Siemens Aktiengesellschaft

Siemens Aktiengesell Schaft

Harald Albrecht

Stephan Höme

Thomas Talanis

Reiner Plonka

Hendrik Gerlach

Martin Rziha

Franz-Josef Götz

Frank Volkmann

Georg Biehler

Harald Herberth

Jürgen Schmitt

Christian Peter Feist

Thomas Fischer

Sven Kerschbaum

Marcel Kießling

Stefan Kern

Ingo Landgraf

Werner Blumenstock

Michael Dreher

Konstantin Jung

Hartmut Stutz

Stephan Hoeme

Lars Walpurgis

Nils Baur

Jochen Balduf

Martin Mehn

Melanie Ehlis

Bernd Schönmüller

Felix Müller

Steffen Peschmann

Stephan HÖME

A method for securely executing control applications via software-implemented containers which are each loadable into a container runtime environment set up on a host and are executable there, wherein a check component of the respective host calculates a respective check identifier via host-specific features and via features of the respective control application, where the check identifier and an initial application certificate of the control application are communicated to a registration component, the registration component verifies the check identifier and the initial application certificate and, in cases of a positive verification result, creates a device configuration certificate and an application instance certificate and communicates them to the host, linking of the application instance certificate with the control application is authorized via the device configuration certificate, and where execution of the container providing the control application on the host is authorized by the application instance certificate.

Host, method and system for the securely executing control applications

A method of capturing packets from one or more applications hosted on containers connected to one or more network interfaces in a section of the industrial network by a packet capture service. The method includes receiving a capture request for capturing packets associated with a connection of a second container from the one or more containers, determining a network path associated with the connection of the second container, determining the presence of the one or more network interfaces in one of first capture session and the connection between the packet capture service and a packet capture client, and approving the capture request based on the between the packet capture service and a packet capture client for creating a second capture session for capturing packets associated with the connection of the second container.

Method of capturing packets from applications hosted on containers

Application developers want to incorporate and maintain only the absolutely essential TSN software in their container applications, but not complete TSN device stacks. At the same time, their TSN application containers are able to request TSN streams from the network dynamically at any time (ad hoc). For this, the TSN application containers require topology information from an Edge device (e.g., like the device access point(s) for TSN network(s)) in the simplest manner possible. A method and an apparatus are disclosed herein to solve the problem described above as a result of the required information and address tuples being provided to the container following installation and not needing to be already known during development.

Method and apparatus for configuring an application

Method for synchronizing control applications via a communication network for transferring time-critical data, wherein network infrastructure devices determine, for the forwarding of datagrams associated with selected data streams, respective time delays between a planned transmission time of the datagram and an actual transmission time of the datagram in question, where the selected data streams are assigned to control applications running on communication terminals, and where a beginning of a next end-node-side transfer cycle is determined by a starting-node-side control application based on the time delay determined by a preceding network infrastructure device in question, an accumulated maximum time delay and a transmission time of the datagrams to achieve synchronization between transfer cycles of starting-node-side control applications and transfer cycles of end-node-side control applications.

Network infrastructure device, communication terminal and method for synchronizing control applications via a communication network for transferring time-critical data

A method for providing time-critical services via a flow control environment, wherein each service is assigned a server component that includes at least one application instance and that is formed by a flow control component that is loadable into the flow control environment and executed there, where an individual virtual communication network is made available for each server component via the flow control environment, a reverse proxy of a subnetwork, comprising the flow control environment, forwards service access requests, for use of the services outside of the subnetwork in accordance with predefined forwarding rules, to the respective server component via its virtual communication network, and the where the virtual communication networks are used for all application instances of the respective server component for forwarding the service access requests.

Method and system for providing time-critical services via a flow control environment

Method for detecting data traffic in a communication network, wherein in order to detect data traffic in a communication network, at least one network infrastructure device to which at least one first communication terminal and one second communication terminal are connected provides a monitoring interface that is secured against unauthorized access, is assigned to the two communication terminals, and is intended for detecting data traffic between at least the first and the second communication device, where a device detecting apparatus determines available monitoring interfaces on network infrastructure devices as well as address information assigned to the monitoring interfaces and provides this interface information to at least one recording apparatus that is separate from the at least one network infrastructure device.

Method and system for detecting data traffic in a communication network

A system for data transmission between a client device, a server device and a plurality of automation devices, wherein the server device includes a descriptive representation of each of the plurality of automation devices, wherein the server device includes a server instance, which server instance is configured to load one of the descriptive representations based on a hostname identifying one of the plurality of automation devices, and wherein the server instance is configured to transmit data from the automation device to a client application on the client device based on the loaded descriptive representation of the automation device.

System for data transmission between a client device, a server device, and a plurality of automation devices

A system and method for providing time-critical services that are each assigned at least one server component formed by a software container which is loadable into a process control environment and which is executable at the process control environment, wherein a virtual IP stack is provided for each server component, which is connected to a virtual switch comprised by the process control environment, where each service additionally comprises a directory service component for determining services provided within the process control environment, where the directory service components are interconnected via a communication interface which is separated from the virtual switch and from the virtual IP stacks of the server components, and where an aggregator component formed via an additional software container is connected to the separated communication interface, where the aggregator component makes available, outside of the process control environment, reconciled information regarding the services provided via the server components.

Method and system for providing time-critical services

Method and system for providing time-critical services via a flow control environment, wherein at least one respective server component is provided for each service, wherein the server component is formed by a flow control component that is loadable into the flow control environment and executed there, where a configuration unit for at least one gateway component of a subnetwork forming the flow control environment ascertains globally valid access information associated with respective addressing information of the server components that is valid within the subnetwork, based on a mode of operation predefined via the configuration unit, one or more gateway components connected in parallel and/or in series are used, and where the at least one gateway component forwards service access requests to the server components in accordance with the forwarding and/or filter rules and the mode of operation.

Automation device, computer program, computer-readable medium and method for automatically configuring an automation device, wherein a) an automation device is provided, b) a device management unit monitors whether an automation identifier is assigned to the automation device, c) upon identifying an assignment of this kind, the device management unit queries a central cluster management unit to determine whether a description object, in which the automation identifier assigned to the automation device is stored, already exists in a cluster state database belonging to the cluster containing description objects for nodes of the cluster, d) if no such description object yet exists, or if such a description object does exist but has been declared inactive, then the device management unit creates, in the cluster state database for a node identifier assigned to the automation device, a description object in which the automation identifier assigned to the automation device is stored.

Automation device, computer program, computer-readable medium and method for automatically configuring an automation device

A system, computer program, computer-readable medium and method for providing a redundant relay, particularly routing function in a network, wherein a superordinate subnetwork is connected to a subordinate subnetwork via redundant relays, particularly routers, a maximum of one of the redundant relays is operated in an active mode at any one time, while the remaining relay(s) are in standby mode, each redundant relay forms a relay redundancy module for controlling the relay mode and a DHCPv6 client for processing a prefix delegation, particularly in accordance with RFC 3633, and the redundant relays each include a relay control module, to which the relay redundancy module of the particular relay signals the current relay mode, and the relay control module of the active relay synchronizes a virtual DUID of its DHCPv6 client and/or a prefix delegated to the active relay to the (or each) relay in standby mode.

System, computer program, computer-readable medium and method for providing a redundant relay, particularly a routing function

A method for providing topology information, use of a name service server, a device, a computer program, a computer-readable medium and a method for configuring a device to be named within an industrial network, wherein a) the device to be named receives a neighbouring name message from a neighbouring device, b) a self-naming module creates a topological neighbouring domain name based on the neighbouring name message, c) the self-naming module transmits the topological neighbouring domain name to a name service server, d) the self-naming module receives from the name service server a response message, which includes at least one device name of the device to be named belonging to the topological neighbouring domain name, and e) at least one device name from the response message is assigned to the device to be named and this name is stored as the device name by the self-naming module.

Method for configuring, method for providing topology information, name service server, device, computer program and computer-readable medium

A method for establishing a stream in a Time-Sensitive Networking (TSN) network, wherein a request message is sent by a stream subscriber to a Domain Name System (DNS) server, upon which entries are stored that each comprise a stream identifier of a first type assigned to a stream, and a stream identifier of a second type that is different from the first type and is assigned to the respective stream, and the specification of a predefined type exclusively used for, or forms these types of entries, where the request message comprises a stream identifier of the first type and the predefined type known to the at least one stream subscriber, where the stream subscriber receives a response message from the DNS server, which contains a stream identifier of the second type belonging to the stream, and where the stream subscriber logs on to the stream using the stream identifier obtained.

Method for establishing a stream, method for providing stream identification information, domain name system (DNS) server, device computer program and computer-readable medium

Coordinator and method for providing control applications via a communication network, wherein prior to migrating a flow control component of a control application to a server device, a coordinator checks whether a data stream for transmitting application data was set up for the control application, where the coordinator enables migration of the flow control component if a data stream has not been set up, in the event a data stream had been set up previously, a check is performed to determine whether sufficient resources for data transmission are available for paths to the server device, such that if sufficient resources are unavailable, migration of the respective flow control component is stopped, and if sufficient resources are available, the coordinator prompts set-up of the data stream to the server device and disconnection of the previously set-up data stream and enables migration of the flow control component to the server device.

Coordination device and method for providing control applications via a communication network for transmitting time-critical data

A method in which a monitoring unit allocated to a communication device checks, based on a name resolution protocol, whether a second communication network address allocated to the first communication device becomes valid in order to set up an uninterrupted communication connection to the communication device that is allocated to an industrial automation system, where in cases of an allocation of a new valid communication network address and an existing communication connection, the monitoring unit initiates a set-up of an additional communication connection using the new communication network address.

Growing community of inventors

Nuremberg, Germany

Harald Albrecht