Classifications

• • G—PHYSICS
  • G05—CONTROLLING; REGULATING
  • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
  • G05B9/00—Safety arrangements
  • G05B9/02—Safety arrangements electric
• • G—PHYSICS
  • G05—CONTROLLING; REGULATING
  • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
  • G05B2219/00—Program-control systems
  • G05B2219/20—Pc systems
  • G05B2219/24—Pc safety
  • G05B2219/24008—Safety integrity level, safety integrated systems SIL SIS
• • G—PHYSICS
  • G05—CONTROLLING; REGULATING
  • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
  • G05B2219/00—Program-control systems
  • G05B2219/30—Nc systems
  • G05B2219/31—From computer integrated manufacturing till monitoring
  • G05B2219/31461—Use risk analysis to identify process parts that should be specially monitored

Definitions

• the invention relates to a method for determining a security level in an automation network with subscribers, a security manager and an automation network.
• Modern concepts of industrial automation i.
• the control and monitoring of technical processes using software is based on the idea of a central controller with distributed sensor / actuator level.
• the participants communicate with each other and with higher-level systems via industrial local networks, also referred to as automation networks.
• the automation networks are generally designed as so-called master-slave communication networks, in which the master subscriber the control level and the slave participants form the sensor / actuator level.
• An essential requirement in industrial automation is safety. When performing automation tasks, it must be ensured that the automation network does not endanger people or the environment if a participant fails or another error occurs. In order to be able to classify the hazards through an automation network, it is mandatory to carry out a hazard analysis. According to the European standard EN1050, the risk assessment has to be carried out as a sequence of logical steps that allow the systematic investigation of hazards emanating from the automation network or the individual participants. Based on the hazard analysis, the technical and organizational requirements for the automation network are then defined to ensure sufficient safety.
• the European standard EN 954-1 "Safety for machines - Safety-related parts of control systems" has established itself as an international standard for the implementation of a risk analysis in the area of machine and plant safety, which includes all safety-related participants regardless of the participant type Based on the determined safety category, the control structure in the automation network is then designed to meet the requirements of the safety functions and the required system behavior in the event of a fault.
• the standards EN ISO 13849-1 and IEC / EN 62061 specify the safety performance of programmable electronic control systems required for risk reduction. For the subdivision of the safety performance, safety levels are defined in the two standards. For this purpose, all security functions of the automation network with all participants involved in their execution are considered.
• the security level of the automation network is determined on the basis of safety characteristics of the participants involved in the safety functions. These parameters are the average time for a dangerous failure (MTTF), the diagnostic coverage (DC), the average probability, and the according to the standard EN ISO13849-1. the probability of a dangerous failure per hour (PFH), the useful life (T M ), the number of cycles in which 10% of a sample of the weary participants considered hazardous (Bio d ), and the common cause failure (CCF). In addition to these safety-related parameters, other parameters, including operational aspects such as the request rate or the test rate of the safety function, can influence the safety level.
• DE 103 18 837 A1 discloses a network in which data and sequence-related links between the subscribers can be determined automatically by a security manager.
• the object of the present invention is to provide a method for determining the security level in an automation network or a security manager for such an automation network, which enables an automatic calculation of the security level in a simple and reliable manner, in particular also for further changes in the automation network ,
• the data and operational links between the subscribers in the automation network and the subscriber-specific links are determined a security level in an automation network with subscribers.
• the security level in the automation network is then calculated by means of a calculation rule that links the ascertained data and operational links of the nodes in the automation network and the determined subscriber-specific security characteristics.
• the method is based on a security manager who has a configuration acquisition module for determining the data and workflow-specific linkage of the subscribers in the automation network and a characteristic data acquisition module for determining subscriber-specific security characteristics and a subscription. calculation module for executing the calculation rule.
• the procedure according to the invention for determining a security level in an automation network or the associated security manager makes it possible to automatically calculate the security level. In particular, it is no longer necessary for the operator to analyze the structure of the automation network and then enter it into the calculation module. Furthermore, the procedure according to the invention and the correspondingly designed security manager also make it possible to independently record extensions or changes in the automation network and to take them into account in the calculation of the security level.
• the subscriber-specific security characteristics are stored in the corresponding subscribers and are automatically requested by the security manager for calculating the security level via an automation network connection by the subscribers.
• the calculation module in the security manager receives the subscriber-specific security characteristics directly from the participants, so that new or previously unknown participants can be included in a simple manner. This ensures that changes and enhancements to the safety function or an exchange of nodes in the automation network are reliably taken into account when determining the security level.
• the data and operational links between the subscribers are determined from the predetermined configuration of the automation network for carrying out an automation task.
• the configuration of the control logic for Management of the automation task contains all the necessary data and runtime links that must be taken into account when calculating the security level. The data and sequence links can thus be easily determined automatically from the control hardware.
• the logical links of inputs and outputs of the subscribers for carrying out the automation task are preferably detected.
• This information contains all the necessary data in order to be able to fully take into account the data and process-related links of the participants when calculating the security level.
• FIG. 1 shows schematically an automation network with a security area
• FIG. 2 shows a security manager for an automation system.
• decentralized control systems are also referred to as automation networks, in which decentralized devices in a sensor / actuator level such as I / O modules, transducers, valves communicate with automation computers at a control level via a powerful real-time communication network.
• the subscribers in the automation network ie the automation computers or the devices of the sensor / actuator level, can communicate via point-to-point connections or via a bus system. be linked to each other.
• a fieldbus system is preferably used as the bus system.
• Automation networks are generally structured hierarchically and work according to the master-slave principle.
• the master members are assigned to the control level and represent the active participants who have access to the communication links in the automation network and determine the data transfer.
• the slave participants are added to the sensor / actor level and form the passive participants. You have no independent access authorization to the communication connections, ie. H. they may only acknowledge received data and transmit data to them upon request of a master user.
• FIG. 1 schematically shows the basic structure of an automation network.
• the automation network has two master subscribers M, SM, which form the control level, and eight slave subscribers Si to S 4 , SSi to SS 4 , which represent the sensor / actuator level. All participants in the automation network are connected to each other via a serial bus 1, via which the data exchange between the participants takes place.
• the data exchange between the subscribers is usually organized by the master subscribers M, SM in the form of data packets, which are composed of control data and user data, the control data in the data packet containing an address information.
• the data exchange is then z.
• Based on the Ethernet protocol which allows data packets up to 1500 bytes in length at transmission speeds of 100 Mbit / sec.
• An essential requirement of the automation network is to ensure that in the event of a subscriber failure or malfunction, there is no risk to people or the environment.
• the risk essentially depends on the type and mode of operation of the participants in the automation network and the reliability of the control programs. In order to protect people and the environment from dangers, dangerous participants in the automation network may only be operated and maintained with suitable protective devices.
• safety functions must still be executed on the control level in the automation network, which ensure that the automation network enters a secure state in the event of failure of safety-relevant subscribers in the automation network. Such a secure state is z. B. an emergency shutdown of the automation network.
• EN 954-1 Safety of machinery - Safety-related parts of control systems
• EN 954-1 only carries out a qualitative approach, whereby, for example, the failure probabilities of individual subscribers in the automation network are not taken into account.
• Such safety characteristics of the participants are the mean time to dangerous failure (MTTF d ), the probability of dangerous failures per hour (PFH d ), the diagnostic coverage (DC d ) t the share of safe failures (SFF d ), the service life (T M ), common cause failure (CCF), and other characteristics specified in the standards.
• the determination of the security level of the automation network further requires that the data and sequence-specific connection of the subscribers in the automation network be recorded. The security level specified by the standards can then be used to determine the security level.
• a security area is usually defined in the automation network.
• the security area is formed by the security-relevant master subscriber SM, hereinafter also referred to as security master SM, and the security-relevant slave subscribers SSi to SS 4 .
• the non-safety-relevant slave subscribers Si to S 4 which continue to be present in the automation network shown in FIG. 1 are controlled by the second master subscriber M, also referred to below as the standard master M.
• the security functions of the non-safety-related control functions by providing se- It is also possible to carry out both the safety functions and the non-safety-related control functions on a single master subscriber, but then it must be ensured that the non-safety-related control functions do not impair the safety functions.
• the security level in an automation network can be determined in conformity with the standard, it is necessary to individually input the data and operational linkage of the subscribers for executing the security functions in the automation network. Furthermore, in the case of the known security tools, the subscriber-specific security characteristics to be taken into account when calculating the security level are taken from a software library. This makes it necessary to continuously update the software library in order to be able to consider new security-relevant subscribers or to record changes to the subscriber-specific security characteristics due to technical or software-specific adaptations in the subscribers. The effort for determining the security level in an automation network is substantially reduced with the security manager 2 provided according to the invention.
• the security manager 2 is integrated in the automation network shown in FIG. 1 in the security master SM.
• the security manager 2 can be embodied both in hardware and in software form.
• the security manager 2 can also be installed in any other participant in the automation network, for example, in the automation network.
• the security manager 2 can also be trained as an independent participant in the automation network.
• the structure of the safety manager 2 is shown schematically in FIG.
• the individual components of the security management gers can again be executed both in hardware and in software.
• the security manager 2 has three interfaces: a bus interface 21 for connecting the security manager to the automation system, a data interface 22 and a man-machine interface 23. If the security manager 2 is not a standalone participant in the automation network but part of a master user or another user On the network, the security manager can alternatively use the corresponding interfaces of this host user.
• the security manager 2 Via the data interface 22, the security manager 2, the automation network configuration, the z. B. by a configuration tool 4 for performing an automation task was import import.
• the read-in system configuration is converted into a system model in a configuration acquisition module 24 connected to the data interface 22, which determines the data and workflow connection of the security-relevant subscribers in the automation network in standardized form.
• the configuration acquisition module 24 can also capture the plant model, which represents the data and operational links of the security-relevant subscribers in the automation network, but also alternatively in a test mode of the automation network itself. This is determined by the
• Configuration acquisition module 24 e.g. For example, using test data, the logical connection of inputs and outputs of the safety-relevant participants in the implementation of the automation task. Furthermore, it is also possible for the configuration acquisition module 24 to read out the security controller from the security master SM and to determine therefrom the data and transaction-specific association of the security-relevant subscribers.
• the security manager 2 also has a characteristic data acquisition module 25 for determining the subscriber-specific security characteristics. These subscriber-specific security
• the characteristic data acquisition module 25 can read in the characteristic data acquisition module 25 from an external database 5 via the data interface 22 or also query it directly from the security-relevant subscribers in the automation network via the bus interface 21. Furthermore, there is the possibility that the characteristic data acquisition module 25 restores updated subscriber-specific safety characteristics to the safety-relevant subscribers or external database 5.
• Each safety-relevant subscriber SSi to SS 4 has, as shown in FIG. 1, a characteristic data memory 3 in which the subscriber-specific safety characteristics are stored.
• This identification data memory 3 is write-protected and provided with an identifier.
• identifier can z. B. the checksum of the subscriber-specific characteristics are used.
• the identifier assigned to the individual characteristic data memories is also stored in the characteristic data acquisition module 25. By means of these identifiers, a secure data communication between the characteristic data acquisition module 25 and the individual subscribers in the automation network can be carried out for the exchange of the subscriber-specific safety characteristics.
• the configuration acquisition module 24 and the characteristic acquisition module 25 are further connected in the security manager 2 to a calculation module 26 in order to calculate a security level in the automation network.
• the calculation module 26 carries out the determination of the security level by means of predetermined calculation rules, the calculation rules taking into account the given security standards.
• the respective calculation rule to be used can be selected by the user via a human-machine interface 23 via a connected input / display unit 6 , However, it is also possible to automatically predetermine the calculation rule to be used by the calculation module 26.
• the determined security level gives the calculation module again via the man-machine Interface 23 in the form of a message to the input / playback unit 6 off.
• Security Manager 2 can be operated in different modes to calculate the security level in the automation network.
• the safety manager 2 can be used in a first operating mode as part of the system design for the predetermination of the respective security level of the design.
• the system configuration and the subscriber-specific security characteristics are queried via the data interface 22 of configuration tools 4 or the external database 5.
• the characteristic data acquisition module 25 can then read out the subscriber-specific characteristic data from the characteristic data memories 3 of the safety-relevant subscribers. Furthermore, the configuration acquisition module 24 can determine the data and execution-specific configuration directly from the configuration of the connected automation network or from the control program of the security master.
• the security manager according to the invention or the security level determination method according to the invention it is possible to automatically determine the security level in the automation network in a simple manner, in particular also after changes in the automation network, eg. B. after connecting another security-relevant subscriber.

Priority Applications (4)

Applications Claiming Priority (2)

Related Child Applications (1)

Publications (1)

Family

ID=41800680

Family Applications (1)

Country Status (6)

Families Citing this family (12)

Citations (2)

Family Cites Families (18)

• 2008
  • 2008-11-24 DE DE102008044018A patent/DE102008044018B4/de not_active Revoked
• 2009
  • 2009-11-18 EP EP09760810.3A patent/EP2359201B1/de active Active
  • 2009-11-18 WO PCT/EP2009/065370 patent/WO2010057908A1/de active Application Filing
  • 2009-11-18 CN CN2009801468976A patent/CN102224466B/zh active Active
  • 2009-11-18 JP JP2011536848A patent/JP5274667B2/ja active Active
• 2011
  • 2011-05-23 US US13/113,397 patent/US9665072B2/en active Active

Patent Citations (2)

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events