# US 12,007,740 B2 · Secure network of safety PLCs for industrial plants

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,007,740 B2
- Document ID: US12007740B2
- Status: Granted
- Kind: B2
- Application number: 17/121,177
- Filed: 2020-12-14
- Published: 2021-07-01
- Granted: 2024-06-11
- Earliest claimed: 2019-12-31
- Assignees: Schneider Electric Systems USA, Inc.
- Applicants: Schneider Electric Systems USA, Inc.
- Inventors: Ajay Mishra; Diana Ivanov; Erna Banchik
- Web page: https://patentgrep.com/patent/US12007740B2

## CPC

- G05B 19/058: {Safety, monitoring}
- G05B 19/052: {Linking several PLC's}
- G05B 19/056: {Programming the PLC}
- G06F 8/61: Installation
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 9/3271: {using challenge-response}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- G06F 11/0709: {in a distributed system consisting of a plurality of standalone computer nodes, e.g. clusters, client-server systems}
- G06F 11/0736: {in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function (testing or monitoring of automated control systems G05B23/02)}
- G06F 11/0751: {Error or fault detection not based on redundancy (power supply failures G06F1/30; network fault management H04L41/06)}
- G06F 11/0796: {Safety measures, i.e. ensuring safe condition in the event of error, e.g. for controlling element}
- G06F 2221/2103: Challenge-response
- G06F 2221/2129: Authenticate client device independently of the user
- G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Network of safety PLCs employs multi-PLC verification of a programming application before allowing the application to reprogram any PLC on the safety network. Each PLC on the safety network is equipped with authentication capability that detects attempts to reprogram the PLC and issues an authentication challenge requiring the programming application to process a proof-of-work. The authentication challenge is also sent to other PLCs on the safety network along with the response from the programming application for verification purposes. The other PLCs process the authentication challenge and check the response from the programming application for acceptability. If a majority of the PLCs on the safety network determines the response from the programming application is correct, then the programming application is verified and may proceed with the reprogramming. Such group authentication requires a malicious application to hijack multiple PLCs concurrently on the safety network, a highly unlikely outcome, before reprogramming any PLC.

## Claims

### Claim 1

A safety system for an industrial plant, comprising:
a safety network in the industrial plant, the safety network physically or logically isolated from non-safety devices in the industrial plant;
a plurality of safety programmable logic controllers (PLCs) coupled to communicate with one another over the safety network, each safety PLC operable to perform one or more safety functions related to a respective equipment in the industrial plant;
an outflow valve in communication with a target safety PLC;
wherein each safety PLC is operable to communicate with a programming application running on a safety system over the safety network to initiate a multi-PLC authentication challenge of the programming application in response to a request by the programming application to download a PLC program to the target safety PLC;
wherein in response to the multi-PLC authentication challenge, one of the plurality of safety PLCs is randomly selected as a master safety PLC;
each of the plurality of safety PLCs issues an authentication challenge to the programming application;
each of the plurality of safety PLCs receives a response to the authentication challenge from the programming application and generates verification results;
each of the plurality of safety PLCs determines whether the verification results are acceptable and provides the verification results to the master safety PLC;
the master safety PLC determines whether the number of acceptable results are greater than or equal to a minimum threshold;
wherein the programming application running on the safety system downloads the PLC program to the target safety PLC if the master safety PLC determines the number of acceptable results are greater than or equal to the minimum threshold; and
wherein the target safety PLC opens and closes the outflow valve using the downloaded program.

### Claim 2 (depends on 1)

The safety system of claim 1, wherein the minimum number of safety PLCs is a majority of the safety PLCs coupled to communicate over the safety network.

### Claim 3 (depends on 1)

The safety system of claim 1, wherein each safety PLC is further operable to verify the response to the authentication challenge from the programming application and provide a verification result to the other safety PLCs coupled to communicate over the safety network.

### Claim 4 (depends on 1)

The safety system of claim 1, wherein the authentication challenge takes the form of a proof-of-work (PoW) that is related to a functionality of the programming application.

### Claim 5 (depends on 4)

The safety system of claim 4, wherein each safety PLC is further operable to select the PoW from a list of predefined PoWs for the programming application stored in each safety PLC.

### Claim 6

A target safety PLC for an industrial plant, comprising:
a processor;
an outflow valve in communication with the target safety PLC;
a network interface connected to the processor, the network interface allowing the target safety PLC to communicate with a plurality of other safety PLCs in the industrial plant over a safety network, the safety network physically or logically isolated from non-safety devices in the industrial plant; and
a storage device connected to the processor, the storage device storing computer-readable instructions thereon that, when executed by the processor, cause the processor to communicate with a programming application running on a safety system over the safety network to initiate a multi-PLC authentication challenge of the programming application in response to a request by the programming application to download a PLC program to the target safety PLC;
wherein in response to the multi-PLC authentication challenge, one of the plurality of safety PLCs is randomly selected as a master safety PLC;
each of the plurality of safety PLCs issues an authentication challenge to the programming application;
each of the plurality of safety PLCs receives a response to the authentication challenge from the programming application and generates verification results;
each of the plurality of safety PLCs determines whether the verification results are acceptable and provides the verification results to the master safety PLC;
the master safety PLC determines whether the number of acceptable results are greater than or equal to a minimum threshold;
wherein the programming application running on the safety system downloads the PLC program to the target safety PLC if the master safety PLC determines the number of acceptable results are greater than or equal to the minimum threshold; and
wherein the target safety PLC opens and closes the outflow valve using the downloaded program.

### Claim 7 (depends on 6)

The target safety PLC of claim 6, wherein the master safety PLC and the computer-readable instructions further cause the processor to tally the verification results received from the other safety PLCs and issue an accept command over the safety network if a minimum number of safety PLCs has communicated over the safety network that the response from the programming application is acceptable.

### Claim 8 (depends on 6)

The target safety PLC of claim 6, wherein the minimum number of safety PLCs is a majority of the safety PLCs coupled to communicate over the safety network.

### Claim 9 (depends on 6)

The target safety PLC of claim 6, wherein the computer-readable instructions further cause the processor to verify the response to the authentication challenge from the programming application and provide a verification result to the other safety PLCs over the safety network.

### Claim 10 (depends on 6)

The target safety PLC of claim 6, wherein the authentication challenge takes the form of a proof-of-work (PoW) that is related to a functionality of the programming application.

### Claim 11 (depends on 10)

The target safety PLC of claim 10, wherein the computer-readable instructions further cause the processor to select the PoW from a list of predefined PoWs for the programming application stored in the safety PLC.

### Claim 12

A method of securing a safety network for industrial plant, comprising:
providing a plurality of safety PLCs coupled to communicate with one another over the safety network, the safety network physically or logically isolated from non-safety devices in the industrial plant;
providing an outflow valve in communication with a target safety PLC;
the target safety PLC communicating with a programming application running on a safety system over the safety network to initiate a multi-PLC authentication challenge of the programming application in response to receiving a request from the programming application to download a PLC program to the target safety PLC of the plurality of safety PLCs;
randomly selecting one of the safety PLCs as a master safety PLC from among the plurality of safety PLCs in response to the multi-PLC authentication challenge;
issuing, by each of the plurality of safety PLCs, an authentication challenge to the programming application;
receiving, by each of the plurality of safety PLCs, a response to the authentication challenge from the programming application and generating verification results;
determining, by each of the plurality of safety PLCs, whether the verification results are acceptable and providing the results to the master safety PLC;
determining, by the master PLC, whether the number of acceptable results are greater than or equal to a minimum threshold;
downloading the PLC program on the target PLC by the programming application running on the safety system if the master safety PLC determines the number of acceptable results are greater than or equal to the minimum threshold; and
opening and closing the outflow valve by the target safety PLC using the downloaded program.

### Claim 13 (depends on 12)

The method of claim 12, further comprising the master safety PLC tallying the verification results received from the other safety PLCs and issuing an accept command over the safety network if a minimum number of safety PLCs has communicated over the safety network that the response from the programming application is acceptable.

### Claim 14 (depends on 12)

The method of claim 12, wherein the minimum number of safety PLCs is a majority of the safety PLCs coupled to communicate over the safety network.

### Claim 15 (depends on 12)

The method of claim 12, wherein initiating multi-PLC authentication includes verifying the response to the authentication challenge from the programming application and providing a verification result to the other safety PLCs over the safety network.

### Claim 16 (depends on 12)

The method of claim 12, wherein the authentication challenge takes the form of a proof-of-work (PoW) that is related to a functionality of the programming application.

### Claim 17 (depends on 16)

The method of claim 16, wherein initiating multi-PLC authentication further includes selecting the PoW from a list of predefined PoWs for the programming application stored in the safety PLC.