# US 11,909,821 B2 · Method for processing application programs in a distributed automation system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,821 B2 - Document ID: US11909821B2 - Status: Granted - Kind: B2 - Application number: 17/293,726 - Filed: 2019-11-07 - Published: 2022-01-06 - Granted: 2024-02-20 - Earliest claimed: 2018-11-21 - Assignees: Phoenix Contact GmbH & Co. KG - Applicants: Phoenix Contact GmbH & Co. KG - Inventors: Tobias Frank; Harry Koop; Julian Bartel - Web page: https://patentgrep.com/patent/US11909821B2 ## CPC - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - G06F 21/51: at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - H04L 9/3247: {involving digital signatures} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 63/123: {received data contents, e.g. message integrity} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Embodiments of the invention relate to the processing of a safety-related user program for a safety control system. The generation of the machine code for the safety-related control takes place on a cloud computer. The data required for generating the machine code such as the source code data of the user program, are secured with a unique signature and transmitted to the cloud computer. The machine code is generated on the cloud computer from the transmitted data. A new signature is generated via the resultant data and the signature from the preceding step. The entire safety life cycle is also covered, since each step in the life cycle is automatically documented and may be clearly tracked at any time, and corruptions of a step may be detected. ## Claims ### Claim 1 A method for processing a safety-related user program for a safety control system, which is configured to control at least one automated device, which contains at least one protection device for carrying out at least one safety function, wherein the safetly-related user program specifies logical connections as a function of a respective state of the at least one safety function for the safety control system for controlling the at least one automated device via the safety control system, by the steps of: generating data for a safety-related user program successively on a plurality of remote device environments distributed spaced apart from one another, each of which provides a safety-related user program processing tool, wherein the data for the safety-related user program is generated on a respective device environment of the plurality of remote device environments via the safety-related user program processing tool provided in each case by this device environment and, after the data is generated, the generated data together with a signature are transferred to another one of these remote device environments; wherein prior to transfer of the generated data together with the signature, the signature is generated based at least on the entirety of the generated data by a signature unit of the device environment on which the data for the safety-related user program has been generated; and wherein after the transfer of the generated data together with the signature, on the device environment receiving the data and signature, receiving the data and signature wherein the received signature is checked by a signature unit of this device environment, and if a result of the signature check is error-free; and wherein data for the safety-related user program is regenerated based on the received data, and the signature to be transferred together with this regenerated data based at least on the entirety of the data generated on this device environment and on the respectively received signature generated by the signature unit of this device environment. ### Claim 2 (depends on 1) The method according to claim 1, wherein the data for the safety-related user program is generated successively on the plurality of remote device environments distributed spaced apart from one another until a completion of a complete intended start-up of the safety-related user program. ### Claim 3 (depends on 1) The method according to claim 1, wherein with each transfer of the generated data together with the signature, metadata relating to the device environment on which the generated dathas been generated, relating to the date of the data generation and/or relating to a user of the safety-related user program processing tool generating the data, and/or smart contract data relating to the device environment to which the generated data is transferred, are also transferred. ### Claim 4 (depends on 1) The method according to claim 1, wherein source code data for the safety-related user program is generated on a first device environment of the plurality of remote device environments distributed spaced apart from one another and transferred from the first device environment as the generated data to a second device environment of the plurality of remote device environments; machine code data for the safety-related user program is generated on the second device environment of the plurality of remote device environments after receipt of the source code data and if a result of the signature check is error-free, and said machine code data is transferred as generated data to at least a third device environment of the plurality of remote device environments. ### Claim 5 (depends on 4) The method according to claim 4, wherein in addition to the machine code data, start-up data for the safety-related user program is generated on the second device environment of the plurality of remote device environments distributed spaced apart from one another after receipt of the source code data, and the machine code data and start-up data are transferred as generated data to at least the third device environment of the plurality of remote device environments distributed spaced apart from one another for starting-up the safety-related user program. ### Claim 6 (depends on 4) The method according to claim 4, wherein in addition to the machine code data, test procedure data for the safety-related user program is generated on the second device environment of the plurality of remote device environments distributed spaced apart from one another, and the machine code data and test procedure data are transferred as generated data to a fourth device environment of the plurality of remote device environments distributed spaced apart from one another for testing the safety-related user program, wherein a test procedure is completed and test result data for the safety-related user program is generated on the fourth device environment of the plurality of remote device environments distributed spaced apart from one another after receipt of the machine code data and test procedure data and if a result of the signature test is error-free, wherein the test result data is transferred as generated data to the second device environment of the plurality of remote device environments distributed spaced apart from one another. ### Claim 7 (depends on 6) The method according to claim 6, wherein start-up data for the safety-related user program is generated on the second device environment of the plurality of remote device environments distributed spaced apart from one another after receipt of the test result data and if a result of the signature check is error-free, and the start-up data is transferred as generated data together with the previously generated machine code data to the third device environment of the plurality of remote device environments distributed spaced apart from one another for starting up the safety-related user program. ### Claim 8 (depends on 5) The method according to claim 5 wherein a start-up procedure is completed and start-up validation data for the safety-related user program is generated on the third device environment of the plurality of remote device environments distributed spaced apart from one another after receipt of the machine code data and start-up data and if a result of the signature check is error-free, and wherein the start-up validation data is transferred as generated data to the second device environment of the plurality of remote device environments distributed spaced apart from one another for concluding the complete intended start-up of the safety-related user program. ### Claim 9 (depends on 8) The method according to claim 8, wherein certification data for the safety-related user program is generated on the second device environment of the plurality of remote device environments distributed spaced apart from one another after receipt of the start-up validation data and if the result of the signature check is error-free. ### Claim 10 (depends on 9) The method according to claim 9, wherein the generated certification data is stored on the second device environment of the plurality of remote device environments distributed spaced apart from one another. ### Claim 11 (depends on 9) The method according to claim 9, wherein the certification data is transferred as generated data together with the previously generated machine code data to a number of third device environments of the plurality of remote device environments distributed spaced apart from one another. ### Claim 12 (depends on 11) The method according to claim 11, wherein the safety-related user program is executed as intended on the number of third device environments of the plurality of remote device environments distributed spaced apart from one another after receipt of the certification data and machine code data and if the result of the signature check is error-free. ### Claim 13 (depends on 1) An automation system for carrying out the method according to claim 1, comprising: a plurality of remote device environments distributed spaced apart from one another, each of which provides a safety-related user program processing tool for generating data for the user program for a safety control system, wherein the safety-related user program processing tool further comprises a signature unit, wherein a first device environment of this plurality of remote device environments distributed spaced apart from one another is configured on a communication user terminal equipment, a second device environment of the plurality of remote device environments distributed spaced apart from one another configured on a cloud computer, and at least one additional device environment of the plurality of remote device environments distributed spaced apart from one another is configured, wherein the first device environment, the second device environment and the at least one additional device environment have interfaces and are designed to transfer in each case generated data together with a respectively generated signature from the first device environment to the second device environment, for the second device environment to the at least one additional device environment and from the at least one additional device environment to the second device environment. ### Claim 14 A system comprising: a first device environment among a plurality of remote device environments, wherein the first device environment is configured to generate source code data for a user program and transfer the generated source code data to a second device environment among the plurality of remote device environments; the second device environment among the plurality of remote device environments, configured to receive the generated source code data from the first device environment and generate machine code data for the user program, wherein the machine code data is generated based on receipt of the generated source code data from the first device environment and if a result of a signature check is error-free; and a third device environment among the plurality of remote device environments, wherein the third device environment is configured to receive the machine code data if the second device environment receives the source code data and if the result of the signature check is error-free. ### Claim 15 (depends on 14) The system of claim 14, wherein the second device environment is configured to generate certification data for the user program if the result of the signature check is error-free. ### Claim 16 (depends on 14) The system of claim 14, wherein the second device environment is configured to generate start-up data and transfer the start-up data to the third device environment. ### Claim 17 (depends on 14) The system of claim 14, wherein the second device environment transmits generated certification data with the generated machine code data to the third device environment. ### Claim 18 (depends on 14) The system of claim 14, wherein the third device environment is configured to generate start-up validation data for the user program. ### Claim 19 (depends on 18) The system of claim 18, wherein the third device environment transfers the generated start-up validation data to the second device environment. ### Claim 20 (depends on 14) The system of claim 14, further comprising: a fourth device environment among the plurality of device environments, wherein the fourth device environment is configured to generate test result data for the user program. ### Claim 21 (depends on 13) The automation system according to claim 13, wherein the first device environment provides a safety-related programming tool for generating a source code of the safety-related user program as a safety-related user program processing tool as well as a signature unit interacting with the safety-related programming tool for generating a signature based on the entirety of the generated source code; wherein the second device environment provides a safety-related compilation tool for generating machine code of the safety-related user program as well as a safety-related tool for generating start-up data and/or test procedure data for the safety-related user program as a safety-related user program processing tool, and a signature unit interacting with the safety-related tool for checking a respectively currently received signature and for generating a signature based on data generated on the second device environment and on a last respectively checked signature.