Industrial-Grade DevOps

Industrial-Grade DevOps
Balancing Speed with Extreme Quality
Frank Buschmann w/ Joachim Fröhlich, Lars Gelbke, Fei Li, Marc Zeller, Peter Zimmerer
Siemens AG, Corporate Technology

DevOps is state-of-practice in enterprise IT software engineering
Leaders in DevOps experience measurable benefits

„ Market attractive
product quality1

§ 18% increase in revenue
§ 19% improvement ... See more

in
product quality and performance

„ Short time-tomarket1

§ 21% reduction of time to market
for product innovations

„ Minimal cost of
downtime2

§ 60% decrease of deployment
downtime costs per year
§ On demand product deployment

„ IT performance2

§ 3x lower deployment failure rate,
24x faster recovery from failure
§ >2000x shorter lead times for
product changes

1) CA Technologies: DevOps: Enterprise Organizations‘ Newest Best Practice, July 2015

2) Puppet 2016 State of DevOps Report

Unrestricted © Siemens AG 2018
Page 2

30.05.2018

Frank Buschmann

The Digitalization of the industry requires an adoption of DevOps
It is the “how” to achieving business agility

Source: Siemens AG
Unrestricted © Siemens AG 2018
Page 3

30.05.2018

Frank Buschmann

The Digitalization of the industry requires an adoption of DevOps
It is the “how” to achieving business agility

Digitalization @ Siemens
Digital Services

Vertical Software
Digitally Enhanced
Electrification and
Automation

110010
101001
110110

8 % growth p.a.

Source: Siemens AG
Unrestricted © Siemens AG 2018
Page 4

30.05.2018

Frank Buschmann

Yet the adoption of DevOps in industry is challenging
Stringent industry-specific constraints and requirements apply

Source: Siemens AG
Unrestricted © Siemens AG 2018
Page 5

30.05.2018

Frank Buschmann

Yet the adoption of DevOps in industry is challenging
Stringent industry-specific constraints and requirements apply

Multi-level Dev
Ecosystems

Regulated
Domains

Ops Environment
Complexity

Solution
Businesses

IT Security

Systems
Engineering

Operational
Quality

Source: Siemens AG
Unrestricted © Siemens AG 2018
Page 6

30.05.2018

Frank Buschmann

Yet the adoption of DevOps in industry is challenging
Stringent industry-specific constraints and requirements apply

Multi-level Dev
Ecosystems

Regulated
Domains

Ops Environment
Complexity

Solution
Businesses

IT Security

Systems
Engineering

Operational
Quality

Source: Siemens AG
Unrestricted © Siemens AG 2018
Page 7

30.05.2018

Frank Buschmann

Ops environment complexity complicates continuous deployment
Operations environments are often polyglot, critical infrastructures
„ Multiple IT, OT and field networks
„ Restricted network access
„ Multi-platform execution environments
„ Federated cloud to edge deployments
„ Flexible deployment demands

„ What delivery pipeline architectures enable continuous
deployment into industry operations environments?

Source: Siemens AG

„ What technologies support flexible deployment of
features to multi-platform execution Siemens AG
Source: environments?
Unrestricted © Siemens AG 2018
Page 8

30.05.2018

Frank Buschmann

Delivery pipelines extend to the field
OPS

„ Dedicated (restricted) DevOps management
networks per (restricted) operations network

Bin
Repository

„ Secure connection of DevOps management
networks with the delivery pipeline via VPN

„ Provisioning of on-premise deployment
execution stacks using containerization

VPN

Deployment

Bin
Repository

Execution Stack

Bin
Repository
Execution Stack

Pull

Deployment

„ Management of on-premise deployment
execution stacks as deployable services

Push

Execution Stack

VPN

„ Dedicated on-premise deployment execution
stacks per DevOps
Release
management network

Deployment

DEV

Asset Mgmt.

Centrally managed, federated on-premise deployment infrastructure

Execution Stack
Unrestricted © Siemens AG 2018
Page 9

30.05.2018

Frank Buschmann

Diverse deployment scenarios
No two operations networks are likely to be the same
„ On-premise deployment service directly
accesses the main repository via Internet

Execution Stack

„ Repository mirror with the latest feature versions
„ Asset management to orchestrate devices for update
„ Deployment service updates devices via feature push

Execution Stack

Pull

Unrestricted © Siemens AG 2018
Page 10

30.05.2018

Push Update
Push

Execution Stack

„ Repository mirror with the latest product features

Bin
Repository

Deployment

Pull
Update

Bin
Repository

Deployment

„ On-premise deployment service runs on
edge device and updates it via feature pull
Asset Mgmt.

VPN

Deployment

Bin
Repository

VPN

Direct Connection (for open Ops networks)

„ Deployment service runs on edge device and
updates it via feature pull

Execution Stack

Frank Buschmann

Delivery pipelines support multi-platform build, test, and release
Parallelization of build, integration and test in virtual, emulated environment
„ Versioning and release management strategies for products with flexible deployment demands
„ Parallel build stage with dedicated build infrastructure per product execution platform
„ Features w/ deployment flexibility packed for all execution environments on which they can run
„ Common integration and test stage based on virtualization and emulation
„ Repository with images for all deployment platforms available to the deployment service

Delivery Pipeline
(WIN)
Version
Ctrl.

Build
(x64)

Deploy
to Test

Release

Bin
Repository

(ARM)
Unrestricted © Siemens AG 2018
Page 11

30.05.2018

Frank Buschmann

Environment orchestration in industrial context
Always different, always specific, always something new
„ Leveraging modern orchestration and provision technologies simplify the creation and
management of industrial DevOps environments
„ Most state-of-the-art technology need (some)
adaption to fulfill industry-specific needs
„ Ops environment complexity enforces tailored solutions
„ Single enterprise standard does not work
„ Orchestration requires proper tooling
„ Secure networking required to bridge dev and ops
„ “Environment as asset” is a key mindset change!
„ Suggests role and practice extensions in
existing scaled agile frameworks, e.g., SAFe

Unrestricted © Siemens AG 2018
Page 12

30.05.2018

Frank Buschmann

Regulated domains challenge agility and cycle time
Regulatory compliance like functional safety is often mandatory
„ Agility and continuous delivery create high
volatility in ensuring regulatory compliance
„ Current practice is time and effort intense
„ Cross-cuts multiple engineering disciplines
„ DevOps environments are subject of certification

„ What enhancements to agile practices help address
regulatory compliance in development fast enough?
„ What methods and technologies support continuous
delivery in the face of regulations and certification?

Source: Siemens AG

Unrestricted © Siemens AG 2018
Page 13

30.05.2018

Frank Buschmann

Safety assurance lifecycle in a nutshell
Strict compliance to (domain-specific) norms is mandatory

Hazard and
Risk Analysis

Safety
Analysis

Safety
Requirements

Definition

Design

„ Regulatory compliance
requires dedicated
activities in addition to
“normal” development

Safety Case

Safety Tests

Realization

Test and
Verification

Certification

Release

Deployment

Operations

Feedback

Unrestricted © Siemens AG 2018
Page 14

30.05.2018

Frank Buschmann

Methods and technologies for safety assurance are emerging
Research driven by funded projects on EU and national level*
„ Component Fault Trees (CFT)
„ Safety Concept Trees (SCT)
„ Conditional Safety
Certificates (ConSerts)

«block»
TLA Syst em::Ego V ehicle:: TLA Fu nction
«CFT»
TLA Function
Overrun a red tr affic light, when TLA
system has vehicle control

Nominal
accel _Too
.
Hi h
g

«CFT Instance»
( Accelerat i n Coor di ator)
o
n

Nominal
deceleration
T oo_Low

Emergency
decelera tion_Too
Low

Em ergency
decelerat o n
i
Too_Low

«CFT I nstance»
( Longitu di al Contr ol
n
)

«CFT Instance»
(Side Collsion Avoidance)
i
Acce l r ation
e
vector Too_High
No TL State
Cha ngede tect ed
(Camera)

TL Curr ent
Shift Plan
w ong
r
Value

D i tance to TL
s
T oo_High

D istance to TL
Too_High

«CFT Instance»
(Camer a-basedTL State
Dete ction)

TL Curr ent Shift
Plan wrong
V al e
u

Distance to TL
Too_H igh
« CFTI nst ance»
(Se l -localization)
f

Came ra m age
i
does n ot cont ai
n
TL st ate chan ge

Cam era image
does not contain
TL state change

„ Component-based Failure
Mode and Effect Analysis
(FMEAexpress)

A cceleration vector
Too_H igh

«CFT Instance»
( Opt i alTr aj ctor y C omputation)
m
e

No TL Stat echange
detected (Camer a)

TL Cur rent Shift
Plan wrong
V al e
u

Cam era
i age
m

Hazard and
Risk Analysis

TL Shi t Plan
f

DDI

Safety
Analysis

Safety Case
«Goal
»
G1
Side colli io wi hc ross ng veh e s
s n t
i
ic l
a
voided

«G o
al»
G2

«Goal
»
G3

«
Context »
C0
Safety goal {A void overrunning
:
a red traffic lig whenTL A
ht,

{Ego Vehi le} does not cros s a r e
c
d
traff i l ght
ci

.. .

s ystem has vehi lec on rol
c
t }

«Strategy»

«Context »

St1
A rgume over critical
nt
s cenarios of traffic lig
ht
phas e
s

C1
C i ic al sc enari s o tr af fi l ght
rt
o f
ci
p es arered to gree and
has
n
g e to red
r en

«Goal»

„ Digital Dependability
Identities (DDI)

Safety
Requirements

Definition

Design

«Context »
C2
Sc e
nario redto green:
[x ]

Safety Tests

Realization

Test and
Verification

« oa
G l»

G4

G5

{EgoV e
hicle} do n c ross a
es ot
redt raffi ilght duri g sc enari
c
n
o
"red to g e
r en"

{Ego Vehicle} does not cros s a red
tr a fi ilght duri g sc ena o "green
f c
n
ri
to red"

«C
ontex t»
C3
Sc en greento red:
ario
[x ]

Certification

Release

Deployment

Operations

Feedback

*) EU H2020 project DEIS (Dependability Engineering Innovation for Cyber Physical Systems), national BMBF project CrESt (Collaborative Embedded Systems)
Unrestricted © Siemens AG 2018
Page 15

30.05.2018

Frank Buschmann

Non-agile culture and limited automation are core challenges
Negative impact on agility and cycle time
„ Agile practices are available
but rarely practiced

Manual

Manual
Manual

Paperwork

„ Though tool supported, activities
are mostly manual
Hazard and
Risk Analysis

„ Compilation of safety case is
typically tedious and
error-prone paperwork

Safety
Requirements

„ Certification by authorities
not integrated with
development
Hazard and
Risk Analysis

Safety
Analysis

Safety
Requirements

Definition

Design

Safety
Analysis

Safety Case

Safety Tests

Safety Case

Safety Tests

Realization

Test and
Verification

Feedback

Limited
Automation

Certification

Release

Deployment

Certification

Separated
Dev

Operations

Authorities

Unrestricted © Siemens AG 2018
Page 16

30.05.2018

Frank Buschmann

Automation of delivery process is a viable first step
Improves traceability and reduces pre-certification efforts
„ Automatic generation of safety tests from component fault trees (CFTs)
„ Integration of safety tests with test automation in delivery pipeline
„ Adaptive test and simulation environments with hardware in the loop for test execution
„ Automatic generation of safety cases using digital dependability identifiers (DDIs)

Hazard and
Risk Analysis

Automation

Safety
Analysis

Safety Case

Model-Based
Safety
Requirements

Safety Tests

Automation

Certification

110010
101001
110110

Digital

Automation

Unrestricted © Siemens AG 2018
Page 17

30.05.2018

Frank Buschmann

Component Fault Trees (CFTs)*
Extend classic fault trees with a component concept
Extension of classic fault trees with a
component concept
„ Focus of are failure modes of an
encapsulated system component
„ Failures visible at the inport / outport
of a component are modeled using
Input / Output Failure Modes
Divide-and-conquer strategy for systems
„ Modular, hierarchical decomposition of
system fault trees

Legend:

„ Potential reuse of CFTs in other systems
*) Höfig, K., Joanni, A., Zeller, M., Montrone, F., Rothfelder, M., Amarnath, R., Munk, P., Nordmann, A. (2018). Model-based Reliability and Safety: Reducing the
complexity of safety analyses using component fault trees, Proceedings of the 2018 Annual Reliability and Maintainability Symposium (RAMS)
Unrestricted © Siemens AG 2018
Page 18

30.05.2018

Frank Buschmann

Automated Test Case Generation from CFTs
Derive test cases from the failure behavior specification (safety tests)
„ Show that in case of failure the implemented behavior is compliant to the specified behavior
„ Use of test results to verify if safety mechanisms are correctly implemented
„ Provide inputs and expected outputs
for fault injection tests

Test
inputs

Expected test
outputs

aÙbÙc

f

*) Zeller, M., Höfig, K. (2015). CONFeTTI – Component Fault Tree-Based Testing, Proceedings of the 25th European Safety and Reliability Conference (ESREL
Unrestricted © Siemens AG 2018
Page 19

30.05.2018

Frank Buschmann

Digital Dependability Identity (DDI)*
Ensures interoperability of safety information across organizations
„ Contains all information that uniquely describes the safety characteristics of a system
component and its interaction
„ Supports encapsulation of model-based descriptions of a system component’s safety artifacts
„ Provides standardized, machine-readable interfaces to access the safety artifacts
„ Component DDIs can be
connected to describe
safety characteristics
of an entire system

*) Schneider, D.; Trapp, M.; Papadopoulos, Y.; Armengaud, E.; Zeller, M. Höfig, K. WAP: Digital Dependability Identities 2015 IEEE International Symposium on
Software Reliability Engineering (ISSRE), 2015, 324-329
Unrestricted © Siemens AG 2018
Page 20

30.05.2018

Frank Buschmann

Composition of safety cases from DDIs
Definition and execution of modular, hierarchical safety cases
„ Continuous and defined extension along the system’s lifecycle
„ Basis for automatic execution of formal safety tests
„ Support for reliable and traceable certification by authorities
Safety-relevant
artifacts

DDI

Integration at
design time

Integration at
configuration time

Integration at
runtime

Unrestricted © Siemens AG 2018
Page 21

30.05.2018

Frank Buschmann

Regulated domains challenge agility and cycle time
First steps towards DevOps possible, a long and windy road is still ahead
„ Component Fault Trees (CFT), Conditional Safety Certificates (ConSerts) and Digital
Dependability Identities (DDI) are promising technologies to automate the delivery process
„ Design and implementation of adaptive test
and simulation environments is a challenge
„ Automated delivery process is important, but not
sufficient to practice DevOps in regulated domains
„ Additional methods and technologies required,
e.g., for rapid design, change / impact analysis

Source: Siemens AG

„ Agile practices available, but practices do not automatically create culture!
„ Certification of tools is a challenge by itself, especially if DevOps environments evolve
Unrestricted © Siemens AG 2018
Page 22

30.05.2018

Frank Buschmann

Operational quality demands side-effect-free deployment
Correct system behavior, availability and performance must not degrade
„ Many systems run 24/7, some with 99.999%
availability – especially in Operations and Control
„ System correctness and (real-time) performance
must be guaranteed when needed
„ Actual configuration may differ from test
configuration, e.g., hardware change,
exact position of machine
„ What product designs enable continuous deployment
in run and test-in-production without side effects?
„ What runtime architectures ensure a side-effect-free
deployment of features in run?

Source: Siemens AG

Unrestricted © Siemens AG 2018
Page 23

30.05.2018

Frank Buschmann

Product features must be prepared for continuous deployment
Design for independence
„ Realize product features as independent, self-contained Microservices
Test Scripts and Data
„ Define and block dedicated time and resource budgets for testing in production
Microservice

Input
Sensor
Proxy

1..n

Control
Logic

1..n

Actuator
Proxy

Driver

Driver

Output

Unrestricted © Siemens AG 2018
Page 24

30.05.2018

Frank Buschmann

Product features must be prepared for continuous deployment
Design for testability
„ Integrate a permanent TEST PROBE* to dynamically configure and execute tests in production
Test Scripts and Data
Microservice
Test
Interpreter

Test
Probe

Test
Controller

Input
Sensor
Proxy

1..n

Control
Logic

1..n

Actuator
Proxy

Driver

Driver

Output

*) F. Li, J. Fröhlich, D. Schall, M. Lachenmayr, C. Stückjürgen, S. Meixner, F. Buschmann: Microservice Patterns for Industrial Edge Applications, EuroPLoP 2018
Unrestricted © Siemens AG 2018
Page 25

30.05.2018

Frank Buschmann

Product features must be prepared for continuous deployment
Design for availability
„ Use AUTHORITY DETERMINATION* paired with PRIMARY ACTIVATION* for seamless version switch
and fall back in case of deployment failure
Test Scripts and Data
Microservice
Test
Interpreter

Test
Probe

Test
Controller

Input
Sensor
Proxy

1..n

Authority
Determination

Control
Logic

1..n

Actuator
Proxy

Driver

Driver

Output

Primary
Activation

*) Publication in preparation
Unrestricted © Siemens AG 2018
Page 26

30.05.2018

Frank Buschmann

Product features must be prepared for continuous deployment
Design for availability
„ Integrate CONNECTORS* to separate domain logic and infrastructure domains from one another
Test Scripts and Data
Microservice
Test
Interpreter

Test
Probe

Test
Controller

Input
Sensor
Proxy

1..n

Control
Logic

1..n

Actuator
Proxy

Driver

Driver

Output

Connector

Authority
Determination

Primary
Activation

*) F. Li, J. Fröhlich, D. Schall, M. Lachenmayr, C. Stückjürgen, S. Meixner, F. Buschmann: Microservice Patterns for Industrial Edge Applications, EuroPLoP 2018
Unrestricted © Siemens AG 2018
Page 27

30.05.2018

Frank Buschmann

Product features must be prepared for continuous deployment
Design for independence, testability and availability
„ Realize product features as independent,
self-contained Microservices

„ Integrate a permanent TEST PROBE to dynamically
configure and execute tests in production

Microservice
Test
Interpreter

Test
Probe

Test
Controller

Input
Sensor
Proxy

1..n

Control
Logic

Actuator
Proxy
1..n

Driver

Output
Driver

„ Define and block dedicated time and resource
budgets for testing

Test Scripts and Data

Connector

Authority
Determination

Primary
Activation

„ Use AUTHORITY DETERMINATION paired with
PRIMARY ACTIVATION for seamless version switch
and fall back in case of deployment failure
„ Integrate CONNECTORS to separate domain logic
and infrastructure domains from one another

Ensure all timing and resource
requirements are met!

Unrestricted © Siemens AG 2018
Page 28

30.05.2018

Frank Buschmann

Product features must be prepared for continuous deployment
Design for independence, testability and availability
„ Design based on “Microservice Patterns
for Industrial Edge Applications”
„ Paper accepted for EuroPLoP 2018*
„ Patterns integrate well with existing
Microservice pattern space, e.g. Microservice.io

How can we enable field tests of an industrial microservice to access internal
process data, possibly distributed across several, internal components,
without impairing the real-time behavior of the microservice under test?
Build a TEST PROBE permanently into each microservice. Encapsulate
testable process data. Make the TEST PROBE programmable, so that test
programs can exactly control read and write accesses to testable process
data. Let microservices treat TEST PROBES as ordinary components with
reserved and limited system resources, so that test programs cannot
accidentally change the microservice behavior

Test Scripts and Data
Microservice
Test
Interpreter

Test
Probe

Test
Controller

Input

1..n

Control
Logic

Actuator
Proxy
1..n

Driver

Driver

Output
Sensor
Proxy

Connector

Authority
Determination

Primary
Activation

*) F. Li, J. Fröhlich, D. Schall, M. Lachenmayr, C. Stückjürgen, S. Meixner, F. Buschmann: Microservice Patterns for Industrial Edge Applications, EuroPLoP 2018
Unrestricted © Siemens AG 2018
Page 29

30.05.2018

Frank Buschmann

Deployment architecture must support zero downtime
Design for test in production
„ Deploy new microservice version, connect it with the availability infrastructure of the current
version, let it receive input but “mute” is output
„ Execute pre-activation tests on the new microservice version via its TEST PROBE

Robot

Robot

Microservice V1.0

Microservice V1.0

Coordination

Output

Input

Coordination

Output

Input

Free resources

Microservice V2.0
Robot
controller

Ensure the device has dedicated resource
budgets for continuous deployment

Robot
controller
……
……
……

Test

Unrestricted © Siemens AG 2018
Page 30

30.05.2018

Frank Buschmann

Deployment architecture must support zero downtime
Design for seamless activation
„ Notify the AUTHORITY DETERMINATION infrastructure to determine the new primary
„ Let the PRIMARY ACTIVATION infrastructure activate the new microservice version when
seamless switch-over is possible

Robot

Robot

Microservice V1.0

Microservice V1.0

Coordination

Output

Input

Coordination

Output

Input

Microservice V2.0

Microservice V2.0
Robot
controller

……
……
……

Test

Robot
controller
……
……
……

Test

Unrestricted © Siemens AG 2018
Page 31

30.05.2018

Frank Buschmann

Deployment architecture must support zero downtime
Design for fail-over
„ Continuously test the new microservice version in production via its TEST PROBE
„ Fall back to old microservice version in case of problems, otherwise uninstall it

Robot

Robot

Free resources

Microservice V1.0
Coordination

Output

Coordination

Output

Input

Input

Microservice V2.0

Microservice V2.0

Robot
controller

Robot
controller
……
……
……

Test

……
……
……

Unrestricted © Siemens AG 2018
Page 32

30.05.2018

Frank Buschmann

Deployment architecture must support zero downtime
Design for test in production, seamless activation and fail-over
„ Deploy new microservice version to device,
let it receive input but “mute” is output
„ Execute pre-activation tests on the new
microservice version via its TEST PROBE

Robot

Robot

Microservice V1.0

Microservice V1.0
Coordination

Output

Microservice V2.0

Free resources

Robot
controller

Robot
controller

„ Notify the AUTHORITY DETERMINATION
infrastructure to determine the new primary
„ Let the PRIMARY ACTIVATION infrastructure
activate the new microservice version when
seamless switch-over is possible
„ Continuously test the new microservice
version in production via its TEST PROBE
„ Fall back to old microservice version in case
of problems, otherwise uninstall it

Output

Coordination

Input

Input

……
……
……

Robot

Robot

Free resources
Coordination

Test

Microservice V1.0
Output

Input

Output

Coordination

Input

Microservice V2.0

Microservice V2.0
Robot
controller

……
……
……

Robot
controller
……
……
……

Test

Ensure the device has dedicated resource
budgets for continuous deployment

Unrestricted © Siemens AG 2018
Page 33

30.05.2018

Frank Buschmann

Operational quality demands side-effect-free deployment
Proof-of-Concept up and running

Demonstrator set-up
Demonstrator

Expected behavior

Lab set-up

Lana
Lana

Test

Activate

Activated

µService
2
DevOps
pipeline

Control
dashboard

3)
4)

Control
System

µService
2a

Gatekeeper
Feature
Activated
T-Rux
3) Deploy in operation
4) Monitor
5) Testing in operation

Unrestricted © Siemens AG 2018
Page 34

30.05.2018

Frank Buschmann

Operational quality demands side-effect-free deployment
Key aspects addressed, several research questions remain
„ Design for continuous deployment adopts and enhances patterns for fault-tolerant systems
„ Design concepts are feasible for independent microservices that implement a
self-contained control program
„ PRIMARY ACTIVATION is a sensitivity point
regarding correctness and availability
„ Additional design concepts necessary for
„ Control programs that are federated across
multiple (distributed) microservices
„ Assurance that deployment is side-effect-free
to other microservices

Source: Siemens AG

„ Applicability of common test-in-production practices like chaos monkey uncertain
Unrestricted © Siemens AG 2018
Page 35

30.05.2018

Frank Buschmann

First adoptions of DevOps in industry target at the industrial IoT
Cloud to edge analytics applications are in focus
Source: Siemens AG

Siemens Industrial Edge offers users the possibility of executing a range of descriptive, diagnostic,
predictive and prescriptive analytical applications. This allows cloud connectivity (data to cloud) to be
used in combination with Edge Apps from Siemens, third party providers or end users themselves in
an integrated hardware and software ecosystem (Edge App to Device) for automation components.

Unrestricted © Siemens AG 2018
Page 36

30.05.2018

Frank Buschmann

First adoptions of DevOps in industry target at the industrial IoT
Key aspects are development efficiency and delivery automation
„ Adaptive Development Workspace

„ Delivery Pipeline and App Management

„ Centrally managed, locally adaptable by partners

„ Multi-staged pipeline with defined quality gates

„ Set-up and configuration < 30 min

„ Orchestration of apps federated across cloud and edge

„ Project templates to get developers productive < 1 day

„ Provisioning of runtimes for all target ops environments

„ Connectivity to delivery pipeline and edge devices

„ App management infrastructure

Unrestricted © Siemens AG 2018
Page 37

30.05.2018

Frank Buschmann

DevOps proof of concepts for industrial operations systems in work
MOM and SCADA are the target

Manufacturing Operations Management

Supervisory Control and Data Acquisition

Source: Siemens AG
Unrestricted © Siemens AG 2018
Page 38

30.05.2018

Frank Buschmann

DevOps proof of concepts for industrial operations systems in work
Deployment flexibility and operational quality in focus
„ Delivery pipeline for flexible deployment
„ Automatic orchestration of federated, distributed
applications: cloud, on-premise, cloud to edge

Build &
Test

Deploy

Public
Cloud

„ Automatic provisioning of runtime images for all
target ops environments

container

cloud native

„ Firmware updates
„ App and firmware management

On
Premise

Private
Cloud
container

„ Operational quality during deployment

container

cloud native

„ Reliability
„ IT Security
„ Availability (on-premise and edge)

container

Edge

container

Field

Unrestricted © Siemens AG 2018
Page 39

30.05.2018

Frank Buschmann

Research on industrial-grade DevOps ongoing
Tough industry challenges in focus

Operational Quality

Continuous Testing of
Software-intense Systems

IT Security / Regulated Domains

Agile Culture and
Automation

Systems Engineering

PLM and ALM Integration
and Automation

Source: Siemens AG
Unrestricted © Siemens AG 2018
Page 40

30.05.2018

Frank Buschmann

Continuous testing of software-intense industrial systems
Adaptive test and simulation environment to balance speed and quality
Enabler for shift-left and shift-right in software intense-systems, e.g., industry automation
„ Model-based Digital Twin of the software to get immediate and early feedback on its quality in
industrial environments
„ Virtual integration and
deployment as digital sandbox
„ X-in-the-loop to step-wise
frontload physical reality
into software development

Executable
Models

Virtual
Integration

Virtual
Commissioning

Real
System

Entire system

Real components

Real subsystems

Installed live
system

Specific system
aspects

Production data
Virtual system as
Digital Twin

Virtual
components
HiL / SiL / MiL

Virtual
components

Adaptive Test- and Simulation Environment
Evaluation

Emulation

Prove
*) concept plus prototype

Unrestricted © Siemens AG 2018
Page 41

30.05.2018

Frank Buschmann

Research in industrial-grade DevOps is well founded
Core technologies developed over a longer time period
Höfig, K., Joanni, A., Zeller, M., Montrone, F., Rothfelder, M., Amarnath, R., Munk, P., Nordmann, A. (2018). Model-based Reliability and Safety: Reducing the
complexity of safety analyses using component fault trees, Proceedings of the 2018 Annual Reliability and Maintainability Symposium (RAMS)
Möhrle, F., Zeller, M., Höfig, K., Rothfelder, M., Liggesmeyer., P. (2016). Automating Compositional Safety Analysis Using a Failure Type Taxonomy for Component
Fault Trees, Proceedings of the 26th European Safety and Reliability Conference (ESREL), pp. 1380-1387
Zeller, M., Höfig, K. (2015). CONFeTTI – Component Fault Tree-Based Testing, Proceedings of the 25th European Safety and Reliability Conference (ESREL), pp
4011-4017
Armengaud, E.; Macher, G.; Massoner, A.; Frager, S.; Adler, R.; Schneider, D.; Longo, S.; Melis, M.; Groppo, R.; Villa, F.; O’Leary, P.; Bambury, K.; Finnegan, A.;
Zeller, M.; Höfig, K.; Papadopoulos, Y.; Hawkins, R. & Kelly, T. DEIS: Dependability engineering innovation for automotive CPS 21st International Forum on
Advanced Microsystems for Automotive Applications, 2017
Schneider, D.; Trapp, M.; Papadopoulos, Y.; Armengaud, E.; Zeller, M. & Höfig, K. WAP: Digital Dependability Identities 2015 IEEE International Symposium on
Software Reliability Engineering (ISSRE), 2015, 324-329
Höfig, K.; Zeller, M. & Grunske, L. metaFMEA-A Framework for Reusable FMEAs Model-Based Safety and Assessment, Springer International Publishing, 2014,
8822, 110-122
Fröhlich, J., Stückjürgen, C. 2017: Reliable Inspection of an Autonomous System At System Runtime with Built-in Data Probes. ISSRE Workshops, Industry Track,
Toulouse, IEEE Computer Society 2017, ISBN
Fröhlich, J., Frtunikj, J., Rothbauer, S., Stückjürgen, C. 2016: Testing Safety Properties of Cyber-Physical Systems with Non-Intrusive Fault Injection – An Industrial
Case Study. SafeCOMP 2016, Trondheim, Springer, LNCS 9923.
Fröhlich, J., and Schwarzinger, M. 2006: Improve Component-Based Programs with Connectors.
Joint Modular Language Conference, Oxford, Springer, LNCS 4228
F. Li, J. Fröhlich, D. Schall, M. Lachenmayr, C. Stückjürgen, S. Meixner, F. Buschmann: Microservice
Patterns for Industrial Edge Applications, EuroPLoP 2018

SELECTED
PUBLICATIONS

Unrestricted © Siemens AG 2018
Page 42

30.05.2018

Frank Buschmann

Industrial-grade DevOps is key for the Digitalization of Industry
Helps mastering the digital transformation at speed and scale

Defines the “How” of Digitalization
Industry-specific challenges
to master
Successful adoption for
Industrial IoT
Research ongoing for
Industrial Operations and Control

Source: Siemens AG
Unrestricted © Siemens AG 2018
Page 43

30.05.2018

Frank Buschmann

Industrial-Grade DevOps
Balancing Speed with Extreme Quality
Frank Buschmann w/ Joachim Fröhlich, Lars Gelbke, Fei Li, Marc Zeller, Peter Zimmerer
Siemens AG, Corporate Technology

... See less