Control device and method for redundant connections in a control plane network

Abstract

The present invention relates to a control device having an integrated switch and configured to logically enable and disable an Ethernet port of the integrated switch. A device network consisting of at least two field devices, a main control device and a main switch, a secondary control device and a secondary switch is also disclosed, wherein the at least two field devices, the main control device and the main switch, the secondary control device and the secondary switch are connected in a daisy chain loop topology. And wherein the secondary control device is configured to logically enable and disable an Ethernet port of the secondary switch. A plane network consisting of such a device network is also disclosed. A method for controlling redundant connections in a plane network is also disclosed, the method comprising: detecting a failure of a main control device, initiating a failover, enabling an Ethernet port of a secondary switch, and disabling an Ethernet port of a main switch.

Description

Technical Field

[0001] The present invention relates to a method for controlling redundant connections in a plane network and a system architecture for implementing such control. Background Art

[0002] Industrial automation systems are provided to execute, control and supervise industrial processes. These automation systems are built from multiple devices, such as programmable logic controllers (PLC), programmable automation controllers (PAC), input / output devices (I / O devices), field devices (e.g., sensors and actuators), which are interconnected via an operating technology OT network (i.e., an industrial device network) using industrial protocols (such as Modbus, ODVA Ethernet / IP, Profinet, etc.). Such automation systems are also typically connected to an enterprise information technology IT network, i.e., a control room network, which uses public IT protocols on TCP / IP and Ethernet IEEE 802.3 to exchange data and signals with, for example, an ERP system or other data management system. These industrial automation systems and enterprise systems are usually combined and supervised from the control room.

[0003] refer to Figure 1 , shows a first example of a configuration 100, wherein a control room network 110 is connected to an industrial device network 120. The control room network 110 includes a main computer system 111 and a layer 2 switch 112. The device network includes two field devices 123, 124, a main PLC 121, an auxiliary PLC 122, and a layer 2 switch 125. The PLCs 121, 122 and the field devices 123, 124 are connected in a daisy chain loop topology. Indicated by square ports and cable links in the figure. The auxiliary PLC 122 is provided for redundancy reasons in the event of a failure of the main PLC 121, and is intended to promote high availability of the control system. In addition to the connection for exchanging data within the network, the two PLCs 121, 122 are also connected via a dedicated link 128 to handle failover.

[0004] The device network 120 uses one of the known industrial protocols, such as Modbus, while the control network 110 uses the common IT protocol over IEEE802.3 Ethernet. For the connection between the switch 112 of the control network 110 and the switch 125 of the device network, the Ethernet protocol is used. The switch 125 then provides communication within the device network 120. Since the two PLCs are part of the same daisy chain, the switch 125 provides loop detection to prevent so-called broadcast storms in which communication messages are continuously forwarded. As shown by the black X in the port of the field device 123.

[0005] Generally speaking, a switch operates at layer 2 of the OSI model and is equipped with multiple ports for providing connections between various devices within a local area network (LAN). Various protocols can be used to transmit messages over IEEE 802.3 (commonly known as Ethernet). Therefore, the ports of a switch can be referred to as Ethernet ports.

[0006] Using switch-only interconnects Figure 1 The configuration is often referred to as a flat network architecture, which has the benefit of providing transparency and ease of control management. There is no hierarchical structure, and there is no means for routing traffic. Figure 1 A disadvantage of configuration 100 is that there is only one connection between the networks and further connections cannot be added for increased redundancy without increasing complexity to address routing requirements.

[0007] refer to Figure 2 , a second example of configuration 200 is shown, in which a control network 210 is connected to a device network 220. Again, the control network 210 includes a main computer system 211 and a switch 212. The device network includes two field devices 223, 224, a main PLC 221 and an auxiliary PLC 222. The PLCs 221, 222 and the field devices 223, 224 are connected in a daisy chain loop topology. Again, in order to promote high availability of the control system, in the event of a failure of the main PLC 221, an auxiliary PLC 222 is provided for redundancy reasons. And the two PLCs 121, 122 are further linked via a dedicated link 228 to handle failover.

[0008] There is no switch in the device network, and the main PLC 221 and the auxiliary PLC 222 are independently connected to the control room switch 212, increasing the level of redundancy and reducing the number of devices required. In this configuration, loop detection now needs to be provided in the switch 212 to prevent broadcast storms. Therefore, this requires the switch 212 to provide loop detection, such as, for example, provided by the spanning tree protocol STP (Spanning Tree Protocol). The spanning tree protocol is intended to create a loop-free logical topology for an Ethernet network by disabling links that are not part of the tree. However, this brings unnecessary complexity and cost. Summary of the invention

[0009] The object of the present invention is to provide a redundant connection between a device network and a control network in a flat network architecture.

[0010] According to the present invention, this object is achieved by providing a device network comprising at least two field devices, a main control device and a main switch, a secondary control device and a secondary switch, wherein the at least two field devices, the main control device and the main switch, the secondary control device and the secondary switch are connected in a daisy chain loop topology, and wherein the secondary control device is configured to logically enable and disable an Ethernet port of the secondary switch.

[0011] According to one aspect, a flat network consisting of the disclosed device network and a control room network is provided, the control room network comprising a main computer system and a control room switch having at least two Ethernet ports, wherein the Ethernet port of the main switch and the Ethernet port of the auxiliary switch are respectively connected to the at least two Ethernet ports of the control room switch.

[0012] According to another aspect, a control device having an integrated switch is provided, and wherein the control device is configured to logically enable and disable Ethernet ports of the integrated switch.

[0013] According to yet another aspect, a method for redundant connections in a control plane network is provided, the method comprising detecting a failure of a primary control device, initiating a failover, enabling an Ethernet port of a secondary switch, and disabling an Ethernet port of a primary switch.

[0014] Further objects, aspects, effects and details of specific embodiments of the present invention will be described in the following detailed description of multiple exemplary embodiments with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] By way of example only, embodiments of the present disclosure will be described with reference to the accompanying drawings, in which:

[0016] Figure 1 A prior art example of a flat network configuration is schematically shown;

[0017] Figure 2 Another prior art example of a flat network configuration is schematically shown;

[0018] Figure 3 shows an example of a flat network configuration according to the present invention; and

[0019] Figure 4 An example of the method according to the invention is shown. DETAILED DESCRIPTION

[0020] refer to Figure 3 , an example of an IT-OT configuration 300 according to the present invention is shown. The IT-OT configuration 300 includes a control network 310 and a device network 320. The control network 310 includes a main computer system 311 and a layer 2 switch 312. The device network includes two field devices 323, 324, a main PLC 321 and a main switch 326, and an auxiliary PLC 322 and an auxiliary switch 327. In this example, the switches are shown as independent devices, and in other examples, they can be integrated into the main PLC 321 and the auxiliary PLC 322, respectively. The main PLC 321 and the switch 326, the auxiliary PLC 322 and the switch 327, and the field devices 323, 324 are connected in a daisy chain loop topology. In addition to the connection for the control network, the PLC is also connected via a dedicated connection 328, such as a redundant point-to-point fiber-optic-based connection, a backplane bus, a proprietary Ethernet link, or a field bus.

[0021] The secondary PLC 322 is provided for redundancy reasons in the event of a failure of the primary PLC 321, and is intended to promote high availability of the control system. This is referred to as a high availability system with a hot-standby configuration, meaning that both PLCs 321, 322 are powered on, but only one is actually executing the application. In the event of a failure of the primary PLC 321, a failover process will be initiated to allow the secondary PLC 322 to take over the execution of the application. Detection of failures may include monitoring operation using, for example, a heartbeat signal or other known means. In addition, during normal operation, activity data from the primary PLC 321 is typically exchanged with the secondary PLC 322 to ensure that the secondary PLC 322 is able to immediately take over the execution of the application in the event of a failover. Figure 3In the example of , the high availability system is considered to be hot standby because the redundant PLC is already running and is provided with currently valid data. In other examples, the configuration can be, for example, a warm standby (warm-standby) that first needs to implement data for the redundant PLC in the case of a failover, or a cold standby (cold-standby) that first needs to start the redundant PLC in the case of a failover.

[0022] The control network 310 and the device network 320 are connected via two independent connections, namely the links between the layer 2 switch 312 and the switches 326, 327: one primary link between the switch 312 and the primary switch 326 and one secondary link between the switch 312 and the secondary switch 327. This increases the level of redundancy and reduces the amount of complex, intelligent, expensive equipment required.

[0023] The device network 320 uses one of the known industrial protocols, such as Modbus, while the control network 310 uses a common IT protocol over IEEE802.3 Ethernet. Since only switches 326, 327 operating at data link layer 2 according to the OSI model are used, rather than smarter gateways operating at network layer 3 according to the OSI model, and due to the daisy chain loop topology, there is a risk of broadcast storms.

[0024] Therefore, the auxiliary PLC 322 is arranged to logically enable and disable the port 327a of the auxiliary switch 327, which is connected to the switch 312 of the control network 310. Preferably, the auxiliary PLC 322 is also arranged to logically enable and disable the port 326a of the main switch 326. Port 326a is mainly suitable for the configuration of the switch outside the PLC. Therefore, the auxiliary PLC 322 controls the operation of the auxiliary switch Ethernet port 327a. And preferably, it also controls the operation of the main switch Ethernet port 326a. Logically enabling or disabling a port can be established, for example, by controlling the MAC database of the corresponding switch or other related registers.

[0025] Note that both the primary and secondary links between switches 326, 327 and layer 2 switch 312 may be engaged, while for only one of switches 326, 327 the logical connection is enabled.

[0026] Therefore, referring to Figure 4 In case of detecting 401 a failure to the primary PLC 321, a failover process is initiated 402 and the Ethernet ports of the secondary switch are enabled 403 and the Ethernet ports of the primary switch are disabled 404. The method may also include notifying 405 the control network that the failover process has ended.

[0027] More generally, if the fault is of a software or logic nature, such as due to an erroneous calculation or user command, the faulty PLC can enter a fallback or safe state defined by the user. In other examples, the faulty PLC can reset itself. In addition, the faulty PLC can also reset the main switch. Thereafter, it can serve as a secondary PLC in hot standby. Or it can initiate a process to become the main PLC again. If the fault is of a hardware nature, an alarm needs to be sent to allow an operator to replace the defective device.

[0028] It will be understood that once the failover process is complete and the standby auxiliary PLC has taken over the functions and tasks, the auxiliary PLC will run as the primary PLC. And once the fault of the original primary PLC is repaired, the original primary PLC can begin to run as the auxiliary PLC.

[0029] In addition to the failure of the main PLC 321 itself, the main switch 326 or the main link to the switch 312 may also fail. In order to monitor this situation, the main PLC 321 and the auxiliary PLC 322 can use, for example, the Simple Network Management Protocol SNMP (Simple Network Management Protocol) to monitor the switches 326, 327 and their links to the switch 312. Therefore, whether it is a switch or a link, a failure in the main connection can be detected by the main PLC, and the main PLC can decide to start a failover process. Therefore, it can happen that the main PLC 321 or the auxiliary PLC 322 or both PLCs 321, 322 may decide to initiate a failover process. More generally, this depends on the state of each PLC, in which they operate as peers of each other.

[0030] Typically, a hub or switch learns the network it is operating on by storing every source MAC address mentioned in an incoming frame received on a particular port; thereby creating a MAC database that associates ports with MAC addresses. If the destination MAC address is not already known in the database, the incoming frame will be flooded to all other ports of the switch except the one where the incoming frame was received. Since there is typically only one device that responds and mentions its source MAC address, a new association of port and MAC address can be stored. In the event of a physical loop, an incoming frame will be sent through one or more ports, but will also be re-introduced due to the loop. As the frame is re-sent, it will repeatedly circulate the loop, reducing capacity until the switch eventually begins to drop frames and becomes unreliable.

[0031] as Figure 2For example, the spanning tree protocol or loop detection protocol can be applied. However, this will again bring similar risks of network segment isolation and network security. In addition, this spanning tree protocol may run too slowly in large, more complex infrastructures.

[0032] Therefore, configuring at least the auxiliary PLC or both the main PLC and the auxiliary PLC to be able to logically enable and disable the ports of the respective switches allows preventing broadcast storms. And it eliminates the need to take further measures by means of protocols, management and / or smarter, more expensive equipment. In this way, a simple, managed switch operating at data link layer 2 according to the OSI model can be used to enable auxiliary links to increase redundancy.

[0033] The disclosed IT-OT plane network configuration and method increases redundancy for the occurrence of a single failure, which means that only one link fails between the IT, control network 310 and the OT, device network 320. The occurrence of a double failure, which means that two links fail simultaneously, although unlikely, can certainly be addressed by expanding the number of links between the IT and OT networks.

[0034] Depending on the setup, ie, the configuration and equipment used, the secondary PLC 322 may configure the switch port 327a in several different ways, as described below.

[0035] 1. Use a port-based network access control protocol, such as IEEE 802.1X

[0036] Port-based network access control is used to allow only certain traffic on specific ports, basically only traffic related to the authentication protocol is allowed, and all other traffic is blocked. For example, for IEEE802.1X, this requires the supplicant to Figure 3 In the example of , the supplicant (ie, switch 312) wants to connect to the authenticator ( Figure 3 The secondary switch 327 in the middle) verifies the requester's credentials with the authentication server ( Figure 3 If a failover process is initiated, the port 327a of the secondary switch 327 to which the switch 312 is linked will be enabled by verifying the credentials of the switch 312.

[0037] 2. Remotely configure the switch using a proprietary protocol

[0038] Some network equipment manufacturers provide proprietary protocols for remotely configuring network equipment. For example, such a proprietary protocol may use Ethernet frames to transmit new settings. In this case, the equipment is equipped with dedicated hardware for processing the remote commands included in the transmitted Ethernet frames; in response to the remote commands, the settings of the network equipment are adapted.

[0039] 3. Use a PLC with an integrated switch

[0040] In the case where the switch is integrated with the PLC, the PLC can directly read & write the switch's IC registers. Therefore, in case of failover, the auxiliary PLC can change the logic setting of the auxiliary switch port by enabling the auxiliary switch port in the register. Since in this configuration, the failure of the main PLC will also affect the main switch, the main switch may not need to be disabled.

[0041] Combined with the above Figure 3 In the described example, a programmable logic controller PLC serves as a control device. In other examples, other suitable control devices, such as a programmable automation controller (PAC) or an embedded controller, may be deployed.

[0042] Although in the above combination Figure 3 In the described example, the control devices 321, 322 may be functionally identical, but it is understood that different types of control devices may be deployed within the same device network. For example, the secondary control device includes an integrated switch with the primary control device, and the secondary control device is configured to enable and disable ports of the primary switch using Ethernet frames or port-based network access control. Therefore, regardless of the specific types of control devices and switches, a flat network architecture with redundant connections between the device network and the control room network is retained.

[0043] As described above, the primary switch and the secondary switch may be integrated into the primary control device and the secondary control device, respectively. In other embodiments, the primary switch and the secondary switch may be integrated into one control device, either the primary and secondary control device or the secondary control device. When such a control device is used in a device network, the control device may be configured to enable and disable ports of the primary switch and the secondary switch.

[0044] Although the present invention has been described above with reference to specific embodiments, the present invention is not intended to be limited to the specific forms set forth herein. Instead, the present invention is limited only by the appended claims, and within the scope of these appended claims, other embodiments besides the specific embodiments described above are also possible.

[0045] In addition, although exemplary embodiments have been described above in some exemplary combinations of components and / or functions, it should be understood that alternative embodiments may be provided by different combinations of components and / or functions without departing from the scope of the present disclosure. In addition, it is specifically contemplated that specific features described separately or as part of an embodiment may be combined with other separately described features or parts of other embodiments.

Claims

1. A system for redundant connections in a control plane network architecture, comprising: at least two field devices (323, 324); A main control device (321) is connected to the main switch (326) via a first port of the main switch; A secondary control device (322) connected to the secondary switch (327) via a first port of the secondary switch; The main control device (321) and the main switch (326), the auxiliary control device (322) and the auxiliary switch (327), and the at least two field devices (323, 324) are connected in a daisy chain loop topology. wherein the Ethernet port (326a) of the main switch (326) and the Ethernet port (327a) of the auxiliary switch (327) are respectively connected to at least two different Ethernet ports of the control room switch (312), wherein the main switch (326) is connected to the control room switch via a first Ethernet port of the control room switch and the Ethernet port (326a) of the main switch (326), and the auxiliary switch (327) is connected to the control room switch via a second Ethernet port of the control room switch and the Ethernet port (327a) of the auxiliary switch (327), and Wherein, the auxiliary control device (322) is configured as: operating in a standby mode of the main control device (321); Detecting (401) a fault in the main control device (321); Initiate (402) failover; The Ethernet port (327a) of the secondary switch (327) is enabled (403).

2. The system according to claim 1, wherein: The master control device (321) is configured to enable and disable the Ethernet port (326a) of the master switch (326).

3. The system according to any one of claims 1 to 2, wherein: The secondary control device and / or the primary control device (322, 321) are configured to enable and disable Ethernet ports (327a, 326a) via a port-based network access control protocol.

4. The system according to any one of claims 1 to 2, wherein: The secondary control device and / or the primary control device (322, 321) are configured to enable and disable Ethernet ports (327a, 326a) via a proprietary protocol for remotely configuring network equipment.

5. The system according to claim 4, wherein: The proprietary protocol for remotely configuring network equipment includes Ethernet frames for transmitting commands and / or configuration settings.

6. The system according to any one of claims 1-2, wherein: The auxiliary switch (327) is integrated in the auxiliary control device (322); and / or The main switch (326) is integrated into the main control device (321).

7. The system according to any one of claims 1-2, wherein: The main switch and the auxiliary switch (326, 327) are integrated in the auxiliary control device or the main control device (322, 321).

8. The system according to any one of claims 1 to 2, wherein: The secondary control device and / or the primary control device (322, 321) is configured to write to an IC register of an integrated switch, the IC register comprising configuration settings of the switch.

9. The system according to any one of claims 1-2, wherein: Both the main control device (321) and the auxiliary control device (322) are powered on, and only the main control device (321) executes applicable programs, and during normal operation, activity data of the main control device (321) is exchanged with the auxiliary control device (322).

10. A method for controlling redundant connections in a plane network architecture, the plane network architecture comprising: At least two field devices (323, 324) are connected to a main control device (321) of a main switch through a first port of the main switch (326), and are connected to a secondary control device (322) of the secondary switch through a first port of the secondary switch (327), wherein the main control device (321) and the main switch (326), the secondary control device (322) and the secondary switch (327), and the at least two field devices (323, 324) are connected in a daisy chain loop topology, wherein the Ethernet port (326a) of the main switch (326) and the Ethernet port (327a) of the auxiliary switch (327) are respectively connected to at least two different Ethernet ports of the control room switch (312), wherein the main switch is connected to the control room switch via the first Ethernet port of the control room switch and the Ethernet port (326a) of the main switch, and the auxiliary switch is connected to the control room switch via the second Ethernet port of the control room switch and the Ethernet port (327a) of the auxiliary switch, the method comprising the following steps performed in the auxiliary control device (322): operating in a standby mode of the main control device (321); Detecting (401) a fault in the main control device (321); Initiate (402) failover; The Ethernet port (327a) of the secondary switch (327) is enabled (403).

11. The method of claim 10, further comprising configuring the secondary control device to: disable an Ethernet port (326a) of the primary switch (326).

12. A control device for redundant connections in a control plane network architecture, configured to: operating as a secondary control device (322) in a standby mode of the primary control device (321); Detecting (401) a fault in the main control device (321); Initiate (402) failover; Enable (403) the Ethernet port (327a) of the secondary switch (327), The Ethernet port (326a) of the main switch (326) and the Ethernet port (327a) of the auxiliary switch (327) are respectively connected to at least two different Ethernet ports of the control room switch (312), wherein: The main switch is connected to the control room switch via the first Ethernet port of the control room switch and the Ethernet port (326a) of the main switch, and the auxiliary switch is connected to the control room switch via the second Ethernet port of the control room switch and the Ethernet port (327a) of the auxiliary switch (327).

13. The control device according to claim 12, further configured to: The Ethernet port (326a) of the primary switch (326) is disabled (404).

14. The control device according to claim 13, further configured to: enabling and disabling an Ethernet port (326a) of the master switch (326) via a port-based network access control protocol; and / or The Ethernet ports (326a) of the master switch (326) are enabled and disabled via a proprietary protocol for remotely configuring network equipment.

Images