KR100635630B1 - Extending OPC-DA system and method for a flexible multi process control and monitoring in Field-Bus environments - Google Patents

Abstract

The present invention provides a fieldbus environment that provides a method of providing differentiated service elements to a plurality of clients that control and monitor a specific service (OPC-DA-based equipment) to an OLE for Process Control (OPC) component using a wrapping technology of the component. The present invention relates to a PCC data access extension system and method for flexible process control and monitoring.

The present invention provides an access pointer extracting step of extracting hardware driver address and field information of a database from a data access structure on a network and generating access pointer information including the same; A user who generates a predetermined tag including the hardware address and database field information included in the data access pointer and the device access pointer extracted in the step, classifies it into a predetermined level, and sets usage rights according to each level. A usage right information application step of reconfiguring the data access structure by applying the right information of the tag to the tag; And driving a data source for reconstructing the data access structure using the tag to which the information of the usage right is applied as the OPC data access.

OPC, Real Tag, Virtual Tag, Processing Tag, Data Acess

Description

Extending OPC-DA system and method for a flexible multi process control and monitoring in Field-Bus environments

1 is a block diagram showing the architecture of the PCC data access extension system for flexible process control and monitoring in a fieldbus environment according to the present invention;

FIG. 2 is a block diagram showing an OPC data access extension system for flexible process control and monitoring in a fieldbus environment;

3 is a flowchart illustrating a method for extending PCC data access for flexible process control and monitoring in a fieldbus environment;

4 is an exemplary view illustrating a display screen of an input unit;

5A is a block diagram showing an access point extractor;

5b is a flowchart showing an access point generation step;

5C is an exemplary diagram illustrating a step of generating a data access pointer;

5D is an exemplary diagram illustrating a step of generating a device access pointer;

6A is a block diagram showing a security unit;

6b is a flow chart showing a step of applying permission information;

6c is a block diagram showing a tag generation step;

6D is a block diagram showing a step of applying usage right information;

7 is a block diagram showing a simulator unit.

Explanation of symbols on main parts of drawing

110: access point extractor 111: DB information extraction means

112 emulator 113 access point extracting means

120: security section 121: tag generation means

122: authority application means 123: security service access means

124: domain controller 125: access structure creation means

130: simulator unit 131: content storage means

132: content providing means 133: simulator means

140: security service 150: input unit

151a: OPC DA Server Option 151b: SQL Server Option

152: connection port 153: source input port

154: user defined table display term 155: field information display term

156a: actual access pointer selection 156b: virtual access pointer selection

156c: Machining access point selection term 157: Field information selection term

158: Access pointer information source display item 159a: Simulator drive selection item

159b: web service option 159c: source access pointer structure

 The present invention provides a fieldbus that provides a specific service (method for providing differentiated service elements to a plurality of clients that control and monitor OPC-DA-based equipment) to an OLE for Process Control (OPC) component using a wrapping technology of the component. The present invention relates to a PCC data access extension system and method for flexible process control and monitoring in an environment.

OLE for Process Control (OPC) typically starts with Microsoft's WinSEM group (Windows for Science, Engineering, and Manufacturing), and is based on OLE / COM technology to interface between client applications and server (equipment) of process data. The way is defined.

  When writing control and monitoring software based on OPC, software that uses an OPC server has a number of risks, with the advantage that all tags (device addresses) provided by OPC are accessible to all users. Some HMI software (WinCC, InTouch, ..) and control and monitoring software are creating and using independent security models. However, there is a problem that there are risk factors due to the vulnerability of the independent security model and the change of personnel.

The present invention devised to solve the conventional problems as described above is scattered in the network of the vulnerability of the security model and the risk of the independent security model according to the change of the personnel and the vulnerability of the independent security model of the OPC-based control and monitoring software Provides extension system and method for flexible process control and monitoring in fieldbus environment that provides strong service in distributed environment by interlocking with secret key encryption system by using Active Directory Services to find and use existing resources It aims to do it.

According to another aspect of the present invention, there is provided an access pointer extracting step of extracting hardware driver address and field information of a database from a data access structure on a network and generating access pointer information including the same; A user who generates a predetermined tag including the hardware address and database field information included in the data access pointer and the device access pointer extracted in the step, classifies it into a predetermined level, and sets usage rights according to each level. A usage right information application step of reconfiguring the data access structure by applying the right information of the tag to the tag; And driving a data source for reconstructing the data access structure using the tag to which the information of the usage right is applied as the OPC data access.

The extracting of the access pointer may include inputting field information of a database; Inputting location information of a drive driver of hardware; Accessing a security service and determining whether the user is a legitimate user authorized to access field information and hardware address information of the database; Generating a data access pointer including table field information of each database on the network; And generating a device access pointer including the location address of the driver of each hardware connected on the network.

Or extract information including each table field information of a database and driver address of each hardware on a network, and generate a data access pointer and a device access pointer each including the extracted field information and driver address information of each hardware. An access point extractor; A security unit for generating a predetermined tag using the access pointer and converting the generated tag into a data access structure by applying user authority information to the generated tag; And a simulator unit for reading out the stored content, combining the data access structure with the content, and controlling the corresponding hardware and database on the network through hardware information and database information included in the data access structure.

The security unit may include: tag generation means for generating a data tag applied to the data access pointer applied from the access pointer extracting means, a real tag of the device access pointer, and a processing tag combining the real tag and the temporary tag; A domain controller storing usage authority information; Security service access means for accessing a security service through the domain controller; Authority applying means for receiving the usage right information through the security service access means and applying the received usage right information to the real, virtual, and processed tags; And access structure generating means for constructing a data access structure as the lowest root using the tag to which the usage right information authorized in the right applying means is applied.

Hereinafter, exemplary embodiments of an extension system and method for flexible process control and monitoring in a fieldbus environment according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating the architecture of an extension system and method for flexible process control and monitoring in a fieldbus environment in accordance with the present invention.

Referring to FIG. 1, the architecture according to the present invention includes a resource layer 10, a business layer 20, and a present layer 30. In this case, the resource layer 10 stores sources such as an address 12 of each hardware included in the lowest root and field information 11 of the database in an OPC data access structure connected to an input network. The access point is extracted to generate an access point (13), and through the security service system on the network, it is determined whether the user is a user authorized to access the hardware address and the field information of the database. If the user is not allowed access, the access is blocked (14). In this case, the access point is a source for generating data and includes an address of a hardware or field information of a database.

In addition, the business layer 20 generates a predetermined tag based on the access pointer extracted from the resource layer 10 and applies user rights information provided by the security service 140 to the generated tag. Apply (21). That is, each tag is given the right to read or write according to a predetermined level. The tag to which the user right information is applied is reconfigured into an OLE for processing control-data access structure including a top root 22a, a group root 22b, and a subroutine 22c in a group (22). ). Here, each tag to which the user right information is applied is configured in the subroute 22c in the group.

In addition, the presentation layer 30 reads the stored content (33) and applies the OPC-data access structure (OPC-Data Access) configured in the business layer 10 to the content (31) to drive it as an OPC component (31). 33).

2 is a block diagram illustrating an extension system for flexible process control and monitoring in a fieldbus environment according to the present invention.

Referring to FIG. 2, the input unit 150 outputs a user's input signal, and the access point extractor 110 is connected to each database 101 and hardware 102 on the network, so that the address and data of the hardware can be obtained. By generating an access pointer including the field information of the base, the security unit 120 forms a predetermined tag based on the access pointer, by applying the user authority information set in the security service 140 to the generated tag Reconstructed by the OPC data access structure, the simulator unit 130 applies the OPC data access structure to the content and drives the content like an OPC component.

Figure 3 is a flow chart illustrating a method of extending the OPC data access for flexible process control and monitoring in a fieldbus environment.

Referring to FIG. 3, the OPC data access extension method for flexible process control and monitoring in a fieldbus environment according to the present invention extracts the address information of a hardware drive driver on a network and field information of a database and includes access point information including the same. An access point extracting step (S10) of generating and converting the access pointer extracted in the step (S10) into a predetermined tag (Tag), and applying the permission information to apply the permission information to each tag (S20) In addition, the hardware and data included in the tag may be driven by operating the data source converted from the tag to which the information of the usage right is applied in the step S20 into an OPC data access structure by using an OPC data access. Simulator step (S30) for remote control of the base.

4 illustrates a display screen of an input unit in an OPC data access extension system for flexible process control and monitoring in a fieldbus environment according to the present invention.

Referring to FIG. 4, in the display showing the input unit 150, the user selects the selection term 151b of the SQL server to extract the data access pointer, or the OPC DA server selection term to extract the device access pointer. (151a) is selected.

For example, in order to select the SQL server 151a and extract the data access pointer, first input the URL of the target database into the source item 153, and when the input is completed, the connection term 152 Click In this case, when the connection term 152 is clicked, the access pointer extracting means 113 (refer to FIG. 5A) is connected to the security service 140 through the security service access means 123, wherein the security service 140 In order to determine whether the user is a user who is allowed to access the database, an ID and a password are required.

Therefore, when the user enters the ID and password, the security service 140 retrieves the ID and password of the user registered in its own DB, and if there is a matching ID and password, and allows access to the database.

Therefore, the user-defined table term 154 displays the table of the database of the URL, and the field term 155 displays the field of the table.

The real access pointer 156a, the virtual access pointer 156b, and the process access pointer term 156c are selected in accordance with the field information of the database as described above. In the tag selection term 157, the access pointer is selected. According to selections 156a, 156b, and 156c, predetermined tags that can be generated can be selected.

In addition, the URL of the source is displayed in the access point information source term 158a, the ID of the connected user is displayed in the ID and the pass term 158b, and the database term 158c indicates the database of the connected source. .

The OPC simulator service stop term 159a selects the stop of the OPC simulator in service, and the stop term 159b of the service control information can select stop when the OPC simulator is being driven, and the source access pointer structure below it. In section 159c, the OPC data access structure reconfigured as a tag to which the user right information is applied is displayed.

5A is a block diagram illustrating an access point extractor.

Referring to FIG. 5A, the emulator 112 and the DB information extracting means 111 are connected to each hardware 101 and the database 102 on a network, and the access point extracting means 113 is connected to the hardware address and the database. Create a data access pointer and a device access pointer based on the information. The access point extracting unit 113 is a component belonging to the security unit 120, and is connected to the domain controller 124 through the security service access unit 123 so that the user can access the database 102 or the hardware 101 on the network. ) Is determined to be a legitimate user who can access

FIG. 5B is a flowchart illustrating an access pointer extraction step, FIG. 5C is an explanatory diagram illustrating an extraction step of a data access pointer, and FIG. 5D is an explanatory diagram illustrating an extraction step of a device access pointer. FIG. 5B is an access extraction step using the flowchart of FIG. Will be described in detail.

First, when the user selects the SQL server in the input unit 150 of FIG. 4, inputs the URL of the database in the source term 153, and clicks the access term 152, the access pointer extracting means 113 is a security service. It is connected to the domain controller 124 through the connection means (123) (S11).

Alternatively, when the user selects the OPC DA server in the input unit 150, inputs the address of the hardware in the source term 153, and clicks the access term 152, the access pointer extracting means 113 accesses the security service. It is connected to the domain controller 124 through the means 123 (S12).

The access point extractor 113 opens a window for requesting a user's ID and password on the display screen of the input unit 150. Therefore, when a user enters his or her ID and password, the access pointer extracting means 113 transmits it to the domain controller 124 through the security service 140 access means 123, and the domain controller 124 Accessing the security service 140 determines whether there is information that matches the ID and password in its own database (S13).

As a result of the determination, when the information of the user whose ID and password are matched is retrieved, access to the hardware or the database entered in the source term is allowed. Therefore, the access point extracting means 113 controls the DB information extracting means 111 to extract table information and field information of a database having a URL input to the source term 153.

Therefore, the database extracted from the DB information extracting means 111 is applied to the table and field information to the access pointer extracting means 113, the access pointer extracting means 113 transfers it to the input unit 150, the field A display item 155 is displayed.

That is, when the URL inputted to the source term 153 is connected, the lowest root field information including the field information of the table of the database having the corresponding URL is displayed in the user defined table term 154, and the field below it. The display section 155 displays field information included in the table.

The access pointer extracting unit 113 generates a data access point as field information of the database extracted through the DB information extracting unit 111 as shown in FIG. 5C. (S14). Here, the data access pointer includes predetermined table and field information in the database.

In addition, the access point extractor 113 controls the emulator 112 to be included in the lowest root of an OPC data access structure having a URL input to a source term of the input unit 150 on a network. The hardware information is displayed on the display screen by extracting address information of the driving driver of the hardware to generate a device access pointer and applying the same to the input unit 150 (S15).

As shown in FIG. 5D, the access point extracting unit 113 is included in the lowest root, among the group root and the lowest root group grouped in the highest root in the OPC data access structure using the emulator 112. The address information of the driving driver of the hardware is extracted and a device access pointer including the same is generated.

The access pointer extracting unit 113 applies the data access pointer and the device access pointer generated as described above to the security unit 120.

6A is a block diagram illustrating a security unit.

Referring to FIG. 6A, the tag generating unit 121 is a real tag based on a data access point and a device access point input through the access pointer extracting unit 110. ) Creates a virtual tag and a processing tag, the domain controller 124 stores the user's authorization information, and the security service access means 123 connects to the domain controller 124. The authority applying means 122 applies the user authority information of the domain controller 124 to the tag generated by the tag generating means 121, and the access structure generating means 125 is a tag to which the user authority information is applied. It is reconfigured to the OPC data access structure and applied to the simulator unit 130.

6B is a flowchart showing a step of applying user authority information.

First, in the tag generating unit 121, a data access pointer and a device access pointer are input from the access pointer extracting unit 110, and access point selection items 156a, 156b, and 156c are displayed on the display screen of the input unit 150. For example, when the user selects the virtual access pointer 156b, the tag selection term 157 below lists the field information included in the data access pointer. At this time, if the user selects predetermined field information from the listed field information, the selected field information is applied to the tag generating means 121 (S21).

Therefore, the tag generating means 121 generates a temporary state V based on the field information included in the data access pointer, as shown in FIG. 6C (S22).

That is, as illustrated in FIG. 6C, when the user selects the real access point item 156a through the input unit 150 and selects a driver address of a predetermined hardware, the tag generating means 121 The real tag (R) is generated based on the input device access pointer. In addition, when the user selects the virtual access pointer item 156b, and then selects a predetermined field item of the database, a virtual tag is generated using information included in the data access pointer.

Further, when the user selects the processing access pointer item 156c, the tag generating unit 121 combines the real tag R and the temporary tag V generated through the data and device access pointer to process the processing tag (156). Create a Processing Tag, P). Here, the processing tag P may be generated by combining the real tag R and the temporary tag V as described above, or without using the real tag R and the temporary tag V. Process tag (P) is created by reading DLL function of database and hardware on network.

That is, the tag generation means 121 generates the processing tag P by the user selecting the combination of the real R and the provisional state V or the DLL function through the input unit 150.

The real tag (R) generated at this time includes the address of a hardware driver on the network included in the device access pointer, and the provisional state (V) indicates that a database on the network included in the data access pointer includes field information. The tag P contains both the hardware driver address and the field information of the database.

As described above, when the tag generated by the tag generating means 121 is completed, the tag generating means 121 applies the generated tag information to the authority applying means 122. Therefore, the authority applying means 122 accesses the domain controller 124 through the security service 140 accessing means 123, checks the authority information set in the security service 140, and receives the information (S23). . The usage right information set at this time is as shown in FIG. 6D.

Referring to FIG. 6D, the usage right information received by the authority applying means 122 through the security service accessing means 123 is classified into a predetermined step (a) and a group (b) according to each level. And the authority (c) for each level and the explanation (d) for each authority.

Therefore, the authority applying means 122 applies the authority information to the real, virtual, and processed tags (R, V, P) generated in the step. As an example, as shown in FIG. 5D, the processing tag P gives a level set to the usage right information. That is, the permission information to be applied is assigned to reference numerals e and f, where reference numeral e indicates that read permission is given as level 4, and reference numeral f indicates that write permission is given as level 3 ( S24).

After applying the usage right information to each tag generated in the step (S22), the authority applying means 122, the access structure generation means 125 for each tag (R, V, P) to which the usage right information is applied; To apply.

Therefore, the access structure generating means 125 reconstructs the OPC data access structure using real, virtual, and processed tags (R, V, P) to which the usage right information is applied. That is, a namespace root grouped as a root root and a lower root of the root root, and a lower root as a lower root of the namespace root. Here, the access structure generating means 125 reconstructs the OPC data access structure by constructing the lowest root using the real, virtual, and processing tags R, V, and P (S25).

The access structure generating means 125 applies the OPC data access structure configured through the above-described steps to the input unit 150, and the input unit 150 applies the source access pointer structure item on the display screen of FIG. This is indicated at 159c.

When the data access structure reconstructed with the tag to which the usage right information is applied is completed, the security unit 120 applies this to the simulator unit 130. Therefore, the simulator unit 130 simulates an applied data access structure so that the accessor can actually drive or virtualize the hardware and the database by using the driver information of the hardware included in the tag and the field information of the database from a distance. It can be simulated as shown in FIG.

7 is a block diagram showing a simulator unit.

Referring to FIG. 7, the content storage means 131 stores content provided by a service, and the content providing means 132 reads the content stored in the content storage means 131 to apply the OPC access data structure. The simulator means 133 applies an OPC data access structure to the contents provided by the content providing means 132 to control or simulate virtual hardware and databases included in the tag according to the user's operation connected to the network. Perform.

As described above, when the access structure generating means 125 reconfigures the OPC data access structure using the tag generated from the tag generating means 121 and applies it to the simulator unit 130, the content providing means 132 first performs the following. The content stored in the content storage means 131 is read, and the OPC access data structure is combined with the read content and applied to the simulator means 133.

Therefore, the simulator means 133 displays the OPC data access structure on the web through the contents, and then according to the drive driver address of the hardware included in the tag and the field information of the database according to the drive operation of the accessor. It connects to the hardware and controls according to the user's operation, or accesses the database to read or write the information.

In addition, the simulator means 133 is simulated to virtually drive the hardware or to use the database information, as opposed to actually driving the hardware or using the information of the database as described above.

That is, the present invention generates a tag having a hardware drive driver address from an original OPC data access structure in hardware on a network, generates a tag by extracting field information of a database on a network, and uses permission information in the generated tag. By reconfiguring the OPC access data structure, only the right user can access in the OPC-based security model, thereby improving security or efficient resource management in a distributed network.

The present invention is not limited to the preferred embodiments of the above-described features, and various modifications can be made by those skilled in the art without departing from the gist of the present invention as claimed in the claims. Of course, such changes will fall within the scope of the claims.

As described above, the OPC data access extension system and the method for flexible process control and monitoring in the fieldbus environment according to the present invention provide a specific service in an OPC-based distributed network, so that resource management on the network can be efficiently performed. As a result, the OPC data access structure is reconfigured through the tag to which the permission information is applied, thereby improving security.

Claims (4)

delete An access pointer extracting step (S10) of extracting hardware driver address and field information of a database from a data access structure on a network and generating access pointer information including the same; Generates a predetermined tag including the hardware address and database field information included in the data access pointer and the device access pointer extracted in the step S10, classifies it into a predetermined level, and sets usage rights according to each level. A usage right information application step (S20) of applying one usage right information to the tag and reconstructing it into a data access structure; A field including a simulator step (S30) for driving a data source for reconstructing a data access structure by using the tag (Tag) to which the information of the usage right is applied in the step (S20) as an OPC data access (OPC-Data Access) In a method of extending PCC data access for flexible process control and monitoring in a bus environment, The access pointer extraction step (S10) is Inputting field information of the database (S11); Inputting location information of a driving driver of hardware (S12); Accessing a security service 140 and determining whether the user is a legitimate user authorized to access field information and hardware address information of the database (S13); Generating a data access pointer including table field information of each database on the network (S14); And generating (S15) a device access pointer including a location address of a driver of each hardware connected on the network. delete An access pointer which extracts information including each table field information of a database and driver address of each hardware on a network, and generates a data access pointer and a device access pointer each including the extracted field information and driver address information of each hardware. An extraction unit 110; A security unit 120 generating a predetermined tag using the access pointer and converting the generated tag into a data access structure by applying user authority information to the generated tag; A field including a simulator unit 130 for reading out stored content and combining the data access structure and the content to control the corresponding hardware and database on a network through hardware information and database information included in the data access structure. OPC Data Access Extension System for Flexible Process Control and Monitoring in Bus Environments, The security unit 120 The processing tag P in which the data access pointer applied from the access pointer extracting unit 113 is a temporary tag V, the device access pointer is a real tag R, and the real tag R and the temporary tag V are combined. Tag generating means 121 for generating a); A domain controller 124 storing usage authority information; Security service access means (123) for accessing the security service (140) through the domain controller (124); Authority applying means (122) for receiving the usage right information through the security service access means (123) and applying the received usage right information to the real, virtual, and processed tags (R, V, P); And a fieldbus generating means (125) which constitutes a data access structure as the lowest root using the tags (R, V, P) to which the usage right information authorized by the authority applying means (122) is applied. OPC data access expansion system for flexible process control and monitoring in the environment.

Images