Method and system for secure data transmission

• US 20080150713A1
• Filed: 11/13/2007
• Published: 06/26/2008
• Est. Priority Date: 11/15/2006
• Status: Active Grant

• Current Assignee: Phoenix Contact GmbH & Company KG
• Original Assignee: Phoenix Contact GmbH & Company KG
• Inventors: Meyer-Graefe, Karsten, Kalhoff, Johannes
• Granted Patent: US 8,537,726 B2
• Time in Patent Office: Days
• US Class Current: 340/532
• CPC Class Codes: G05B 19/0428 Safety, monitoring G05B19/0423 takes precedence
• CPC Class Codes: G05B 19/048 Monitoring; Safety
• CPC Class Codes: G05B 19/058 Safety, monitoring
• CPC Class Codes: G05B 19/4185 characterised by the network communication
• CPC Class Codes: H04L 1/0061 Error detection codes
• CPC Class Codes: H04L 1/16 in which the return channel carries supervisory signals, e.g. repetition request signals
• CPC Class Codes: H04L 1/1671 the supervisory signal being transmitted together with control information
• CPC Class Codes: H04L 12/403 with centralised control, e.g. polling
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: Y02P 90/02 Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]

Abstract

The invention achieves secure data transmission in a communications system (1) employed to control safety-relevant processes, through the provision of cooperating evaluators (212, 222) arranged in a shared manner in communications stations (21, 22) in order to evaluate safety-oriented data in a simple and cost-effective way.

Accordingly, the invention provides a method in which a data report is transmitted from a first station (21), by means of a communications system (1) designed for serial data transmission, to a second station and said data report is checked by means of a second evaluator (222) arranged in the second station (22). Depending on the results of the check of the data report, an acknowledgement report is transmitted from the second station (22) to the first station (21), which [acknowledgement report] likewise is checked by the evaluator (212) arranged in the first station (21).

Furthermore, the invention provides for a system to carry out the method.

Claims

1. Method for secure data transmission between at least a first (21, 21′

, 23, 26) and a second (22, 22′

, 24, 27) station of a communications system (1, 1′

) designed for serial data transmission between said stations (21, 22, 21′

, 22′

, 23, 24, 26, 27), with the first station comprising a first evaluator (212, 232, 262) and the second station comprising a second evaluator (222, 242, 272), the method comprising;

transmitting a data report from the first station (21, 21′

, 23, 26) to the second station (22, 22′

, 24, 27),

checking said data report by means of the second evaluator arranged in the second station,

transmitting an acknowledgement report from the second station to the first station depending on the results of the check of the data report, and

checking the acknowledgement report by means of the first evaluator arranged in the first station.

2. Method according to claim 1, with serial data transmission occurring between the stations (21, 22, 21′

, 22′

, 23, 24, 26, 27) by means of a data transmission protocol.

3. Method according to claim 1, with serial data transmission occurring between the stations by means of a serial bus of wired (30) or wireless (30′

) design.

4. Method according to claim 1, with the first and/or second station being designed as a sensor or actuator of an automation system.

5. Method according to claim 1, with the data report comprising an input or output signal of a sensor or actuator.

6. Method according to claim 1, with a check of the data report and/or of the acknowledgement report comprising a check for plausibility of the data contained in said report.

7. Method according to claim 1, with a check of the acknowledgement report comprising a comparison of data contained in the acknowledgement report with data contained in the data report.

8. Method according to claim 1, with the acknowledgment report comprising an additional valid data report.

9. Method according to claim 1, with a controller or sensor (70) that does not include an evaluator being switched between the first and second station.

10. Method according to claim 9, with the controller or sensor (70) being designed as a mechanical element.

11. Method according to claim 1, with a monitoring circuit (214, 224, 234, 244) being assigned to each evaluator (212, 222, 232, 242) which [monitoring circuit] monitors the data stream to and/or from the associated evaluator (212, 222, 232, 242) for validity according to a specified protocol and in the event of a fault sets the associated evaluator (212, 222, 232, 242) and/or a sensor or actuator controlled by means of the associated evaluator to a secure status.

12. Method according to claim 11, with monitoring of the data stream by means of the monitoring circuit (214, 224, 234, 244) comprising the recognition of a specified pattern.

13. Method according to claim 11, with the monitoring circuit (214, 224, 234, 244) monitoring the functional capability of the associated evaluator (212, 222, 232, 242).

14. Method according to claim 1, with a check of a data report by means of an evaluator, a check of an acknowledgement report by means of an evaluator, the monitoring of a data stream by means of a monitoring circuit and/or the monitoring of the functional capability of an evaluator by means of a monitoring circuit occurring by means of execution of a function (22p1, 22p2) stored in the executing station (22), and with, prior to execution of the function, parts (22p2) of the function to be executed and/or parameters for executing the function being transmitted from an additional station (21) to the executing station (22).

15. Method according to claim 1, with the communications system (1, 1′

) comprising the first and second station being designed as a master/slave system, with the first or second station being designed as the master.

16. Method according to claim 1, with the first or second station being connected to a higher-level bus system (40).

17. System for transmission of safety-oriented data for control of an automation system, comprising:

a serial communications system (1) having at least a first and a second station (21, 22, 21′

, 22′

, 23, 24, 26, 27) connected thereto,

at least a first evaluator (212, 232, 262) arranged in the first station (21, 21′

, 23, 26), and

at least a second evaluator (222, 242, 272) arranged in the second station (22, 22′

, 24, 27), with the second evaluator being designed in order to check a data report received from the first station and in order to generate an acknowledgement report depending on the results of the check of the data report, the first evaluator being designed in order to check an acknowledgement report received from the second station, and with the first and/or second station being designed in order to execute a security function in the event of a fault.

18. System according to claim 17, with the data transmission protocol of the communications system (1) being designed as a secure communications protocol.

19. System according to claim 17, with the communications system (1, 1′

) for serial data transmission between the stations comprising a wired (30) or wireless (30′

) serial bus.

20. System according to claim 17, with the first and/or second station being designed as a sensor or actuator of the automation system.

21. System according to claim 17, with the first and/or second evaluator being designed in order to check data contained in a data report or acknowledgement report for plausibility.

22. System according to claim 17, with the first and/or second evaluator being designed in order to compare data contained in a data report with data contained in an acknowledgment report.

23. System according to claim 17, with at least the second evaluator being designed in order to generate an acknowledgement report, which comprises an additional valid data report.

24. System according to claim 17, with a controller or sensor element (70), which does not include an evaluator, being switched between the first and second station.

25. System according to claim 24, with the controller or sensor (70) being designed as a mechanical element.

26. System according to claim 17, with the first (23) and second (24) stations being arranged in a common subassembly (25).

27. System according to claim 17, with a monitoring circuit (214, 224, 234, 244) being assigned to each evaluator (212, 222, 232, 242) which [monitoring circuit] is designed in order to monitor the data stream to and/or from the associated evaluator (212, 222, 232, 242) for validity according to a specified protocol and in the event of a fault sets the associated evaluator (212, 222, 232, 242) and/or a sensor or actuator controlled by means of the associated evaluator to a secure status.

28. System according to claim 27 with the monitoring circuit (214, 224, 234, 244) being designed in order to recognize a specified pattern.

29. System according to claim 27, with the monitoring circuit (214, 224, 234, 244) being designed in order to monitor the functional capability of the associated evaluator (212, 222, 232, 242) by means of a function.

30. System according to claim 17, with at least one station being designed in order to carry out a check of a data report by means of an evaluator, a check of an acknowledgement report by means of an evaluator, the monitoring of the data stream by means of a monitoring circuit and/or the monitoring of the functional capability of an evaluator by means of a monitoring circuit by means of executing a function (21p1, 22p2) stored in the station (22), with at least one station (22) moreover being designed, in order to execute the function, to request executable parts of functions (22p2) and/or parameters from an additional station (21).

31. System according to claim 17, with the communications system (1, 1′

) comprising the first and second stations, being designed as a master/slave system, with the first or second station being designed as the master.

32. System according to claim 17, with the first or second station being connected to an additional, higher-level communications system (40).