Classifications

• • G—PHYSICS
  • G05—CONTROLLING; REGULATING
  • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
  • G05B19/00—Programme-control systems
  • G05B19/02—Programme-control systems electric
  • G05B19/04—Programme control other than numerical control, i.e. in sequence controllers or logic controllers
  • G05B19/042—Programme control other than numerical control, i.e. in sequence controllers or logic controllers using digital processors
  • G05B19/0423—Input/output
  • G05B19/0425—Safety, monitoring
• • G—PHYSICS
  • G05—CONTROLLING; REGULATING
  • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
  • G05B2219/00—Program-control systems
  • G05B2219/20—Pc systems
  • G05B2219/25—Pc structure of the system
  • G05B2219/25428—Field device

Definitions

• the present application relates to a field device according to the preamble of claim 1, a modular field device concept according to the preamble of claim 14 and a method for operating a field device with the features of the preamble of claim 15.
• field device subsumes various technical facilities that are directly related to a production process. Field devices can thus in particular be actuators, sensors and measuring transducers and / or evaluation devices.
• Field devices with a modular structure which are assembled from a modular field device concept, are also known from the prior art.
• a modular field device concept it is possible to select from a plurality of combinable sensors, housings, electronic units or electronic modules and operating and / or display units, which are each coordinated with one another, and a corresponding field device can be constructed.
• Such a modular field device concept is offered, for example, by the company Vega Grieshaber KG.
• a sensor, a corresponding electronics module that contains the field device electronics, ie in particular measured value processing and an interface to a controller and possibly a fieldbus used, as well as various display and / or operating units can usually be combined.
• the sensors, electronic modules and displays and / or operating units are adapted to one another and to various available housings.
• a further area of application results from the recently available autarkic field devices, in particular autarkic sensors.
• Sensors i.e. field devices from this product family, are particularly easy to assemble without attaching a communication or supply line.
• the measured values determined by these field devices are typically transferred to a cloud, ie to one, using narrowband radio technology (LoRa, Sigfox, NB-IOT) Server broadcast on the World Wide Web.
• Typical application scenarios for such field devices include areas such as flood forecasting, inventory management or other decentralized measurement tasks. Due to the direct connection to the World Wide Web, such field devices are inherently exposed to a permanent threat from hacker attacks from the network.
• Modular field devices are highly flexible in their application and configuration and can be adapted to a large number of application scenarios.
• the problem arises that a previously defined composition of a modular field device must not be easily changed, be it for reasons of special coordination or configuration for a monitored process, for reasons of IT security, for protection within the company Know-how or for theft protection.
• a field device according to the invention with an electronics module with field device electronics and at least one expansion module is characterized in that the electronics module and / or the field device is persistently connected to at least one expansion module.
• the field device according to the invention is modular with at least one electronics module with the field device electronics and at least one expansion module, the field device electronics, which for the sake of simplicity is also referred to as electronics module, is persistently connected to the at least one expansion module.
• persistent means “cannot be changed in an uncontrolled manner”, which means in particular that a change is either prevented or at least made more difficult and registered.
• the electronics module and / or the field device and the expansion module are persistently connected, that the field device electronics and the expansion module and / or the field device and the expansion module cannot be separated from one another in an uncontrolled manner. In this way it is ensured that a configuration made up of electronics module and expansion module cannot be changed or at least not changed unnoticed. This protects the predetermined configuration from unauthorized changes and it can be ensured that no unauthorized interventions take place.
• a persistent connection can be established, for example, in that the electronics module and / or the field device is mechanically persistently connected to the expansion module.
• a mechanically persistent connection can be achieved by mechanically latching the expansion module to the electronics module and / or in a housing of the field device, for example by suitably arranged locking latches.
• a mechanically persistent connection can be achieved by gluing, for example by means of an adhesive ring, which, when the expansion module is fully and correctly installed glued to the electronics module and / or the housing of the field device can be achieved.
• a mechanically persistent, ie irreversible, connection can, for example, be designed as an irreversible snap-in connection and / or an irreversible screw connection and / or an irreversible adhesive connection and / or comprise an irreversible barrier.
• An irreversible barrier can e.g. B. be a housing cover that closes a housing chamber in which the expansion module is arranged, irreversibly.
• an original housing cover can be exchanged and replaced with a self-locking cover.
• a self-locking lid can, for example, have latching hooks or the like that prevent the lid from opening after it has been fully closed for the first time. Additionally or alternatively, the self-locking cover can have a bond that fixes the cover in a screwed position.
• the electronics module is electrically connected to the expansion module in a persistent manner.
• an electrically persistent connection can be achieved by a persistent configuration of an electrical connection between the field device electronics in the electronics module and the expansion module.
• electrical connectors in particular plug connectors, can be designed with a mechanically irreversible lock. This means, for example, that the connectors cannot be detached without being destroyed.
• the electrical connection between the field device electronics and the expansion module can be designed to be inaccessible from the outside and thus tamper-proof.
• the expansion module can also have no function and only provide physical access to electrical contacts of the Permanently close field device electronics.
• different expansion stages of a field device with one and the same electronics module with identical field device electronics can be offered, whereby, for example, in a cheaper expansion stage, the connection of functional expansion modules is permanently prevented by the non-functional expansion module.
• identical field device electronics By using identical field device electronics, higher quantities and thus lower costs can be achieved in production.
• a firmware update can also be used to implement continuous monitoring of the electrical connections between the field device electronics and the expansion module. An unauthorized interruption of a connection can lead to an alarm signal and / or a shutdown of the field device and / or a blocking of the access to the configuration of the field device.
• the field device electronics are logically and persistently connected to the expansion module.
• a logically persistent connection means a link between the field device electronics and the expansion module through a unique identification.
• the field device electronics and thus the electronics module can have a unique device identification and / or the expansion module can have a unique module identification.
• the respective identification of the other module can be stored in an inaccessible memory area and thus checked alternately whether the correct module is connected.
• the field device electronics can have a unique device certificate and / or the expansion module can have a unique module certificate. These certificates can also be exchanged, thus logically safeguarding the original configuration.
• the certificates can also be used to encrypt communication between the modules.
• Corresponding checksums can also be used to determine whether a stored device identification or a certificate has been changed. If this is the case, you can proceed as above with regard to an unauthorized interruption of the electrical connection.
• the field device is preferably designed as a field device for process automation, preferably as a level, limit level, flow, density or density profile measuring device.
• the expansion module can be designed as a blocking module, preferably a mechanical blocking module.
• a blocking module can prevent mechanical access to electrical contacts or prevent the field device electronics from being removed from the housing of the field device.
• the expansion module can be designed as a display and / or operating module.
• the expansion module can also have a security module.
• a security module can implement various functions and, in particular, be designed to be suitable for the implementation of predetermined IT security levels.
• the legislators are also formulating new requirements for the operators and manufacturers of devices, which pursue the goal of critical infrastructure facilities (KRITIS) such as energy (electricity, gas, oil), transport (air, rail, water, road) To make drinking water supplies and digital infrastructure resistant to negligent or willful hacker attacks.
• KRITIS critical infrastructure facilities
• NIS Directive European Directive 2016/1148
• the cyber security standards that have existed for a long time (e.g. IEC 62443, ISO 27001) require that the devices used there meet a standardized IT security level, also known as the Security Level (SL).
• IEC 62443 (as of 08/2013, for example) has defined the following security levels for this, which are classified according to the means available to the attacker, the material and financial resources available, the technical skills and the underlying motivation.
• the security level SLO is a purely theoretical construct with no risk of impairment or manipulation and therefore no measures are necessary.
• the security level SL1 describes the ability of a system to avoid accidental and unintended impairment or manipulation.
• the security level SL2 describes the ability of a system to defend against intended manipulations by interested individuals and companies with generic security knowledge.
• the security level SL3 describes the ability of a system to defend against intentional manipulations by experts and companies who develop and use effective, but cost-oriented attack scenarios with clear goals.
• the security level SL4 describes the ability of a system to defend against intentional manipulations by organizations with experts, who focus on achieving the specifically selected target at almost any price.
• the expansion module can have a plurality of functional units for implementing the specified IT security level. In this way, several different expansion modules with different functional units can be made available, which implement different IT security levels in cooperation with a field device.
• an expansion module can be designed in such a way that it can implement several different IT security levels in cooperation with a field device.
• individual functional units that are not required or not permitted for implementing a certain IT security level can be deactivated or required or prescribed functional units activated so that several different IT security levels can be implemented with one expansion module.
• functional units are understood to mean function blocks which are implemented in hardware and / or software and which are decisive for compliance with the specified IT security levels.
• the IT security levels of different levels usually differ in at least one functional unit, ie that at least one functional unit is activated or deactivated to implement one IT security level, which is accordingly not activated or deactivated to implement another IT security level .
• the IT security levels on which this application is based can relate to various aspects of IT security and can be implemented using various measures that are summarized in the functional units in the present application.
• aspects of IT security as they can be implemented in the IT security levels subject to the registration, include various levels of identification and authentication of users, devices and software, usage control, securing the communication of the field device with regard to authentication and integrity as well as e.g. . of required reaction times.
• the expansion module can have a first electrical interface for connecting the electronics module of the level measuring device and a communication module for connecting to a higher-level unit.
• the retrofit module can be connected to the field device electronics, preferably a communication interface, more preferably a wired communication interface of the field device electronics.
• the expansion module can use the communication module to establish external communication. Outwardly means in this sense to a unit outside the field device, in particular a higher-level unit, a control device or other field devices.
• higher-level units can be used in addition to evaluation devices and computers, for example in a control room, as well as servers in a LAN (Local Area Network) or WAN (Wide Area Network) environment. This also applies to devices in virtual private networks (VPN).
• VPN virtual private networks
• the field device electronics and / or the expansion module can be designed in such a way that releasing the persistent connection triggers an error message. This can be done either, as described above, by monitoring electrical connections, or, as also described above, by contact switches, so-called sabotage contacts.
• the expansion module is designed as a separately manageable unit. This means that the expansion module is designed as part of a modular system of different, coordinated modules and as a separate structural unit.
• a modular field device concept according to the invention comprising a plurality of different sensors, a plurality of different housings, a plurality of electronic modules and a plurality of expansion modules is characterized in that at least one combination of housing and / or electronics module and expansion module is designed and coordinated in this way is that the electronics module and / or the housing can be connected persistently to at least one expansion module.
• a method according to the invention for operating a field device with an electronics module with field device electronics and at least one expansion module is characterized in that the field device electronics and / or the field device is persistently connected to at least one expansion module.
• the expansion module is permanently connected to the field device electronics, that is to say the electronics module, and / or the field device or its housing.
• the electronics module and / or the field device is preferably mechanically connected to the expansion module and / or the field device electronics are connected electrically and / or logically to the expansion module in a persistent manner.
• the field device electronics and / or the expansion module are preferably designed in such a way that a release of the persistent connection triggers an error message.
• Figure 1 shows a field device according to the prior art
• Figure 2 shows a first embodiment of a field device according to the present application
• FIG. 3 shows a second exemplary embodiment of a field device in accordance with the present application
• FIG. 4 shows an example of a method for operating a field device according to FIG. 3 and FIG. 4
• FIG. 5 shows a third exemplary embodiment of a field device with an expansion module designed for this purpose.
• FIG. 1 shows a field device according to the prior art.
• the field device 101 is designed as a radar level measuring device.
• the field device 101 has, as sensor 100, a transmitting and receiving device with a horn antenna.
• an electronics module 102 is arranged with an electronics unit that is matched to the sensor 100 and has an electronic expansion interface 104.
• expansion modules can be connected to this expansion interface 104 and installed in the field device 101 by the end customer himself. It is particularly common to have existing sensors 101 with a To expand expansion module 106, which is formed as a display and control unit. The expansion module 106 exchanges both energy and data with the field device electronics in the electronics module 102 via the electronic interface 104.
• the expansion module 106 is fastened to the electronics module 102 by means of a standardized mechanical housing receptacle 105, for example a screw-in mechanism 105.
• a housing cover 103 protects the overall electronics, consisting of electronics module 102 and expansion module 106, from mechanical and atmospheric interference.
• Previous expansion modules 106 are basically designed to be able to be mounted and dismantled again as often as desired on one or more different field devices 101.
• FIG. 2 shows a first exemplary embodiment of a field device 101 according to the present application with an expansion module 201, which in the present case is designed as a security module.
• the security module 201 contains various hardware and software units which are required to implement a defined security level (SL) in cooperation with the field device electronics in the electronics module 102.
• the security module 201 contains, in particular, a user administration 202 which contains a list of authorized users for a release for the configuration of the field device 101.
• SL security level
• the security module 201 has a mechanically persistent connection to the electronics module 102, which in the present exemplary embodiment is implemented by a cascade of flexible locking latches 203, which are pushed to the side when the security module 201 is installed on the electronics module 102, but when Place the attempt to remove the security module 201 across and hook it in such a way that dismantling is prevented.
• safety module 201 By appropriately designing the mechanical dimensions of the safety module 201, electrical persistence can also be achieved.
• electrical persistence in addition to the module 201 shown, in particular functionless modules can also be used, which are used exclusively for irreversible mechanical sealing.
• the behavior of the field device 101 is changed in such a way that the currents in the feed line 107 are continuously monitored.
• the operation of the field device 101 is interrupted after a fault message has been output after it is switched on again.
• a last alarm signal for example fed from an energy store (not shown here), is transmitted wirelessly to a higher-level unit.
• FIG. 3 shows a second exemplary embodiment of a field device 101 according to the present application.
• the expansion module 301 used there is logically sealed in order to achieve logical persistence.
• the expansion module 301 can be mechanically mounted as often as desired on the electronic module 102 and then removed.
• the interaction of the components 302, 303, 304, 305 ensures that the expansion module 301 and the electronics module 102 are logically linked to one another in such a way that the field device can continue to operate without the expansion module 301 and / or a Installation of the expansion module 301 on another field device is no longer possible from now on.
• the method begins with plugging in the expansion module 301 in step 401.
• the expansion module 301 updates the firmware of the field device 101 by copying the firmware into the electronics module 102
• Memory 303 stored information to a processor 304 in the electronics module 102, which then updates the program code 305.
• step 403 the field device 101 is restarted, and according to the instructions of the program code, which is now new by the firmware update, instructed in step 404 to generate a unique sensor identification signature, for example a numerical code.
• the code is transmitted to the expansion module 301 in step 405, whereupon the expansion module stores this signature in the non-volatile memory 303. From now on, the expansion module 301 will only start operating in conjunction with that electronic module 102 whose signature matches the signature stored in the memory 303.
• step 406 the expansion module 301 sends its own, for example factory-generated, secret signature back to the electronics module 102.
• this signature is now checked, and here in particular compared with the signature of an accepted module transmitted by the software update.
• the normal operating mode of the field device 101 for determining a measured value is activated in step 409.
• step 410 a fault report is transmitted to the outside in a wired or wireless manner, and regular sensor operation is refused.
• step 411 The method ends in step 411.
• the electronics module 102 and the expansion module 301 can henceforth only be operated jointly in precisely this combination, and consequently are logically clearly coupled to one another.
• the expansion module 301 can therefore be viewed as logically persistent in the context of the present invention.
• FIG. 5 shows a field device 502 with an expansion module 501 designed for this purpose.
• the expansion module 501 has devices 203 which lead to mechanical persistence of the expansion module 501 after assembly.
• the expansion module 501 is presently equipped as a so-called blocking module without additional functions, and also has no connection to the expansion interface 104 of the electronics module 102.
• the embodiment shown can in particular be used to implement different variants of a field device with different market prices.
• the field device 502 is made available on the market, for example, as an inexpensive sensor without the option of expandability.
• the standardized sensor electronics which are also used in expandable devices, can also be used in the inexpensive variant, but to prevent the expandability by mechanically covering the expansion interface 104. This can be done in a simple manner by applying a mechanically persistent expansion module with corresponding locking catches 203 already at the manufacturer.
• the mechanical interface between the expansion module 501 and the electronics module 102 can be designed in such a way that if the expansion module 501 is forcibly removed against the resistance of the locking catches, a mechanical receptacle on the electronics module 102 is damaged in this way or is destroyed that attaching a functional expansion module becomes impossible after forcibly removing the locking module.
• connection cable 503 is attached to a connection block with electrical contacts 204 of the electronics module 102 at the manufacturer's premises, and thus the interior of the electronics module 102 is completely protected from external manipulation or unauthorized expansions. Provision can also be made to prevent or limit the expandability of existing field devices for certain countries or target markets in order not to violate existing third party property rights in these countries. Provision can also be made to ensure that configurations relevant to approval, for example a flameproof encapsulation of the field device 502 that is relevant for explosion protection, are invariably ensured by means of suitable persistent additional modules.
• the expansion module 501 can also be designed in the form of a persistent housing cover 504, which can be glued to the housing of the field device 502, for example.
• the module 501 has, for example, a mechanical persistence.
• electrical and / or logical persistence can be used to achieve the above-mentioned goals.

Landscapes

• Physics & Mathematics (AREA)
• General Physics & Mathematics (AREA)
• Engineering & Computer Science (AREA)
• Automation & Control Theory (AREA)
• Arrangements For Transmission Of Measured Signals (AREA)

Applications Claiming Priority (1)

Publications (1)

Family

ID=70554074

Family Applications (1)

Country Status (4)

Family Cites Families (5)

• 2020
  • 2020-05-05 EP EP20724082.1A patent/EP4147097A1/de active Pending
  • 2020-05-05 US US17/919,680 patent/US20230297055A1/en active Pending
  • 2020-05-05 WO PCT/EP2020/062430 patent/WO2021223855A1/de unknown
  • 2020-05-05 CN CN202080100549.1A patent/CN115516386A/zh active Pending

Also Published As

Similar Documents

Legal Events