WO2020222845A1

WO2020222845A1 - External module for network connection to programmable logic controller (plc) backplane

Info

Publication number: WO2020222845A1
Application number: PCT/US2019/030306
Authority: WO
Inventors: Heiko Claussen; Florian Ersch; Richard Gary Mcdaniel
Original assignee: Siemens Aktiengesellschaft
Priority date: 2019-05-02
Filing date: 2019-05-02
Publication date: 2020-11-05

Abstract

Examples of techniques for an external module for use in conjunction with a programmable logic controller (PLC) backplane are described herein. An aspect includes a connector configured to connect the external module to a backplane of the PLC. Another aspect includes a PLC monitoring module configured to receive data from the backplane of the PLC. Yet another aspect includes a data port, wherein the external module is configured to send data from the backplane of the PLC to a cloud server via the data port on the external module.

Description

EXTERNAL MODULE FOR NETWORK CONNECTION TO PROGRAMMABLE LOGIC CONTROLLER (PLC) BACKPLANE

BACKGROUND

[0001] The present techniques relate to programmable logic controllers (PLCs) for industrial processes. More specifically, the techniques relate to an external module for a network connection to a PLC backplane.

[0002] Digitization is prevalent in various industrial fields such as factory automatization. Automated design tools and flexible production facilities may allow for customized products rather than mass produced solutions. Flexible production provides devices in a manufacturing process that may adapt to new production flows by either reprogramming or adding new specialized functionality. Such devices may require connectivity to a centralized computer system (e.g., a cloud server) in order to download new functionalities or skills. Connectivity must be secure in order to ensure that process equipment is not hacked, disturbed (e.g., denial of service attack), or monitored by external parties via the connection. For example, external process monitoring may lead to a loss of the intellectual property that defines how a product is built.

SUMMARY

[0003] According to an embodiment described herein, an external module for use in conjunction with a PLC backplane includes a connector configured to connect the external module to a backplane of the PLC. The external module may also include PLC monitoring module configured to receive data from the backplane of the PLC. The external module may also include a data port, wherein the external module is configured to send data from the backplane of the PLC to a cloud server via the data port on the external module. [0004] According to another embodiment described herein, a method can include receiving, by a processor of an external module that is connected to a backplane of a PLC, data from the backplane of the PLC. The method can also include sending the data from the backplane of the PLC to a cloud server via a data port on the external module.

[0005] A computer program product includes a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processing device to cause the processing device to perform a method including receiving, by the processing device of an external module that is connected to a backplane of a PLC, data from the backplane of the PLC. The method can also include sending the data from the backplane of the PLC to a cloud server via a data port on the external module.

BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Fig. 1 is a block diagram of an example system including embodiments of a programmable logic controller (PLC) and an external module for a network connection to the PLC backplane;

[0007] Fig. 2 is a block diagram of an example system including an embodiment of an external module for a network connection to a PLC backplane;

[0008] Fig. 3 is a process flow diagram of an example method for monitoring an industrial process by an embodiment of an external module for a network connection to a PLC backplane;

[0009] Fig. 4 is a process flow diagram of an example method for collecting local data from an industrial process by an embodiment of an external module for a network connection to a PLC backplane;

[0010] Fig. 5 is a process flow diagram of an example method for updating a PLC by an embodiment of an external module for a network connection to a PLC backplane; and [0011] Fig. 6 is a block diagram of an example computer system for use in conjunction with an external module for a network connection to a PLC backplane.

DETAILED DESCRIPTION

[0012] Embodiments of an external module for a network connection to a

programmable logic controller (PLC) backplane are provided, with exemplary embodiments being discussed below in detail. An external module that directly connects to a PLC backplane may allow relatively fast deployment of improved PLC functionality for an industrial process (including but not limited to a manufacturing process or a power generation process) at relatively low cost. The external module may be plugged in to, and be powered by, a connector on the PLC backplane. Relatively high throughput process data regarding the industrial process may be transferred from the PLC to a cloud server via a data port on the external module. The external module may also process data from the PLC backplane and/or one or more local data sources in order to determine representative data for transmission to a cloud server, so as to reduce the amount of data that is transferred to the cloud server.

[0013] Artificial intelligence allows optimization of industrial machinery on the fly. An artificial intelligence system may control a process with self-learning reinforcement algorithms that optimize a defined cost function (e.g., minimize power consumption per product produced), and adapt the system parameters accordingly. Other example artificial intelligence applications include condition based or predictive monitoring, in which the algorithm may notify the user when a particular part needs to be repaired to prevent downtime or damages. An artificial intelligence algorithm may require the collection of relatively large amounts of data from the industrial process during operation. An artificial intelligence module comprising a neural network may be included on an external module, and may process data regarding the industrial process before transmission to the cloud server. [0014] The external module may provide hardware-based protection for the PLC against cyberattacks, and therefore allow secured connectivity of PLC assets to a cloud server. In some embodiments, a limited shared memory on the external module may be used for communication between the external module and the PLC. Therefore, access to the external module may not allow access to the PLC itself. In some embodiments, the external module may include an encryption engine so as to securely transmit data to the cloud server. In some embodiments, encryption may also be implemented between the external module and the PLC in order to ensure that intrusions are recognized and to prevent misleading data transfer. In some embodiments, storage, such as a secure data (SD) card, in the external module may be write-protected to prevent changing of data or programs on the external module.

[0015] Because the external module is directly connected to the PLC backplane, the external module may receive data from any connected modules that transmit data through the PLC backplane to the PLC. For example, the PLC may mirror received sensor signals from the industrial process and send the sensor signals to the external module, or the external module may sniff the data traffic on the backplane in various embodiments. An external module that sniffs backplane data traffic and transfers the backplane data to a cloud server may not require any interaction with the PLC. In some embodiments, synchronous backplane data streams, which may be relatively low throughput, may be uploaded to a cloud server (e.g., MindSphere™) via the external module.

[0016] In some embodiments, one or more local data sources, such as a camera that captures video of the industrial process, and/or an ethernet connection that connects one or more elements of the industrial process, may be directly connected to the external module. The external module may process relatively high throughput data (e.g., audio, video, and/or ethernet traffic data) from the one or more local data sources, and transmit the processed data to the cloud server. In some embodiments, the processing of the data from a local data source may be performed by a neural network module on the external module. The neural network module may extract meaningful information from the high throughput data stream for transport. For example, a neural network (e.g., PointNet) may determine a type, position, and/or orientation of objects from video data. The neural network may generate filtered and compressed metadata based on the local data source, and the metadata may be sent to the cloud server along with synchronously acquired metadata from the other modules connected to the PLC backplane. Embodiments of an external module may incorporate any appropriate aspect(s) of Patent Cooperation Treaty (PCT) Application No. PCT/US2018/047030 (Attorney Docket No. 2018P10618WO), “PROGRAMMABLE LOGIC CONTROLLER-BASED MODULAR ACCELERATION MODULE FOR ARTIFICIAL INTELLIGENCE”, filed on August 20, 2018 by Siemens Corporation, which is herein incorporated by reference in its entirety.

[0017] In some embodiments, the external module may perform condition monitoring or predictive analytics based on data received from the PLC backplane or a local data source. In some embodiments, the external module may send status information at regular intervals (e.g., a life signal or data for trend analysis) to a cloud server during normal operation of the industrial process, and may send more detailed data if a fault is observed or determined to be imminent. The detailed data may be used to diagnose a fault in the industrial process.

[0018] Fig. 1 is a block diagram of an example system 100 including an embodiment of a PLC and an external module. PLC 101 includes PLC resources 102 and backplane 104. PLC resources 102 may include a PLC data port 103. The backplane 104 connects the PLC 101 to an industrial process via connections 105. Connections 105 may include a plurality of modules, such as analog or digital I/O modules, that are connected to the backplane 104 and interface with elements of the industrial processes, including but not limited to valves, sensors, and actuators. Connections 105 may transmit control data to, and receive operating data from, any appropriate elements of the industrial process. Data, such as sensor data, from connections 105 is received on backplane 104, and is used by PLC resources 102 to analyze the operation of the industrial process and to control the elements of the industrial process by transmitting commands to the elements of the industrial process via backplane 104 and connections 105. Access to the PLC resources 102 via data port 103 may expose the PLC 101 to cyberattacks; therefore, the PLC 101 may communicate with a network 109 and cloud server 110 via data port 107 on the external module 106.

[0019] External module 106 is connected to the backplane 104 of the PLC 101. The external module 106 may be powered by its connection to the backplane 104, and may have access to any data that is transmitted on the backplane 104, e.g., sensor and control data that is transmitted between connections 105 and PLC resources 102. External module 106 may be connected to one or more local data sources (e.g., a camera and/or an ethernet connection) of the industrial process via connections 108. The data port 107 on external module 106 is connected to cloud server 110 via network 109. Network 109 may be any appropriate network, such as the internet. Cloud server 110 may be any appropriate cloud server in various embodiments, including but not limited to

MindSphere™. In some embodiments, an external module such as external module 106 may be connected to multiple cloud servers via network 109. External module 106 is discussed in further detail below with respect to Fig. 2.

[0020] It is to be understood that the block diagram of Fig. 1 is not intended to indicate that the system 100 is to include all of the components shown in Fig. 1. Rather, the system 100 can include any appropriate fewer or additional components not illustrated in Fig. 1 (e.g., additional computer systems, processors, memory components, embedded controllers, modules, computer networks, network interfaces, data inputs, etc.). Further, the embodiments described herein with respect to system 100 may be

implemented with any appropriate logic, wherein the logic, as referred to herein, can include any suitable hardware (e.g., a processor, an embedded controller, or an application specific integrated circuit, among others), software (e.g., an application, among others), firmware, or any suitable combination of hardware, software, and firmware, in various embodiments. [0021] Fig. 2 is a block diagram of an example system 200 including an embodiment of an external module 201 for a network connection to a PLC backplane. System 200 shows an external module 201, which may correspond to external module 106 of Fig. 1. External module 201 includes a backplane connector 202, which may connect an external module 201 to a backplane such as backplane 104 of Fig. 1. The external module 201 may be powered via backplane connector 202. The external module 201 may also receive data regarding the industrial process from backplane 104 via backplane connector

202. In some embodiments, at least a portion of the data from the backplane connector 202 may be transmitted to a cloud server, such as cloud server 110, through data port 203 via PLC monitoring module 204. PLC monitoring module 204 is discussed below in further detail with respect to Fig. 3. Data regarding the industrial process may also be received from one or more local data sources 206 via data extraction neural network 205. In some embodiments, the local data source 206 may be connected to the external module 201 via a universal serial bus (USB) port on the external module 201. The data extraction neural network 205 may process the data from a local data source 206, and transmit the processed data to a cloud server such as cloud server 110 via the data port

203. Data extraction neural network 205 is discussed in further detail below with respect to Fig. 4. The cloud server 110 may also perform any appropriate processing regarding data received from the external module 201 in various embodiments, and may provide feedback to, or manage, one or more functions of the external module 201 and/or the PLC 101 based on the processing.

[0022] Cloud server 110 may communicate with the external module 201 via data port 203 and security module 210; the security module 210 may monitor the connection to cloud server 110 for cyberattacks. In some embodiments, software on the PLC 101 may be updated via PLC update module 207 using shared memory 208 via security module 210. The external module 201 may provide a secured gateway to enable an application framework for program download to the PLC 101. The external module 201 may only exchange a limited memory map (e.g., shared memory 208) with the PLC 101, enabling secured communication between the PLC 101 and the cloud server 110. Based on, for example, authenticating an update password (by, for example, PLC update module

207 or security module 210), the external module 201 may be triggered to transfer a new or improved application to the PLC resources 102 in pieces via limited shared memory

208 on the external module 201. PLC update module 207 and shared memory 208 are discussed in further detail below with respect to Fig. 5.

[0023] The software on the external module 201 may be updated by external update module 209 via security module 210. In some embodiments, the external module 201 may implement an application (or app) framework via the connection to the cloud server 110 of Fig. 1. In such embodiments, the external module 201 may be configured for various different functions by downloading of applications. A function may be selected and purchased from a cloud platform, and downloaded onto the external module 201 as an application. An external module 201 may support any appropriate number of applications (e.g., monitoring modules, data extraction neural network modules).

Applications on an external module 201 may implement any appropriate functions, including but not limited to: logging data that is observed on the PLC backplane (e.g., by PLC monitoring module 204), reporting on a location and orientation of an object based on video camera data from a video camera comprising a local data source 206;

monitoring network traffic in the PLC backplane 104, or in an ethernet connection in the industrial process, for cyberattacks; and support for machine control by voice commands or lip reading. Any appropriate applications may be provided to the industrial process via the external module 201 without affecting the PLC resources 102 on the PLC 101. In some embodiments, a PLC backplane 104 may support multiple external modules, each hosting one or more application(s).

[0024] Embodiments of an external module 201 may include any appropriate components and/or capabilities, including but not limited to an operating system, one or more programmable central processing units (CPUs), one or more streaming hybrid architecture vector engine (SHAVE) processors, neural network hardware acceleration, image processing hardware acceleration, real-time network connectivity to the backplane of the PLC, external connectivity through Ethernet and/or universal serial bus (USB), and a removable secure digital (SD) card storage. In some embodiments, one or more software modules of the external module 201 may be pre-installed on the external module 201. Further, any elements discussed below with respect to computer system 600 of Fig.

6 may be included in various embodiments of an external module 201. In some embodiments, the external module 201 may comprise a Technology Module Neural Processing Unit (TM NPU) from Siemens AG.

[0025] It is to be understood that the block diagram of Fig. 2 is not intended to indicate that the system 200 is to include all of the components shown in Fig. 2. Rather, the system 200 can include any appropriate fewer or additional components not illustrated in Fig. 2 (e.g., additional computer systems, processors, memory components, embedded controllers, modules, computer networks, network interfaces, data inputs, etc.). Further, the embodiments described herein with respect to system 200 may be

implemented with any appropriate logic, wherein the logic, as referred to herein, can include any suitable hardware (e.g., a processor, an embedded controller, or an application specific integrated circuit, among others), software (e.g., an application, among others), firmware, or any suitable combination of hardware, software, and firmware, in various embodiments.

[0026] Fig. 3 is a process flow diagram of an example method 300 for monitoring an industrial process by an embodiment of an external module for a network connection to a PFC backplane. Method 300 of Fig. 3 may be implemented in PFC monitoring module 204 of external module 201 of Fig. 2. In block 301, the external module 201/106 is connected directly into the backplane 104 of a PFC 101 via a backplane connector 202. The external module 201/106 may be powered by the connection to the backplane 104, and may also have access to any data that is transmitted through the PFC backplane 104. In block 302, the external module 201/106 obtains data that is being transmitted via backplane 104 to and from the elements of the industrial process via connections 105 and the PLC resources 102 of the PLC 101 during operation of the industrial process. The data that is obtained by the external module 201/106 may include but is not limited to sensor data and commands to valves and actuators in the industrial process. In various embodiments, the PLC 101 may mirror received sensor signals from the industrial process and send the sensor signals to the external module 201/106 in block 302, or the external module 201/106 may sniff the data traffic on the PLC backplane 104 in block 302.

[0027] In block 303, the PLC monitoring module 204 processes the data that is received from the backplane 104. The PLC monitoring module 204 may include a neural network in some embodiments. In some embodiments, the PLC monitoring module 204 may condense and/or encrypt the data for transmission via data port 203. In block 304, the processed data from the PLC monitoring module 204 is transmitted to cloud server 110 via data port 107/203 of the external module 106/201. In some embodiments of block 304, the external module 106/201 may send status information at regular intervals (e.g., a life signal or data for trend analysis) to cloud server 110 during normal operation of the industrial process. The external module 106/201 may send more detailed data in block 304 if a fault is observed or determined to be imminent in the processing of block

303 by PLC monitoring module 204. Detailed data that is sent to the cloud server 110 in block 304 may be used to diagnose a fault in the industrial process. Blocks 302, 303, and

304 of method 300 of Fig. 3 are repeated throughout the operation of the external module 106/201.

[0028] The process flow diagram of Fig. 3 is not intended to indicate that the operations of the method 300 are to be executed in any particular order, or that all of the operations of the method 300 are to be included in every case. Additionally, the method 300 can include any suitable number of additional operations.

[0029] Fig. 4 is a process flow diagram of an example method 400 for collecting local data from an industrial process by an embodiment of an external module for a network connection to a PLC backplane. Method 400 of Fig. 4 may be implemented in data extraction neural network 205 of external module 201 of Fig. 2. In block 401 of method 401, the external module 106/201 is directly connected to a local data source 206 in the industrial process. The local data source 206 may be any appropriate data source, including but not limited to a video camera or an ethernet connection. In block 402, the data extraction neural network 205 in the external module 106/201 receives data from the local data source 206 during operation of the industrial process. In block 403, the data extraction neural network 205 processes the received data from the local data source 206. In block 404, the processed data from the data extraction neural network 205 is transmitted to cloud server 110 via data port 107/203 of the external module 106/201. Blocks 402, 403, and 404 of method 400 of Fig. 4 are repeated throughout the operation of the external module 106/201.

[0030] The data extraction neural network 205 may extract any appropriate information from a high throughput data stream for transmission to the cloud server 110 according to method 400 of Fig. 4. For example, a neural network (e.g., PointNet) in data extraction neural network 205 may determine a type, position, and/or orientation of objects from video data from a local data source 206 comprising a video camera. In some embodiments, the data extraction neural network 205 may generate filtered and compressed metadata based on the local data source 206, and the metadata may be sent to the cloud server 110 along with synchronously acquired metadata from other modules connected to the PLC backplane 104 that is received by PLC monitoring module 204.

[0031] In some embodiments, local data source 206 may comprise an Ethernet-based communication line within the industrial process. The external module 201 may sniff data packets that are exchanged between elements of the industrial process on the communication line. Various information regarding the data packets on the

communication line, including but not limited to data packet timing, origin, and/or size, may be fed into data extraction neural network 205 in block 402 to monitor the industrial process for, for example, errors and/or cyberattacks in block 403. If the data extraction neural network 205 determines a possible cyberattack based on the processing of block 403, information on the detected possible attack may be communicated through the backplane 104 from the external module 106 to the PLC 101, where countermeasures may be taken. Possible countermeasures that may be taken by the PLC 101 include but are not limited to changing an internet protocol (IP) address, changing an encryption key, communicating on a different network, ignoring packets from an intruder, and/or shutting down communications or production.

[0032] The process flow diagram of Fig. 4 is not intended to indicate that the operations of the method 400 are to be executed in any particular order, or that all of the operations of the method 400 are to be included in every case. Additionally, the method 400 can include any suitable number of additional operations.

[0033] Fig. 5 is a process flow diagram of an example method 500 for updating a PLC by an embodiment of an external module for a network connection to a PLC backplane. Method 500 of Fig. 5 may be implemented using PLC update module 207 and shared memory 208 via security module 210 of external module 201 of Fig. 2. In block 501 of method 500, a cloud server 110 provides update credentials to PLC update module 207 on the external module 201/106. In block 502, the PLC update module 207 verifies whether the credentials that were received in block 501 are valid. If the credentials are not verified in block 502, flow proceeds from block 502 to block 503, and method 500 ends. If the credentials are verified in block 502, flow proceeds from block 502 to block 504. In block 504, the PLC update module 207 receives update software from the cloud server 110 via data port 203 and security module 210, and stores the received update software in shared memory 208. The update software that is received in block 504 may be an entire software update in some embodiments; in other embodiments the update software that is received in block 504 may be a portion of a software update package.

The portion of the update software that is received in block 504 may be determined based on the size of the shared memory 208. In block 505, the update software that was stored in shared memory 208 is transferred to a memory in PLC resources 102 of PLC 101. [0034] In block 506, it is determined whether the entire software update has been received by PLC 101. If it is determined in block 506 that the entire software update has not been received, flow proceeds from block 506 back to block 504, in which the PLC update module 207 receives additional update software from the cloud server 111, and stores the additional update software in shared memory 208. The additional update software is then transferred to the PLC resources 102 of PLC 101 from the shared memory 208 in block 505. Blocks 504 and 505 are repeated until it is determined in block 506 that the entire software update package has been received on the PLC 101, at which point flow proceeds to block 507. In block 507, the PLC 101 may install the software update. In some embodiments, the PLC 101 may authenticate and/or check the software update package for errors before installing the software update in block 507.

[0035] In some embodiments, once the full application is determined to be received by the PLC 101 in block 506, the full download of the application may be checked for accuracy by PLC 101 using an encoding approach. In some embodiments, based on determining that the application transfer has completed without error, and authenticity of the application download is confirmed, in block 507, the PLC 101 may install the new application in a container framework, and start the application in the container (based on , e.g., docker technology) as a separate process with limited resource access to allow continuous operation of the available PLC resources 102. A testing application on the PLC 101 may then generate and transfer testing results regarding the operation of the new application in the container through the backplane 104 and external module 106 to cloud server 110. The application may be validated at the cloud server 110 based on the received testing results. Based on the validation, the cloud server 110 may send a signal for the PLC 101 to execute the new application outside of the container.

[0036] The process flow diagram of Fig. 5 is not intended to indicate that the operations of the method 500 are to be executed in any particular order, or that all of the operations of the method 500 are to be included in every case. Additionally, the method 500 can include any suitable number of additional operations. [0037] Turning now to FIG. 6, a computer system 600 is generally shown in accordance with an embodiment. Embodiments of a computer system 600 such as is shown in Fig. 6 may be used to implement, or may be used in conjunction with, any element or elements of an external module for a PLC backplane that are discussed above with respect to Figs. 1-5. The computer system 600 can be an electronic, computer framework comprising and/or employing any number and combination of computing devices and networks utilizing various communication technologies, as described herein. The computer system 600 can be easily scalable, extensible, and modular, with the ability to change to different services or reconfigure some features independently of others. The computer system 600 may be, for example, a server, desktop computer, laptop computer, tablet computer, or smartphone. In some examples, computer system 600 may be a cloud computing node. Computer system 600 may be described in the general context of computer system executable instructions, such as program modules, being executed by a computer system. Generally, program modules may include routines, programs, objects, components, logic, data structures, and so on that perform particular tasks or implement particular abstract data types. Computer system 600 may be practiced in distributed cloud computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed cloud computing environment, program modules may be located in both local and remote computer system storage media including memory storage devices.

[0038] As shown in FIG. 6, the computer system 600 has one or more central processing units (CPU(s)) 601a, 601b, 601c, etc. (collectively or generically referred to as processor(s) 601). The processors 601 can be a single-core processor, multi-core processor, computing cluster, or any number of other configurations. The processors 601, also referred to as processing circuits, are coupled via a system bus 602 to a system memory 603 and various other components. The system memory 603 can include a read only memory (ROM) 604 and a random access memory (RAM) 605. The ROM 604 is coupled to the system bus 602 and may include a basic input/output system (BIOS), which controls certain basic functions of the computer system 600. The RAM is read- write memory coupled to the system bus 602 for use by the processors 601. The system memory 603 provides temporary memory space for operations of said instructions during operation. The system memory 603 can include random access memory (RAM), read only memory, flash memory, or any other suitable memory systems.

[0039] The computer system 600 comprises an input/output (I/O) adapter 606 and a communications adapter 607 coupled to the system bus 602. The I/O adapter 606 may be a small computer system interface (SCSI) adapter that communicates with a hard disk 608 and/or any other similar component. The I/O adapter 606 and the hard disk 608 are collectively referred to herein as a mass storage 610.

[0040] Software 611 for execution on the computer system 600 may be stored in the mass storage 610. The mass storage 610 is an example of a tangible storage medium readable by the processors 601, where the software 611 is stored as instructions for execution by the processors 601 to cause the computer system 600 to operate, such as is described herein below with respect to the various Figures. Examples of computer program product and the execution of such instruction is discussed herein in more detail. The communications adapter 607 interconnects the system bus 602 with a network 612, which may be an outside network, enabling the computer system 600 to communicate with other such systems. In one embodiment, a portion of the system memory 603 and the mass storage 610 collectively store an operating system, which may be any appropriate operating system, to coordinate the functions of the various components shown in FIG. 6.

[0041] Additional input/output devices are shown as connected to the system bus 602 via a display adapter 615 and an interface adapter 616 and. In one embodiment, the adapters 606, 607, 615, and 616 may be connected to one or more I/O buses that are connected to the system bus 602 via an intermediate bus bridge (not shown). A display 619 (e.g., a screen or a display monitor) is connected to the system bus 602 by a display adapter 615, which may include a graphics controller to improve the performance of graphics intensive applications and a video controller. A keyboard 621, a mouse 622, a speaker 623, etc. can be interconnected to the system bus 602 via the interface adapter 616, which may include, for example, a Super I/O chip integrating multiple device adapters into a single integrated circuit. Suitable I/O buses for connecting peripheral devices such as hard disk controllers, network adapters, and graphics adapters typically include common protocols, such as the Peripheral Component Interconnect (PCI). Thus, as configured in Fig. 6, the computer system 600 includes processing capability in the form of the processors 601, and, storage capability including the system memory 603 and the mass storage 610, input means such as the keyboard 621 and the mouse 622, and output capability including the speaker 623 and the display 619.

[0042] In some embodiments, the communications adapter 607 can transmit data using any suitable interface or protocol, such as the internet small computer system interface, among others. The network 612 may be a cellular network, a radio network, a wide area network (WAN), a local area network (LAN), or the Internet, among others.

An external computing device may connect to the computing system 600 through the network 612. In some examples, an external computing device may be an external Webserver or a cloud computing node.

[0043] It is to be understood that the block diagram of Fig. 6 is not intended to indicate that the computer system 600 is to include all of the components shown in Fig. 6. Rather, the computer system 600 can include any appropriate fewer or additional components not illustrated in Fig. 6 (e.g., additional memory components, embedded controllers, modules, additional network interfaces, etc.). Further, the embodiments described herein with respect to computer system 600 may be implemented with any appropriate logic, wherein the logic, as referred to herein, can include any suitable hardware (e.g., a processor, an embedded controller, or an application specific integrated circuit, among others), software (e.g., an application, among others), firmware, or any suitable combination of hardware, software, and firmware, in various embodiments. [0044] Although specific embodiments of the disclosure have been described, one of ordinary skill in the art will recognize that numerous other modifications and alternative embodiments are within the scope of the disclosure. For example, any of the

functionality and/or processing capabilities described with respect to a particular system, system component, device, or device component may be performed by any other system, device, or component. Further, while various illustrative implementations and architectures have been described in accordance with embodiments of the disclosure, one of ordinary skill in the art will appreciate that numerous other modifications to the illustrative implementations and architectures described herein are also within the scope of this disclosure. In addition, it should be appreciated that any operation, element, component, data, or the like described herein as being based on another operation, element, component, data, or the like may be additionally based on one or more other operations, elements, components, data, or the like. Accordingly, the phrase“based on,” or variants thereof, should be interpreted as“based at least in part on.”

[0045] The present disclosure may be a system, a method, apparatus, and/or a computer program product. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present disclosure.

[0046] The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

[0047] Computer readable program instructions described herein can be downloaded to respective computing/processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and/or a wireless network. The network may comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. A network adapter card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing/processing device.

[0048] Computer readable program instructions for carrying out operations of the present disclosure may be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field- programmable gate arrays (FPGA), or programmable logic arrays (PLA) may execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

[0049] Aspects of the present disclosure are described herein with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer readable program instructions.

[0050] These computer readable program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer readable program instructions may also be stored in a computer readable storage medium that can direct a computer, a

programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including instructions which implement aspects of the function/act specified in the flowchart and/or block diagram block or blocks. [0051] The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process, such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions/acts specified in the flowchart and/or block diagram block or blocks.

[0052] The flowchart and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, apparatus, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware- based systems that perform the specified functions or acts or carry out combinations of special purpose hardware and computer instructions.

[0053] The descriptions of the various embodiments of the present techniques have been presented for purposes of illustration, but are not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein was chosen to best explain the principles of the embodiments, the practical application or technical improvement over technologies found in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

CLAIMS What is claimed is:

1. An external module for use in conjunction with a programmable logic controller (PLC), the external module comprising: a connector configured to connect the external module to a backplane of the PLC; a PLC monitoring module configured to receive data from the backplane of the PLC; and a data port, wherein the external module is configured to send data from the backplane of the PLC to a cloud server via the data port on the external module.

2. The external module of claim 1, wherein the data from the backplane of the PLC comprises sensor data and control data from an industrial process that is controlled by the PLC, and wherein the external module is powered via the connector to the backplane of the PLC.

3. The external module of claim 1, further comprising a PLC update module and a shared memory, the PLC update module configured to: receive update credentials from the cloud server; based on the update credentials, receive a software package from the cloud server; store the software package in the shared memory; and transfer the software package from the shared memory to the PLC, wherein the software package installs an application on the PLC.

4. The external module of claim 3, wherein receiving the software package from the cloud server comprises: receiving a first portion of the software package, a size of the first portion of the software package corresponding to a size of the shared memory; storing the first portion of the software package in the shared memory; transferring the first portion of the software package from the shared memory to the PLC; and based on transferring the first portion of the software package from the shared memory to the PLC, receiving a second portion of the software package from the cloud server; wherein the application is installed on the PLC based on receiving an entirety of the software package from the external module by the PLC.

5. The external module of claim 1, further comprising a connection to a local data source and a data extraction neural network, the data extraction neural network configured to receive data from the local data source and process the received data from the local data source, and wherein the processed data is transmitted to the cloud server via the data port on the external module.

6. The external module of claim 5, wherein the local data source comprises an ethernet connection of an industrial process, wherein the received data from the local data source comprises data regarding packets that are transmitted on the ethernet connection; and wherein the data extraction neural network is configured to: determine a cyberattack in the industrial process based on the data from the local data source; and notify the PLC regarding the determined cyberattack.

7. The system of claim 5, wherein the local data source comprises a video camera, wherein the received data comprises video data of an industrial process, and wherein the data extraction neural network is configured to determine a type, an orientation, and a location of an element of the industrial process based on the video data.

8. A computer-implemented method, comprising: receiving, by a processor of an external module that is connected to a backplane of a PLC, data from the backplane of the PLC; and sending the data from the backplane of the PLC to a cloud server via a data port on the external module.

9. The computer-implemented method of claim 8, wherein the data from the backplane of the PLC comprises sensor data and control data from an industrial process that is controlled by the PLC, and wherein the external module is powered via the connection to the backplane of the PLC.

10. The computer- implemented method of claim 8, comprising: receiving update credentials from the cloud server; based on the update credentials, receiving a software package from the cloud server; storing the software package in a shared memory of the external module; and transferring the software package from the shared memory to the PLC, wherein the software package installs an application on the PLC.

11. The computer-implemented method of claim 10, wherein receiving the software package from the cloud server comprises: receiving a first portion of the software package, a size of the first portion of the software package corresponding to a size of the shared memory; storing the first portion of the software package in the shared memory; transferring the first portion of the software package from the shared memory to the PLC; and based on transferring the first portion of the software package from the shared memory to the PLC, receiving a second portion of the software package from the cloud server; wherein the application is installed on the PLC based on receiving an entirety of the software package from the external module by the PLC.

12. The computer-implemented method of claim 8, comprising: receiving data from a local data source that is connected to the external module by a data extraction neural network on the external module; processing the received data from the local data source by the data extraction neural network; and transmitting the processed data to the cloud server via the data port on the external module.

13. The computer- implemented method of claim 12, wherein the local data source comprises an ethernet connection of an industrial process, wherein the received data from the local data source comprises data regarding packets that are transmitted on the ethernet connection, and further comprising: determining a cyberattack in the industrial process based on the data from the local data source by the data extraction neural network; and notify the PLC regarding the determined cyberattack.

14. The computer- implemented method of claim 12, wherein the local data source comprises a video camera, wherein the received data comprises video data of an industrial process, and further comprising: determining a type, an orientation, and a location of an element of the industrial process based on the video data by the data extraction neural network.

15. A computer program product comprising: a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processing device to cause the processing device to perform a method comprising: receiving, by the processing device in an external module that is connected to a backplane of a PLC, data from the backplane of the PLC; and sending the data from the backplane of the PLC to a cloud server via a data port on the external module.

16. The computer program product of claim 15, wherein the data from the backplane of the PLC comprises sensor data and control data from an industrial process that is controlled by the PLC, and wherein the external module is powered via the connection to the backplane of the PLC.

17. The computer program product of claim 15, comprising: receiving update credentials from the cloud server; based on the update credentials, receiving a software package from the cloud server; storing the software package in a shared memory of the external module; and transferring the software package from the shared memory to the PLC, wherein the software package installs an application on the PLC.

18. The computer program product of claim 17, wherein receiving the software package from the cloud server comprises: receiving a first portion of the software package, a size of the first portion of the software package corresponding to a size of the shared memory; storing the first portion of the software package in the shared memory; transferring the first portion of the software package from the shared memory to the PLC; and based on transferring the first portion of the software package from the shared memory to the PLC, receiving a second portion of the software package from the cloud server; wherein the application is installed on the PLC based on receiving an entirety of the software package from the external module by the PLC.

19. The computer program product of claim 15, comprising: receiving data from a local data source that is connected to the external module by a data extraction neural network on the external module; processing the received data from the local data source by the data extraction neural network; and transmitting the processed data to the cloud server via the data port on the external module.

20. The computer program product of claim 19, wherein the local data source comprises an ethernet connection of an industrial process, wherein the received data from the local data source comprises data regarding packets that are transmitted on the ethernet connection, and further comprising: determining a cyberattack in the industrial process based on the data from the local data source by the data extraction neural network; and notify the PLC regarding the determined cyberattack.