.in2 20 8th PLC_PRG.inst2.out 24 99 g_dummy 28 8th g_arr[1] 32 11 g_arr[2] 36 22 g_arr[3] 40 9 g_arr[4] 44 44 g_arr[5] 48 55 g_test 52 99

A difference list can now be created from these two tables by comparing the first values with the second values: Table 5: Difference list of two memory dumps instance path Old value t ₁ New value t ₂ Type of Change PLC_PRG.inst2.in2 0 8th value PLC_PRG.inst2.out 0 99 value g_dummy 99 8th value g_test 0 99 value

From this list of differences according to Table 5, the programmer can recognize the presumably unexpected change in the g_dummy variable much more quickly. Without comparing the memory dumps, this change would probably remain undetected until the variable itself is used again somewhere.

The example performed here represents a special case in which all variables retain their storage space. In general, one can imagine the procedure for project statuses that have changed to a greater or lesser extent. In the event of changes in the project, the compiler unit 36 will typically place unchanged variables in the same position in the memory unit 24. New variables are placed in new memory locations, while deleted variables free up memory. This can also lead to unused gaps in memory. Incorrectly used array accesses or pointer accesses can also result in changes in unused memory that cannot be assigned to an instance path.

1. 1. Ein Wert an einer Speicherstelle wurde geändert.
2. 2. Ein Instanzpfad wurde hinzugefügt.
3. 3. Ein Instanzpfad wurde gelöscht.
4. 4. Ein Instanzpfad wurde im Speicher verschoben mit Wertänderung.
5. 5. Ein Instanzpfad wurde im Speicher verschoben ohne Wertänderung.

The difference list according to Table 5 can therefore contain changes of the following type, for example:

1. 1. A value at a location has been changed.
2. 2. Added an instance path.
3. 3. An instance path has been deleted.
4. 4. An instance path was moved in memory with value change.
5. 5. An instance path was moved in memory with no value change.

1. a) Ein Wert hat sich geändert und liegt in einem neu hinzugefügten Instanzpfad.
2. b) Ein Wert hat sich geändert und liegt in einem gelöschten Instanzpfad.
3. c) Ein Wert hat sich geändert und liegt in zwei unterschiedlichen Instanzpfaden.
4. d) Ein Wert hat sich geändert bei gleichbleibendem Instanzpfad.
5. e) Ein Wert hat sich in einem Speicher ohne zugehörigen Instanzpfad geändert.

Change 1 can be combined with other changes:

1. a) A value has changed and is in a newly added instance path.
2. b) A value has changed and is in a deleted instance path.
3. c) A value has changed and is in two different instance paths.
4. d) A value has changed while the instance path remains the same.
5. e) A value has changed in a memory without an associated instance path.

The changes a), b) and c) can be detected using the method described above, but are probably not relevant for many practical applications: If an instance path changes, then a value change is also to be expected. It can therefore be useful in some applications to delete these changes from the difference list according to Table 5 or to filter the table accordingly for the user. The resulting list of changes can be presented to the user in a suitable manner, for example as a simple table on the display unit 44 on the programmable logic controller unit 16 and/or on the programming environment 26. In addition, for some applications it can be useful to enter changed variables directly in the debugging environment of the programming interface 30 optically, for example with a suitable color, and to display the changed values directly as a value pair or to output them at the request of the programmer.

In the same way as shown here, variables on the stack can also be compared, especially if the call stack is the same in both dumps, for example if the same functions are called.

The methods and devices presented can also be used for (statistical) analyzes or tests of the functioning of the programmable logic control unit 16 or the system controlled by the programmable logic control unit 16, for example the gantry crane 12.

Machine controls by programmable logic controllers 16 run cyclically in many applications that are important in practice. Empirically valuable data can be obtained through the above-described differential analysis by means of dumps taken at a suitable point in such a cyclic sequence.

• • Hat der Datenpunkt zu diesem vorgegebenen Zeitpunkt immer den gleichen Wert?
• • Wenn sich die Werte des Datenpunkts ändern: Wie sind diese Werte verteilt? Gibt es bspw. eine Normalverteilung der Werte um einen Mittelwert?

For this purpose, for example, in embodiments, a memory dump can always be triggered automatically by the memory comparison device 38 at a predetermined point in time in the machine cycle, this memory dump can be compared with a first reference memory dump and the difference list generated according to the method described above can be saved according to Table 5. A large number of such difference lists can be obtained in a corresponding manner during a reference operation of the machine. These difference lists can now be examined for their properties for each data point, e.g.:

• • Does the data point always have the same value at this specified point in time?
• • If the values of the data point change: How are these values distributed? For example, is there a normal distribution of the values around a mean?

If a data point has one of the two properties, then a rule can be generated for this data point, which can be used later to check whether this property still applies during further operation of the programmable logic controller 16 or the system controlled by the programmable logic controller 16.

• • Hat ein Datum, das sich bisher nie geändert hatte, auf einmal einen neuen Wert?
• • Liegt ein Datum, das in einem bestimmten Bereich liegen sollte, deutlich außerhalb dieses Bereichs?
• • Hat sich über einen gewissen Zeitraum die Normalverteilung der Werte eines Datums deutlich verschoben?

Other properties to be checked can be:

• • Does a date that has never changed suddenly have a new value?
• • Is a date that should be in a certain range significantly outside of that range?
• • Has the normal distribution of the values of a date shifted significantly over a certain period of time?

For example, these rules may be generated in a human-readable form so that a user can review these rules. For example, it would be possible that the reference operation for obtaining the rules is always carried out during the night shift, so that the system uses this to generate a rule for the time that would not make sense.

During the normal operating phase of the machine, the memory comparison device 38 can then use these rules to monitor the correct operation of the programmable logic controller 16. If a rule is violated, for example, a warning can be issued. The system operator can then check whether violation of the rule can result in damage to the controlled system, for example to the gantry crane 12, and, if necessary, shut down the system and examine it more closely.

In this way, for example, signs of wear on moving parts of the system could be detected much earlier in the sense of what is known as “predictive maintenance”. In particular, malfunctions in a system can already be detected before the system can be damaged.

It is also to be expected that just by analyzing such rule sets, helpful insights into the properties of the system can be gained. If, for example, a control project contains code that is never executed and thus generates data that never changes, then this could be recognized by the rule sets obtained and the control project revised accordingly.

Furthermore, the information obtained with the method according to the disclosure can be used to verify tests. For this purpose, the memory unit 24 can be compared, for example, using memory dumps before and after a functional test, in order to check the effects of a tested functionality.

For this purpose, the tester creates, for example, the first memory dump before a test and the second memory dump after the test has been carried out. From the two memory dumps, he then creates the difference list described above in accordance with Table 5 and checks whether the test had the desired effects.

He can also save the difference list for his test. Further executions of the test could then be automated, with a memory dump being automatically generated before the test, the test being executed and a memory dump being automatically generated after the test. The difference list is then automatically generated from the two memory dumps and compared with the difference list of the test. The test fails if the difference list is not identical to the original difference list. In such a case, the tester can be informed by issuing a warning signal and can manually check the test that has been carried out.

The embodiments described above and the drawings only serve to explain the solution according to the invention and the advantages that can be achieved with the solution according to the invention, but are not intended to limit the invention. The scope of protection results from the appended claims.

Reference List

10

industrial control environment

12

gantry crane

14

Gantry crane hook assembly 12

16

programmable logic controller

18

control line

20

processing unit

22

communication interface

24

storage unit

26

programming environment

28

network

30

programming interface

32

programming memory unit

34

programming processor unit

36

compiler unit

38

memory compare device

40

readout unit

42

comparison unit

44

display unit

Claims (15)

A method for memory comparing a programmable logic controller (16), comprising: Generating a first memory dump of a memory (24) of the programmable logic controller (16), the first memory dump corresponding to a first state of the programmable logic controller (16) at a first point in time, the first memory dump having a first plurality of variable identifiers of a control project for the programmable logic controller (16) and each of said first plurality of variable identifiers has an associated first value, each of said first plurality of variable identifiers having a memory location statically allocated in said memory (24); Generating a second memory dump of the memory (24) of the programmable logic controller (16), the second memory dump corresponding to a second state of the programmable logic controller (16) at a second point in time, the second point in time differing from the first point in time, the second memory dump a second plurality of variable identifiers of the control project and a second value associated with each of the second plurality of variable identifiers, each of the second plurality of variable identifiers having a memory location statically allocated in the memory (24); and Compare the second values with the first values. procedure after claim 1 , further comprising: displaying a result of the comparison of the second values with the first values, in particular on a visual display (44). A method according to any one of the preceding claims, wherein generating the first memory dump comprises: determining the first plurality of variable identifiers; determining the storage locations associated with the first plurality of variable identifiers in the memory (24); and reading out the values of the first plurality of variable identifiers at the memory locations associated with the first plurality of variable identifiers in the memory (24). procedure after claim 3 , wherein the determination of the first plurality of variable identifiers comprises a selection of a first plurality of variables of the control project, in particular a selection of a first plurality of variables from a program code of a control program for the programmable logic controller (16). procedure after claim 3 or 4 , wherein determining the first plurality of variable identifiers comprises creating instance paths associated with a first plurality of variables of the controller project. Procedure according to one of claims 3 until 5 , wherein determining the storage positions associated with the first plurality of variable identifiers in the memory (24) by means of an allocation key Belle takes place, in particular by means of an assignment table created when compiling the control project. A method according to any one of the preceding claims, comprising: Modifying the control project, in particular a control program of the control project, in order to obtain a modified control project for the programmable logic controller (16), between the first point in time and the second point in time. A method according to any one of the preceding claims, comprising: Generating a third memory dump and possibly further subsequent memory dumps of the memory (24) of the programmable logic controller (16), the third memory dump corresponding to a third state of the programmable logic controller (16) at a third point in time, which differs from the first point in time and the second Time differs, wherein the third memory dump comprises a third plurality of variable identifiers of the control project and an associated third value for each of the third plurality of variable identifiers, wherein a memory position is statically allocated to each of the third plurality of variable identifiers in the memory (24); and Comparing the third values with the first values and/or the second values. Computer program with computer-readable instructions, the computer-readable instructions being set up to execute a method according to one of the preceding claims when executed in a computer (20, 34), in particular in a computer (20, 34) coupled to a programmable logic controller (16). . Apparatus (38) for memory comparison of a programmable logic controller (16), comprising: a readout unit (40), which is set up to access a memory (24) of a programmable logic controller (16) and at a first point in time a first memory dump and at a second point in time, which differs from the first point in time, a second memory dump of to generate memory (24) of the programmable logic controller unit (16); wherein the first memory dump corresponds to a first state of the programmable logic controller (16) at the first point in time, wherein the first memory dump comprises a first plurality of variable identifiers of a control project for the programmable logic controller (16) and an associated first value for each of the first plurality of variable identifiers ; wherein the second memory dump corresponds to a second state of the programmable logic controller (16) at the second time, wherein the second memory dump comprises a second plurality of variable identifiers of the control project and a second value associated with each of the second plurality of variable identifiers; and each of said first plurality of variable identifiers and said second plurality of variable identifiers having a memory location statically allocated in said memory (24); and a comparison unit (42) which is set up to compare the second values with the first values. Device (38) after claim 10 comprising: a display unit (44) arranged to display a result of comparing the second values with the first values. Device (38) after claim 10 or 11 , wherein the readout unit (40) is set up to determine the first plurality of variable identifiers; for determining the storage locations associated with the first plurality of variable identifiers in the memory (24); and for reading out the values of the first plurality of variable identifiers in the memory locations associated with the first plurality of variable identifiers in the memory (24). Device (38) after claim 12 , wherein the determination of the first plurality of variable identifiers comprises a selection of a first plurality of variables of the control project, in particular a selection of a first plurality of variables from a program code of a control program for the programmable logic controller (16). Device (38) after claim 12 or 13 , wherein determining the first plurality of variable identifiers comprises creating instance paths associated with a first plurality of variables of the controller project. Device (38) according to one of Claims 12 until 14 , wherein the determination of the memory positions assigned to the first plurality of variable identifiers in the memory (24) takes place by means of an assignment table, in particular by means of an assignment table created when the control project is compiled.

Images