WO2021233552A1

WO2021233552A1 - Redundant control logic for safety-criticial automation systems based on artificial neural networks

Info

Publication number: WO2021233552A1
Application number: PCT/EP2020/064295
Authority: WO
Inventors: Alfred GERLACH; Günther APEL
Original assignee: Tsu Gmbh Gesellschaft Für Technik, Sicherheit Und Umweltschutz Mbh
Priority date: 2020-05-22
Filing date: 2020-05-22
Publication date: 2021-11-25

Abstract

A method (100) for generating one or more manipulated variables (12) for at least one actuator (3) of an automation system (1), comprising the following steps:. one or more input variables (11) are obtained (110) from the automation system (1);. the input variables (11) are processed (120) by a first control logic (4a) to give a first suggestion (12a) for the one or more manipulated variables (12);. the input variables (11) are processed (130) by a second control logic (4b), which is independent of the first control logic (4a), to give a second suggestion (12b) for the one or more manipulated variables (12);. the two suggestions (12a, 12b) for the one or more manipulated variables (12) are checked against one another for plausibility (140); and. in response to the two suggestions (12a, 12b) being found to be plausible with respect to one another (150) in this check, an end result of the one or more manipulated variables (12) is determined (160) from the two suggestions (12a, 12b), wherein a second control logic (4b) is selected with an artificial neural network, ANN (4b*), which is trained to predict a suggestion (12b) for the manipulated variables (12) for given values of the input variables (11), which suggestion matches the suggestion (12a) of the first control logic (4a) with regard to these values of the input variables (11).

Description

Redundant control logic for safety-critical automation systems based on artificial neural networks. The invention relates to automation systems whose control logic is designed redundantly so that malfunctions in the control logic can be recognized and countermeasures can be initiated.

State of the art

Automation systems control machines or processes on the basis of higher-level specifications that are obtained from a control system and / or from a sensor system. A control logic converts these specifications into concrete manipulated variables. Actuators that have a physical effect on the machine or the process are controlled with these manipulated variables.

Automation systems are also increasingly used in safety-critical areas in which property damage or personal injury can be caused if the control logic outputs a manipulated variable that is not appropriate for the current operating situation and this manipulated variable is translated by the actuator into an action that is disadvantageous in the current situation. Since a control logic, like any other technical device, can in principle malfunction or fail, two or more redundant control logics are used for safety-critical applications, the outputs of which are checked against each other for plausibility before they are fed to the respective actuator. This is based on the consideration that the probability of a simultaneous and similar malfunction of both control logics, which affects the outputs of both control logics in the same way, is very low. Task and solution

The object of the present invention is to implement redundant generation of manipulated variables in an automation system with a particularly favorable ratio of cost to operational reliability.

According to the invention, this object is achieved by a method according to the main claim and by an automation system according to the secondary claim. Further advantageous refinements emerge from the subclaims that refer back to them.

Disclosure of the invention

In the context of the invention, a method for generating one or more manipulated variables for at least one actuator of an automation system was developed.

As part of this process, one or more input variables are obtained from the automation system. These input variables can originate, for example, from a control system, an associated periphery, and / or from a sensor system or any other signal transmitters. The input variables can, for example, be setpoint values to which one or more variables relevant to the operation of the machine or the process are to be regulated. Examples of such quantities are temperatures, pressures, voltages, currents, chemical concentrations, positions and speeds.

The input variables are processed by a first control logic to form a first proposal for the one or more manipulated variables. This first control logic can, for example, be a regulator (“low-level controller”) which is designed to regulate one or more of the aforementioned variables relevant to the operation of the machine or the process to setpoint values. Alternatively or in combination for this purpose, the first control logic can, for example, control movements of machine parts or vehicles in such a way that collisions with other machine parts or vehicles are avoided. The input variables are also processed by a second control logic, which is independent of the first control logic, to form a second proposal for the one or more manipulated variables. This independence can in particular also include, for example, that the input variables of the first control logic, on the one hand, and the second control logic, on the other hand, are fed in as far as possible different ways. The input variables can therefore, for example, be taken from the automation system in two ways that are independent of one another.

The two suggestions for the manipulated variables are checked against each other for plausibility. In response to the fact that the two proposals here prove to be plausible to one another, an end result of the one or more manipulated variables is determined from the two proposals. For example, it can be checked whether both control logics suggest the same or at least similar action of the actuator at the same time.

A second control logic with an artificial neural network, ANN, is chosen. This ANN is trained to predict a proposal for the manipulated variables for given values of the input variables, which proposal agrees with the proposal of the first control logic with regard to these values of the input variables.

It was recognized that in this way the redundancy in the generation of the manipulated variables can be implemented with lower costs. It is not necessary to completely duplicate the hardware of the first control logic. Instead, all that is required is standard hardware that performs the inference calculation of the ANN, i.e. translates input variables based on a suggestion for manipulated variables, can. This hardware does not even have to be kept at the location where the first control logic is physically implemented. Rather, the second control logic can also be implemented in a cloud, for example. Since completely different hardware and software are inevitably used for the inference calculation than in the first control logic, a diversity is automatically created between the first control logic and the second control logic. If the second control logic is a duplicate of the first control logic, the plausibility is particularly easy to check because it is to be expected that the outputs of both control logics are always the same. The duplicate also has sources of error in common with the original, which increases the probability of simultaneous and similar failures of both control logics. Hardware of the same type and in particular a CPU of the same type is used, possibly even from the same production batch. For example, if both CPUs are affected by the same material or manufacturing defect and after a certain number

Operating hours one CPU fails, the other CPU, which has experienced exactly the same load-time profile, may physically look the same, so that the second CPU could fail at the same time or a little later. Many users of RAID systems have already had corresponding painful experiences in computer technology, which store the data to protect against loss in a redundant array of several hard drives: Almost at the same time, more hard drives of the same construction failed than could be handled by the redundancy.

A diverse solution in which two conventional control logics are obtained from different manufacturers can significantly reduce the likelihood of such simultaneous failures. Compared to such a solution, the use of a second control logic with a trained ANN is significantly cheaper, not only with regard to the hardware. It also eliminates the additional effort that would be required to acquire the know-how for dealing with a further control logic and to continuously maintain and control this further control logic maintain. Furthermore, if the ANN is sufficiently trained, it can be expected that in the error-free state the outputs of the ANN are closer to the outputs of the first control logic than the outputs of the second control logic. If the output of the ANN is compared with the output of the first control logic, this is more meaningful than if the output of the second control logic is compared with the output of the first control logic.

Thus, in a particularly advantageous embodiment, the two proposals are checked for plausibility against one another by comparing them with one another. The two proposals are rated as plausible to one another if a deviation determined in this comparison is within a specified tolerance. Furthermore, it can also be stipulated that the two proposals must also be delivered at times that differ from one another by a maximum of a specified tolerance in order to be assessed as plausible to one another. This time dimension can also be included in the training of the ANN. When training the ANN, for example, it can be assessed not only whether the ANN maps certain values of the input variables to the same manipulated variables as the first control logic does, but also whether the ANN delivers these values at the same time as the first control logic.

If the two proposals prove to be implausible with one another, any countermeasures can be taken. In particular, for example, the output of manipulated variables can be suppressed and / or some other measure can be initiated to put a machine or system controlled by the automation system or a process controlled by the automation system into a safe state or to leave it there .

For example, the two suggestions can be fed into a comparator which only outputs a manipulated variable to the actuator if the two suggestions are plausible to one another, that is to say, for example, are sufficiently similar. The two Proposals can also be routed, for example, into a failsafe device which, in response to the fact that the two proposals are not plausible to one another, interrupts the energy supply to the machine or the process or forces the machine or the process into a safe state in some other way .

The advantage of the ANN lies in its power to generalize. The ANN can be trained, for example, on the basis of a finite number of situations that have sufficient variability. It is then able to predict a proposal for the manipulated variables that corresponds to the proposal of the first control logic with regard to these values of the input variables, even in a wide range of situations embodied by values of the input variables that were not the subject of the training.

This power to generalize can not only be used to secure the ongoing operation of the control logic. Before a control logic can even be used in safety-relevant applications, it must generally be checked and approved. During this test, the control logic must prove in a large number of situations that it is outputting the correcting variable values that are appropriate for the respective situation. For this purpose, a large number of values of the input variables are applied to the control logic, each representing a situation, and the values of the manipulated variables received from the control logic are checked to determine whether they represent an appropriate response in the context of the intended use of the control logic in a specific automation system.

It was recognized that with a trained ANN that has learned the behavior of the control logic and is therefore a “digital twin” of this control logic, the time required for such a test can be significantly reduced. For this purpose, the invention provides a method for checking a control logic which processes one or more input variables obtained from an automation system into one or more manipulated variables. As part of this method, an artificial neural network, ANN, is provided which is trained to predict a proposal for the manipulated variables for given values of the input variables, which proposal corresponds to the proposal of the control logic with regard to these values of the input variables. The ANN is supplied with test values for the input variables that relate to specified test scenarios. The ANN maps the test values of the input variables to test values of the manipulated variables. The test values of the input variables can in particular include values that do not belong to the learning values of the input variables used during training. Ideally, the set of Lem values for the input variables is disjoint to the set of test values for the input variables.

The response behavior of the ANN, characterized in each case by the test values of the manipulated variables, is now checked on the basis of specified criteria to determine whether it would be appropriate in the context of the intended use of the control logic in a specific automation system. In response to that

Response behavior of the ANN is recognized as appropriate overall, it is determined that the test of the control logic has been passed.

Due to its training, the ANN behaves like the control logic to be tested, i.e. it supplies test values for the manipulated variables that are the same or at least very similar to the values of the manipulated variables that the control logic would have provided in its place. However, the ANN can be operated on much faster hardware than the control logic. Therefore, the test values of the manipulated variables can be received by the ANN much faster than the control logic could supply them. In normal operation of the control logic, the values of the manipulated variables are not required so quickly. at However, the test requires such values in much larger numbers than in normal operation, so that the processing speed of the control logic would be a bottleneck during the test. This bottleneck can be eliminated by temporarily running the ANN on faster hardware such as graphics processors (GPUs). For example, GPUs can be rented by the hour or even by the minute from cloud providers if the control logic is to be checked. The GPUs can also be used to train the ANN on the behavior of the control logic to be tested.

In particular, for example, complete setpoint curves of the input variables and / or manipulated variables, along which the machine and / or the process is to travel, can be run through with the aid of the ANN as a “digital twin” with very small increments. This makes the test significantly more complete compared to the previous state of the art, in which a relatively large step size had to be selected for reasons of time.

The test of whether the response behavior of the ANN is appropriate can be carried out according to any criteria. In particular, these criteria can include, for example, boundary conditions for the values of the manipulated variables that are specified by the specific automation system. If the test values of the manipulated variables do not comply with these boundary conditions, the response behavior of the ANN cannot be implemented as it is in the specific automation system.

An approach that can be used as an alternative to or in combination with the aforementioned test measures the extent to which the behavior of the control logic can be learned from an ANN. If the behavior is easy to learn, this indicates that it is internally consistent. If, on the other hand, the behavior is difficult to learn, this indicates that it contains parts that are in the context of the automation system are not plausible. If, for example, an integer overflow occurs in certain situations in the control logic, so that an integer value that has risen too high is suddenly capped to zero and counts up again from there, this behavior is completely surprising and does not follow any recognizable pattern that an ANN could capture during training.

The invention therefore provides a further method for checking a control logic which processes one or more input variables obtained from an automation system into one or more manipulated variables.

As part of this process, a large number of learning values for the input variables as well as associated learning values for the manipulated variables are provided. The learning values of the manipulated variables can, for example, be values of the manipulated variables that the control logic to be tested suggests for the Lem values of the input variables. The learning values of the manipulated variables can, however, alternatively or also in combination with this, also be generated, for example, from prior knowledge of the specific automation system.

An artificial neural network, ANN, is trained in such a way that it applies the learning values of the input variables to the respective associated learning values of the

Maps manipulated variables. After this training, test values of the input variables, which relate to specified test scenarios, are fed to both the control logic and the ANN. The test values of the input variables can in particular include values that do not belong to the Lem values of the input variables used during training. Ideally, the set of Lem values for the input variables is disjoint to the set of test values for the input variables.

Proposals for values of the manipulated variables, to which the control logic on the one hand and the ANN on the other hand map the test values of the input variables, are checked against each other for plausibility. In response to this being for a given proportion of the test scenarios, the two proposals prove to be plausible to each other, it is determined that the test of the control logic has been passed. In particular, the aforementioned integer overflow or other sporadically occurring problems are either not learned at all by the ANN with high probability or are also generalized to other situations. When comparing the proposals for the values of the manipulated variables that the ANN on the one hand and the control logic output on the other, both lead to greater deviations.

The method for generating manipulated variables during operation of the automation system and the first-mentioned method for checking a control logic each require an ANN that has already been trained. The invention also provides a method for training an ANN for use in one of these methods.

In this method, a control logic, the behavior of which the ANN is supposed to predict in a specific automation system, is supplied with a large number of Lem values of the input variables that are realistic in the context of this automation system. These learning values of the input variables are mapped by the control logic to Lem values of manipulated variables of the automation system. In this way, the learning values of the input variables are "labeled" as to which values of the manipulated variables the ANN should generate from these Lem values. The learning values of the input variables are fed to the ANN. The ANN maps the Lem values of the input variables to values of the manipulated variables. Parameters that characterize the behavior of the ANN are optimized with the aim that the values of the manipulated variables, to which the ANN maps the Lem values of the input variables, are plausible with the learning values of the output variables. These parameters can in particular be, for example, weights with which inputs, the neurons of the ANN are supplied to be added to activations of the respective neurons.

This training of the ANN is a monitored training, whereby the behavior of the control logic serves as the "ground truth" on the basis of which the ANN learns.

The optimization can in particular, for example, be aimed at ensuring that the values of the manipulated variables, to which the ANN maps specific learning values of the input variables, match the associated learning values of the manipulated variables as closely as possible in accordance with a cost function.

Alternatively or also in combination with this, the optimization can be aimed at clustering defined data points through the learning values of the input variables in combination with the associated learning values of the output variables and / or expressing them using a compressed representation.

In particular, the methods can be implemented entirely or partially by computer. The invention therefore also relates to a computer program with machine-readable instructions which, when they are executed on one or more computers, cause the computer or computers to carry out one of the described methods. In this sense, control devices for vehicles and embedded systems for technical devices, which are also able to execute machine-readable instructions, are to be regarded as computers. The invention also relates to a machine-readable data carrier and / or to a download product with the computer program. A download product is a digital product that can be transmitted via a data network, ie can be downloaded by a user of the data network and that can be offered for sale for immediate download in an online shop, for example. Furthermore, a computer can be equipped with the computer program, with the machine-readable data carrier or with the download product.

The invention also relates to an automation system for controlling a machine and / or a process. This automation system comprises at least one control system, at least one periphery, and / or at least one signal generator, which are designed to provide state variables and / or setpoints of the machine or the process as input variables. A first control logic is provided which is designed to process the input variables into a first proposal for one or more manipulated variables.

A second control logic with an artificial neural network, ANN, is provided. The ANN is trained to predict a proposal for the manipulated variables for given values of the input variables, which proposal corresponds to the proposal of the first control logic with regard to these values of the input variables.

Means are also provided for checking the plausibility of the suggestion of the first control logic against the suggestion of the second control logic and an evaluation unit for determining an end result of the manipulated variables from suggestions that are assessed as mutually plausible by the said means. Said means and the evaluation unit can in particular also be combined, for example, in one device or in an assembly.

Areas of application in which safety-relevant automation systems are operated and which can benefit from the described methods and the automation system are, for example: • Conveyor systems in mining; · Elevator systems; • Process industry, for example control and monitoring of exothermic processes;

• Automation tasks in the rail industry, such as the remote control of train systems in goods handling;

• Automation tasks in vehicles, such as autonomous driving or the detection of situations in which the airbag is to be deployed;

• Automation tasks in aircraft, such as autopilots or automatic landing systems;

• Machine tools in which, for example, setting up, troubleshooting, special operation or automatic operation must be automated at increased speeds;

• Forming machines in which, for example, the tool change, the monitoring of movement areas or the avoidance of impermissible axis positions must be automated;

• Packaging machines, in which a safe operational stop is to be guaranteed in the event of a process disruption; as

• Printing and converting machines in which the monitoring of protection areas and the maintenance of reduced speeds and safe directions of rotation must be automated.

Special descriptive part

The subject matter of the invention is explained below with reference to figures, without the subject matter of the invention being limited thereby. It is shown:

FIG. 1: exemplary embodiment of the method 100 for generating manipulated variables 12; FIG. 2: exemplary embodiment of the method 200 for checking a control logic 4a; FIG. 3: exemplary embodiment of the method 300 for checking a control logic 4a; FIG. 4: exemplary embodiment of training method 400;

FIG. 5: exemplary embodiment of the automation system 1;

FIG. 6: Path-speed diagram in an exemplary application of the automation system 1 in mining.

FIG. 1 is a schematic flow diagram of an exemplary embodiment of the method 100 for generating manipulated variables 12. In step 110, one or more input variables 11 are obtained from the automation system 1.

These input variables 11 are processed in step 120 by a first control logic 4a to form a first suggestion 12a for the one or more manipulated variables 12.

In parallel with this, the input variables 11 are also processed in step 130 by a second control logic 4b, which contains an ANN 4b *, to form a second suggestion 12b for the one or more manipulated variables 12. The ANN 4b * is trained to predict a suggestion 12b for the manipulated variables 12 for given values of the input variables 11, which proposal corresponds to the suggestion 12a of the first control logic 4a with regard to these values of the input variables 11.

In step 140, the two proposals 12a, 12b for the one or more manipulated variables 12 are checked for plausibility against one another. In response to the fact that the two proposals 12a, 12b prove to be plausible to one another (truth value 1 for diamond 150), a final result of the one or more manipulated variables (12) is determined in step 160 from the two proposals 12a, 12b. If, on the other hand, the two suggestions 12a, 12b turn out to be implausible to one another (truth value 0 for Diamant 150), the output of manipulated variables is suppressed in step 170 and / or another measure is initiated in step 180 to shut down a machine controlled by the automation system 1 or plant, or one of the automation system 1 controlled process to put in a safe state or to leave there.

Within the box 140 it is shown by way of example how the proposals 12a, 12b can be checked for plausibility with respect to one another. According to block 141, the

Proposals 12a, 12b are compared with one another. If the deviation determined in this comparison 141 is within a specified tolerance (truth value 1 for diamond 142), and optionally the two suggestions 12a, 12b are also delivered at times that differ from each other by a maximum of a specified tolerance (truth value 1 for diamond 143) , the two proposals 12a, 12b can be rated as plausible to one another.

FIG. 2 is a schematic flow diagram of an exemplary embodiment of the method 200 for checking a control logic 4a. In step 210 the trained KNN 4b * is provided. In step 220, the KNN 4b * test values 11 * of the input variables 11, which relate to predetermined test scenarios. The test values 11 * are mapped to test values 12 * of the manipulated variables 12 by the ANN 4b * in step 230. That characterized by the test values 12 * of the manipulated variables 12 in each case

Response behavior of the ANN 4b * is checked in step 240 on the basis of predetermined criteria to determine whether it would be appropriate in the context of the intended use of the control logic 4a in a specific automation system 1. If this is the case (truth value 1 in the case of diamond 250), it is determined in step 260 that the test of the control logic 4a has been passed.

FIG. 3 is a schematic flow diagram of an exemplary embodiment of the method 300 for checking a control logic 4a. In step 310, a large number of Lem values 11 # of the input variables 11 as well as associated learning values 12 # of the manipulated variables 12 are provided. In step 320 an artificial neural Network, KNN 4b *, trained to the effect that it maps the learning values 11 # of the input variables 11 to the respective associated learning values 12 # of the manipulated variables 12. In step 330, test values 11 * of the input variables 11, which relate to predetermined test scenarios, are fed to both the control logic 4a and the ANN 4b *. The control logic 4a and the ANN 4b * then supply suggestions 12a and 12b for the manipulated variables 12. These suggestions 12a, 12b are checked for plausibility against one another in step 340. In response to the fact that the two suggestions 12a, 12b each prove to be plausible to one another for a given proportion of the test scenarios (truth value 1 for diamond 350), it is determined in step 360 that the test of control logic 4a has been passed.

FIG. 4 is a schematic flow diagram of the method 400 for training the ANN 4b * in one of the previously described methods 100, 200 In the context of this automation system 1, realistic Lem values 11 # of the input variables 11 are supplied. These learning values 11 # of the input variables 11 are each mapped in step 420 by the control logic 4a to learning values 12 # of manipulated variables 12 of the automation system 1. That is, the control logic 4a is the source for the learning values 12 # of the manipulated variables 12.

The learning values 11 # of the input variables 11 are fed to the KNN 4b * in step 430, so that the KNN 4b * in step 440 the learning values 11 # of the

Input variables 11 are mapped to values of the manipulated variables 12. In step 450, parameters 4b #, which characterize the behavior of the ANN 4b *, are optimized with the aim that the values of the manipulated variables 12 to which the ANN 4b * maps the learning values 11 # of the input variables 11 to the learning Values 12 # of the output variables 12 are plausible. The termination criterion for this optimization 450 is arbitrary. According to block 451, the optimization 450 can for example be aimed at ensuring that the values of the manipulated variables 12, to which the ANN 4b * maps concrete learning values 11 # of the input variables 11, are as good as possible with the associated Lem values 12 # in accordance with a cost function. of the manipulated variables 12 match.

According to block 452, the optimization 450 can be aimed at clustering defined data points using the learning values 11 # of the input variables 11 in combination with the associated Lem values 12 # of the output variables 12 and / or expressing them using a compressed representation.

FIG. 5 shows an exemplary embodiment of the automation system 1 for controlling a machine and / or a process 2. The control takes place via at least one actuator 3, which acts on the machine and / or the process 2 when controlled with manipulated variables 12. The automation system 1 comprises at least one control system 5a, at least one periphery 5b, and / or at least one signal generator 5c, which are designed to provide state variables and / or setpoints of the machine or of the process 2 as input variables 11. The input variables 11 can in particular have been obtained beforehand as feedback 2a from the machine or the process 2 or as feedback 3a from the actuator 3.

The first control logic 4a is designed to process the input variables 11 into a first suggestion 12a for one or more manipulated variables 12. The second control logic 4b contains an artificial neural network, KNN 4b *. This KNN 4b * is trained to have one for given values of the input variables 11

To predict proposal 12b for the manipulated variables 12, which corresponds to proposal 12a of the first control logic 4a with regard to these values of the input variables 11;

Means 6 are provided for checking the plausibility of suggestion 12a of first control logic 4a against suggestion 12b of second control logic 4b. Off as plausible Proposals 12a and 12b expanded to one another, an end result of the manipulated variables 12 is determined by the evaluation unit 7.

FIG. 6 shows an exemplary diagram of the maximum permissible speed v of a conveyor cage in a mine over position s along a travel path that ranges from 0% to 100%. The drive machine (conveyor) of the conveyor cage is controlled by the automation system 1, which here serves as a speed controller.

Cruise control, braking device and signaling system are the essential components of the hoisting machine control of a shaft hoisting system. The speed controller controls the drive of the hoisting machine and monitors the conveying equipment, mostly rope-guided, which are used to transport people and materials, on the entire route to ensure that the maximum permissible travel speeds are adhered to. If the limit is exceeded, the speed controller stops the conveying equipment · by electrically switching off the drive motor or

• by applying the mechanical brake and switching off the drive motor.

One of several control functions of the speed controller implements what is known as "point-by-point speed monitoring". Depending on the position of the conveyor in the shaft and the direction of travel, the travel speed must not exceed certain limit values. According to FIG. 6, for example, the maximum driving speed when driving in the direction of 100% in the range 0 to 20% must not exceed the specified value of vl. Common control logics 4a that are used in this application and can be secured and / or checked according to the invention with the KNN 4b * are programmable electronic components in the form of programmable logic controllers, PLCs. The mode of operation of the point-by-point speed monitoring can be described according to Figure 6 for journeys from position 0% to position 100% as follows: (1) Between 0% <position <20% and 80% <position <100%, the current speed may be Do not exceed value vl.

(2) Between 20 <position <40% and 60% <position <80%, the current speed must not exceed the value v2.

(3) Between 40 <position <60%, the current speed must not exceed the value v3.

(4) If one or more of the requirements (1) to (3) are not met, the drive of the hoisting machine is shut down electrically.

(5) If requirement (4) is not met, the drive is switched off and the mechanical brake is activated.

This functionality is implemented equally by the control logic 4a on the one hand and by the control logic 4b with the ANN 4b * on the other hand, so that the manipulated variable 12 is generated in a redundant way (suggestions 12a or 12b). Due to the different nature of ANN and PLC in terms of engineering and technology, the principle of "diversity" is implemented. The ANN-based redundancy thus represents a suitable measure for avoiding and controlling systematic errors. An ANN 4b * trained in the planning and design stage for the requirements of a process to be controlled can use the already known criteria as input information before and during commissioning Will be provided.

Plant-related and / or process-related can be used to check the plausibility of the known Requirements as well as modifications made in the meantime, the response behavior of the ANN 4b * can be used simultaneously as a prediction for the real behavior of the process to be put into operation in order to avoid unintentional or even dangerous incorrect behavior.

The commissioning engineer is given additional information with the help of the KNN 4b *, which supports him in setting his system parameters in a time-saving manner and thus offers the potential for economic benefits.

List of reference symbols

1 automation system

11 input variables 11 * test values of the input variables 11

11 # Learn values of the input variables 11 12 Manipulated variables 12 * Test values of the manipulated variables 12 12 # Learn values of the manipulated variables 12 12a Suggestion for manipulated variables from control logic 4a

12b Proposal for manipulated variables from control logic 4b 2 Machine and / or process

2a Feedback from the machine and / or process 2

3 actuator 3a feedback from actuator 3 4a first control logic, generates proposal 12a 4b second control logic, generates proposal 12b 4b * ANN in second control logic 4b 4b # parameters, characterize behavior of ANN 4b * 5a control system in automation system 1 5b peripherals in automation system 1 5c signal transmitter in automation system 1 6 means for checking the plausibility of proposals 12a, 12b 7 evaluation unit, forms final result for manipulated variables 12 100 methods for generating manipulated variables 12

110 Obtaining the input variables 11 120 Generating the first proposal 12a 130 Generating the second proposal 12b 140 Checking the plausibility of the proposals 12a, 12b 141 Comparing the proposals 12a, 12b 142 Check a discrepancy from comparison 141

143 Check the times at which proposals 12a, 12b arrive 150 Decision whether proposals 12a, 12b are plausible to one another 160 Determine the final result for manipulated variables 12 170 Suppress the output of manipulated variables 12 180 Initiate other measures 200 Process for checking the control logic 4a 210 Providing the ANN 4b * 220 Supply of test values 11 * to ANN 4b * 230 Generation of test values 12 * by ANN 4b * 240 Checking the response behavior of the ANN 4b * 250 Decision as to whether the response behavior is appropriate 260 Establishing that the control logic 4a has passed the test 300 Method for checking the control logic 4a 310 Providing learning values 11 #, 12 # 320 Training the ANN 4b * 330 Supplying test values 11 * to the control logic 4a and ANN 4b * 340 Plausibility checking of the proposals 4a, 4b 350 Decision as to whether proposals 4a, 4b plausible 360 Establishing that the control logic 4a passed 400 Method for training the ANN 4b * 410 Supply of learning values 11 # to control logic 4 a 420 Generation of learning values 12 # by control logic 4a 430 Supply of learning values 11 # to ANN 4b * 440 Generation of values for manipulated variables 12 by ANN 4b *

450 Optimizing the parameters 4b # of the ANN 4b

451 Optimizing with the cost function

452 Optimizing by Clustering s way

V speed

Claims

Expectations

1. Method (100) for generating one or more manipulated variables (12) for at least one actuator (3) of an automation system (1) with the steps:

• One or more input variables (11) are obtained (110) from the automation system (1);

• the input variables (11) are processed (120) by a first control logic (4a) to form a first proposal (12a) for the one or more manipulated variables (12);

• the input variables (11) are processed (130) by a second control logic (4b), which is independent of the first control logic (4a), to form a second proposal (12b) for the one or more manipulated variables (12);

• the two proposals (12a, 12b) for the one or more manipulated variables (12) are checked for plausibility against each other (140); and

• In response to the fact that the two proposals (12a, 12b) prove to be plausible to one another (150), an end result of the one or more manipulated variables (12) is determined (160) from the two proposals (12a, 12b), whereby a second control logic (4b) with an artificial neural network, KNN (4b *), is selected, which is trained to predict a proposal (12b) for the manipulated variables (12) for given values of the input variables (11), which with the Proposal (12a) of the first control logic (4a) matches these values of the input variables (11).

2. The method (100) according to claim 1, wherein the two suggestions (12a, 12b) are checked for plausibility against each other (140) by being compared with each other (141), and wherein the two suggestions (12a, 12b) are rated as plausible to each other (142) if a deviation determined during this comparison (141) lies within a predetermined tolerance.

3. The method (100) according to any one of claims 1 to 2, wherein the two proposals (12a, 12b) must also be delivered (143) at times that differ from one another by at most a predetermined tolerance in order to be assessed as plausible to one another.

4. The method (100) according to any one of claims 1 to 3, in response to the fact that the two proposals (12a, 12b) prove to be implausible to one another

(150), the output of manipulated variables is suppressed (170) and / or another measure is initiated (180) in order to convert a machine or system controlled by the automation system (1) or a process controlled by the automation system (1) into to move to a safe state or to leave it there.

5. The method (100) according to any one of claims 1 to 4, wherein the input variables (11) fed to the two control logics (4a, 4b) are taken from the automation system (1) in two mutually independent ways.

6. Method (200) for checking a control logic (4a) which processes one or more input variables (11) obtained from an automation system (1) into one or more manipulated variables (12), with the following steps:

• An artificial neural network, ANN (4b *), is provided (210), which is trained to predict a proposal (12b) for the manipulated variables (12) for given values of the input variables (11), which is based on the proposal ( 12a) the control logic (4a) agrees with regard to these values of the input variables (11);

• the ANN (4b *) receives test values (11 *) of the input variables (11) (220) that relate to specified test scenarios; • the test values (11 *) of the input variables (11) are mapped (230) by the ANN (4b *) onto test values (12 *) of the manipulated variables (12);

• the response behavior of the ANN (4b *) characterized by the test values (12 *) of the manipulated variables (12) is checked (240) on the basis of specified criteria to determine whether it is in the context of the intended use of the control logic (4a) in a concrete Automation system (1) would be appropriate;

• In response to the fact that the response behavior of the ANN (4b *) is recognized overall as appropriate (250), it is determined (260) that the test of the control logic (4a) has been passed.

7. The method (200) according to claim 6, wherein the predetermined criteria contain boundary conditions for the values of the manipulated variables (12) which are predetermined by the specific automation system (1).

8. Method (300) for checking a control logic (4a) which processes one or more input variables (11) obtained from an automation system (1) into one or more manipulated variables (12), with the following steps:

• A large number of learning values (11 #) of the input variables (11) as well as associated learning values (12 #) of the manipulated variables (12) are provided

(310);

• an artificial neural network, ANN (4b *), is trained (320) to transfer the learning values (11 #) of the input variables (11) to the associated learning values (12 #) of the manipulated variables (12) maps; · Test values (11 *) of the input variables (11) that relate to specified

Relate test scenarios are fed to both the control logic (4a) and the ANN (4b *) (330);

• Proposals (12a, 12b) for values of the manipulated variables (12) to which the control logic (4a) on the one hand and the ANN (4b *) on the other hand the test values (11 *) of the Input variables (11) each map, are checked for plausibility against each other (340);

• In response to the fact that the two proposals (12a, 12b) prove to be plausible to one another (350) for a given proportion of the test scenarios, it is determined (360) that the test of the

Control logic (4a) is passed.

9. Method (400) for training an artificial neural network, ANN (4b *), for use in a method (100, 200) according to one of claims 1 to 7, with the steps:

A control logic (4a), whose behavior in a specific automation system (1) the ANN (4b *) is supposed to predict, is supplied with a large number of learning values (11 #) of the input variables (11) that are realistic in the context of this automation system (1) (410);

• the Lem values (11 #) of the input variables (11) are mapped (420) by the control logic (4a) in each case to Lem values (12 #) of manipulated variables (12) of the automation system (1);

• the Lem values (11 #) of the input variables (11) are fed to the ANN (4b *) (430);

• the ANN (4b *) maps the learning values (11 #) of the input variables (11) to values of the manipulated variables (12) (440);

• Parameters (4b #), which characterize the behavior of the ANN (4b *), are optimized (450) with the aim of ensuring that the values of the manipulated variables (12) to which the ANN (4b *) access the learning values (11 #) maps the input variables (11) to the learning values (12 #) of the output variables (12) are plausible.

10. The method (400) according to claim 9, wherein the optimization (450) is aimed (451) that the values of the manipulated variables (12) to which the ANN (4b *) concrete Lem values (11 #) of the input variables (11), according to a Cost function agree as closely as possible with the associated learning values (12 #) of the manipulated variables (12).

11. The method (400) according to any one of claims 9 to 10, wherein the optimization (450) is directed (452) by the Lem values (11 #) of the input variables (11) in combination with the associated learning values ( 12 #) of the output variables (12) to cluster defined data points and / or to express them by means of a compressed representation. 12. Computer program containing machine-readable instructions which, when executed on one or more computers, cause the computer or computers to carry out a method (100, 200, 300, 400) according to one of claims 1 to 11. 13. Machine-readable data carrier and / or download product with the

Computer program according to claim 12.

14. Automation system (1) for controlling a machine and / or a process (2), comprising: at least one control system (5a), at least one periphery (5b), and / or at least one signal transmitter (5c) designed for this purpose are,

To provide state variables and / or setpoint values of the machine or of the process (2) as input variables (11);

• a first control logic (4a) which is designed to process the input variables (11) into a first proposal (12a) for one or more manipulated variables (12);

• a second control logic (4b) with an artificial neural network, ANN (4b *), which is trained to make a proposal (12b) for the manipulated variables (12) for given values of the input variables (11) predict which matches the proposal (12a) of the first control logic (4a) with regard to these values of the input variables (11);

• Means (6) for checking the plausibility of the proposal (12a) of the first control logic (4a) against the proposal (12b) of the second control logic (4b); and · an evaluation unit (7) for determining an end result of the manipulated variables

(12) from proposals (12a, 12b) which are assessed as mutually plausible by the said means (6).