Update for an automation installation in the course of operation

• US 10,310,470 B2
• Filed: 04/22/2014
• Issued: 06/04/2019
• Est. Priority Date: 04/22/2014
• Status: Active Grant

• Current Assignee: Siemens AG
• Original Assignee: Siemens AG
• Inventors: Grosch, Thomas, Richter, Jan
• Primary Examiner(s): Rampuria, Satish
• Application Number:
  US15/305,926
• Publication Number:
  US 20170052523A1
• Time in Patent Office: 1,869 Days
• Field of Search: 700 28- 37, 717168-178
• CPC Class Codes: G05B 13/042 in which a parameter or coefficient is automatically adjusted to optimise the performance
• CPC Class Codes: G05B 19/0426 Programming the control sequence
• CPC Class Codes: G05B 19/056 Programming the PLC
• CPC Class Codes: G05B 2219/13004 Programming the plc
• CPC Class Codes: G05B 2219/50129 Setup machines as function of process model, control strategy for optimum use of machines
• CPC Class Codes: G06F 8/656 while running

Abstract

A method for stipulating a starting time for an update for a control apparatus that controls at least one peripheral component in a process automation installation by producing control outputs is disclosed. The update requires at least one predetermined down time. The invention is based on a suitable starting time for performing an update in order to perform an update in the course of operation of a process automation installation without risk. The method involves detecting a current operating state for the at least one peripheral component, taking the detected operating state as a basis for using a controlled system model of the process to simulate what state trajectory the at least one peripheral component negotiates within the down time for a predetermined static control output, and checking whether the state trajectory lies exclusively within a range of admissible operating states, and, if appropriate, starting the update.

Claims

1. A method for stipulating a starting time for an update for a control apparatus, said control apparatus controlling at least one peripheral component in a process automation installation, said method comprising:

producing a control output, said update requiring at least a predetermined downtime;

detecting a current operating state for at least one peripheral component;

using the detected operating state as a basis for a controlled system model of a process, said controlled system model simulating what state trajectory the at least one peripheral component runs through within the downtime for a predetermined stationary control output;

checking to determine whether the state trajectory is within a range of permissible operating states, wherein the range of permissible operating states includes operating states which the process and/or the at least one peripheral component has a permissible operating value; and

starting the update only when the state trajectory is entirely within the range of permissible operating states for the downtime.

2. The method of claim 1, further comprising:

outputting the stationary control output to the at least one peripheral component to start the update;

decoupling the control apparatus; and

initiating the update during an interruption-free operation of the process.

3. The method of claim 1, further comprising emitting a takeover signal for outputting a further control output to a further control apparatus after the update has been started and within the downtime.

4. The method of claim 3, further comprising:

providing a predetermined safety control output, said predetermined safety control output controlling the at least one peripheral component into a predetermined safe operating state; and

outputting the safety control to the at least one peripheral component if an error state is signaled in the control apparatuses and/or the at least one peripheral component after the update has been started.

5. The method of claim 3, further comprising:

coupling the control apparatus to the at least one peripheral component again after the update;

restarting values determined via synchronization with the further control apparatus coupled to the at least one peripheral component during the update; and

outputting by the control apparatus as the first control output after coupling.

6. The method of claim 1, wherein the controlled system model includes a model of a controlled system which includes the at least one peripheral component.

7. The method of claim 1, further comprising:

determining a time at which the state trajectory has an impermissible operating state for a first time to check the state trajectory via a simulation;

using the time to determine a maximum permissible time horizon; and

checking to determine whether the downtime is less than a time horizon or less than the time horizon minus a predetermined buffer time.

8. The method of claim 7, further comprising:

coupling the control apparatus to the at least one peripheral component again after the update;

restarting values corresponding to the stationary control output or restarting values determined using the state trajectory; and

outputting by the control apparatus as the first control output after coupling the determined time by using the state trajectory.

9. The method of claim 1, further comprising determining a further state trajectory for at least one further predetermined stationary control output trajectory if the state trajectory is at least partially outside the range of permissible operating states within the downtime.

10. The method of claim 1, further comprising delaying the update when there is no permissible state trajectory.

11. A control apparatus for a process automation installation, said control apparatus stipulating a starting time for an update and being configured to:

produce a control output, said update requiring at least a predetermined downtime;

detect a current operating state for at least one peripheral component;

use the detected operating state as a basis for a controlled system model of a process, said controlled system model simulating what state trajectory the at least one peripheral component runs through within the downtime for a predetermined stationary control output;

check to determine whether the state trajectory is within a range of permissible operating states, wherein the range of permissible operating states includes operating states which the process and/or the at least one peripheral component has a permissible operating value; and

start the update only when the state trajectory is entirely within the range of permissible operating states for the downtime.

12. The control apparatus of claim 11, constructed in the form of a programmable logic controller (PLC).

13. A process automation installation having at least one peripheral component and a control apparatus, said control apparatus stipulating a starting time for an update, said process automation installation comprising:

at least one peripheral component; and

a first control apparatus configured to;

produce a control output, said update requiring at least a predetermined downtime;

detect a current operating state for at least one peripheral component;

use the detected operating state as a basis for a controlled system model of a process, said controlled system model simulating what state trajectory the at least one peripheral component runs through within the downtime for a predetermined stationary control output;

check to determine whether the state trajectory is within a range of permissible operating states, wherein the range of permissible operating states includes operating states which the process and/or the at least one peripheral component has a permissible operating value; and

start the update only when the state trajectory is entirely within the range of permissible operating states for the downtime.

14. The process automation installation of claim 13, further comprising a second control apparatus and a synchronization connection for synchronizing regulator states, said first and second control apparatuses being coupled via the synchronization connection.