# US 10,310,470 B2 · Update for an automation installation in the course of operation > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,310,470 B2 - Document ID: US10310470B2 - Status: Granted - Kind: B2 - Application number: 15/305,926 - Filed: 2014-04-22 - Published: 2017-02-23 - Granted: 2019-06-04 - Earliest claimed: 2014-04-22 - Assignees: Siements Aktiengesellschaft - Applicants: Siemens Aktiengesellschaft - Inventors: Thomas Grosch; Jan Richter - Web page: https://patentgrep.com/patent/US10310470B2 ## CPC - G05B 19/0426: {Programming the control sequence} - G05B 13/042: {in which a parameter or coefficient is automatically adjusted to optimise the performance} - G05B 19/056: {Programming the PLC} - G06F 8/656: while running - G05B 2219/13004: Programming the plc - G05B 2219/50129: Setup machines as function of process model, control strategy for optimum use of machines - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method for stipulating a starting time for an update for a control apparatus that controls at least one peripheral component in a process automation installation by producing control outputs is disclosed. The update requires at least one predetermined down time. The invention is based on a suitable starting time for performing an update in order to perform an update in the course of operation of a process automation installation without risk. The method involves detecting a current operating state for the at least one peripheral component, taking the detected operating state as a basis for using a controlled system model of the process to simulate what state trajectory the at least one peripheral component negotiates within the down time for a predetermined static control output, and checking whether the state trajectory lies exclusively within a range of admissible operating states, and, if appropriate, starting the update. ## Claims ### Claim 1 A method for stipulating a starting time for an update for a control apparatus, said control apparatus controlling at least one peripheral component in a process automation installation, said method comprising: producing a control output, said update requiring at least a predetermined downtime; detecting a current operating state for at least one peripheral component; using the detected operating state as a basis for a controlled system model of a process, said controlled system model simulating what state trajectory the at least one peripheral component runs through within the downtime for a predetermined stationary control output; checking to determine whether the state trajectory is within a range of permissible operating states, wherein the range of permissible operating states includes operating states which the process and/or the at least one peripheral component has a permissible operating value; and starting the update only when the state trajectory is entirely within the range of permissible operating states for the downtime. ### Claim 2 (depends on 1) The method of claim 1, further comprising: outputting the stationary control output to the at least one peripheral component to start the update; decoupling the control apparatus; and initiating the update during an interruption-free operation of the process. ### Claim 3 (depends on 1) The method of claim 1, further comprising emitting a takeover signal for outputting a further control output to a further control apparatus after the update has been started and within the downtime. ### Claim 4 (depends on 3) The method of claim 3, further comprising: providing a predetermined safety control output, said predetermined safety control output controlling the at least one peripheral component into a predetermined safe operating state; and outputting the safety control to the at least one peripheral component if an error state is signaled in the control apparatuses and/or the at least one peripheral component after the update has been started. ### Claim 5 (depends on 3) The method of claim 3, further comprising: coupling the control apparatus to the at least one peripheral component again after the update; restarting values determined via synchronization with the further control apparatus coupled to the at least one peripheral component during the update; and outputting by the control apparatus as the first control output after coupling. ### Claim 6 (depends on 1) The method of claim 1, wherein the controlled system model includes a model of a controlled system which includes the at least one peripheral component. ### Claim 7 (depends on 1) The method of claim 1, further comprising: determining a time at which the state trajectory has an impermissible operating state for a first time to check the state trajectory via a simulation; using the time to determine a maximum permissible time horizon; and checking to determine whether the downtime is less than a time horizon or less than the time horizon minus a predetermined buffer time. ### Claim 8 (depends on 7) The method of claim 7, further comprising: coupling the control apparatus to the at least one peripheral component again after the update; restarting values corresponding to the stationary control output or restarting values determined using the state trajectory; and outputting by the control apparatus as the first control output after coupling the determined time by using the state trajectory. ### Claim 9 (depends on 1) The method of claim 1, further comprising determining a further state trajectory for at least one further predetermined stationary control output trajectory if the state trajectory is at least partially outside the range of permissible operating states within the downtime. ### Claim 10 (depends on 1) The method of claim 1, further comprising delaying the update when there is no permissible state trajectory. ### Claim 11 A control apparatus for a process automation installation, said control apparatus stipulating a starting time for an update and being configured to: produce a control output, said update requiring at least a predetermined downtime; detect a current operating state for at least one peripheral component; use the detected operating state as a basis for a controlled system model of a process, said controlled system model simulating what state trajectory the at least one peripheral component runs through within the downtime for a predetermined stationary control output; check to determine whether the state trajectory is within a range of permissible operating states, wherein the range of permissible operating states includes operating states which the process and/or the at least one peripheral component has a permissible operating value; and start the update only when the state trajectory is entirely within the range of permissible operating states for the downtime. ### Claim 12 (depends on 11) The control apparatus of claim 11, constructed in the form of a programmable logic controller (PLC). ### Claim 13 A process automation installation having at least one peripheral component and a control apparatus, said control apparatus stipulating a starting time for an update, said process automation installation comprising: at least one peripheral component; and a first control apparatus configured to: produce a control output, said update requiring at least a predetermined downtime; detect a current operating state for at least one peripheral component; use the detected operating state as a basis for a controlled system model of a process, said controlled system model simulating what state trajectory the at least one peripheral component runs through within the downtime for a predetermined stationary control output; check to determine whether the state trajectory is within a range of permissible operating states, wherein the range of permissible operating states includes operating states which the process and/or the at least one peripheral component has a permissible operating value; and start the update only when the state trajectory is entirely within the range of permissible operating states for the downtime. ### Claim 14 (depends on 13) The process automation installation of claim 13, further comprising a second control apparatus and a synchronization connection for synchronizing regulator states, said first and second control apparatuses being coupled via the synchronization connection.