Detecting path failure in parallel redundancy protocol communication

Abstract

The invention is entitled "Detecting Path Failures in Parallel Redundancy Protocol Communications". An electronic device and other electronic devices include first and second ports that utilize a parallel redundancy protocol in a communications network that includes first and second lanes. The device includes processing circuitry, a PRP handling program, a protocol stack, a memory, a persistent storage device, accessible by the processing circuitry, and transmit and receive circuitry for transmitting and receiving packets. A redundancy manager is used to identify path failures in the network. The processing circuitry implements a method of detecting network path failures, the method including the other electronic devices transmitting frame pairs over the first and second lanes. The electronic device receives the frame pairs and implements a receive processing flow, deletes a redundant frame when the first or second frame is identified as a redundant frame, and compares first frame parameters with second frame parameters to determine when the path failure is present.

Description

Technical Field

[0001] The aspects disclosed in this invention relate to network communication using parallel redundancy protocols, such as network communication within a process control system. Background Technology

[0002] The commercially available Parallel Redundancy Protocol (PRP) standard IEC-62439-3T (which includes the High Availability Seamless Protocol (HSR)) provides redundant communication, where the same data is sent through two (or more) different paths (sometimes called channels). The Ethernet frames used for both PRP and HSR are the same, but the applications differ. HSR is implemented through nodes in a ring configuration, where frames are sent in each direction, while PRP is implemented through nodes in a parallel network, where frames are sent through two independent but parallel networks.

[0003] The provided PRP parallelism ensures that a single failure or a combination of failures will not cause communication interruption. A port on any node may fail without interfering with the system, or an Ethernet switch may fail without interfering with the system if the system supports nodes with both PRP and Ethernet devices.

[0004] For Ethernet communication commonly used in process control systems (PCS), this implies a dual-interface and parallel switch tree. To facilitate the rejection of duplicate (redundant) frames, electronic devices (generally referred to as nodes in a PRP network, often called PRP nodes with a first port and a second port) append a PRP Redundancy Control Tail (RCT) to the frame fields. These frame fields include: a sequence number (sometimes called an index); a channel indicator, generally called a port identifier (port ID; for two ports, there may be a first port that can use the first channel and a second port that can use the second channel); the frame size; and a PRP suffix that allows the receiving device to determine that the frame belongs to a PRP. This RCT of the frame is not visible to higher layers of the receiving node (it is considered padding). Receivers discard redundant (or duplicated) frames using various known methods.

[0005] The transmitter (transmitting node) inserts the same sequence number into both frames of a frame pair transmitted from two ports via corresponding channels, incrementing the sequence number by one for each transmitted frame. The receiver keeps track of the sequence number for each source address, which typically includes the source Media Access Control (MAC) address from which it receives frames. The received second (later received) frame, which has the same source address and sequence number as the first frame of the frame pair from either of the corresponding channels, is ignored (or discarded).

[0006] While intelligent Ethernet switches can detect and report when devices disconnect from the network, such as using simple network management protocols, PRP itself does not provide path failure detection. Therefore, applications using PRP communication running on the network cannot detect path failure issues until a significant number of failures occur. Summary of the Invention

[0007] This summary is provided to introduce a simplified selection of disclosed concepts, which are further described below in detail with reference to the accompanying drawings. This summary is not intended to limit the scope of the claimed subject matter.

[0008] The aspects disclosed in this invention recognize the problem that commercially available PRP packages do not provide path failure diagnosis. Therefore, for conventional PRPs, there is no warning of communication path failures until multiple communication failures occur, which is often too late for some systems such as PCS, which are known to include time-sensitive situations. The aspects disclosed in this invention include new techniques for fault detection in PRP-based communication networks and include the option to issue an alert in response to the first occurrence of a communication path failure in the network. For systems such as PCS, issuing alerts is considered important to enable timely corrective maintenance or to change process parameter settings before the relevant situation becomes serious (e.g., due to security concerns).

[0009] One aspect of this invention includes an electronic device and at least one other electronic device in a communication network comprising a first channel and a second channel, wherein each electronic device includes a first port and a second port, the first port utilizing the first channel and the second port utilizing the second channel, and the protocol used is PRP. The electronic device includes processing circuitry comprising or associated with: a PRP processor; a protocol stack; a memory and persistent storage device accessible by the processing circuitry; and transmit and receive circuitry for transmitting and receiving data packets. A redundancy manager (generally implemented in the memory of the electronic device) is used to identify path failures in the network.

[0010] The processing circuit implements a method for detecting network path failures. This method includes the other electronic device transmitting a frame pair, the frame pair having a first frame transmitted via a first channel and a second frame transmitted via a second channel. The electronic device receives the frames of the frame pair and implements a receive processing stream. The receive processing stream includes deleting redundant frames when either the first or second frame is identified as a redundant frame. The parameters of the first frame are compared with the parameters of the second frame to determine when a path failure exists.

[0011] The aspects of the method disclosed in this invention provide detection of communication path failures for network implementation of at least PRP communication, and provide options for implementing PRP via fault-tolerant Ethernet communication with almost no additional overhead. The aspects disclosed in this invention may also include early warning of path failures, enabling appropriate corrective actions to be taken. Attached Figure Description

[0012] Figure 1A Aspects of known PRP communication are illustrated, in which two features are shown: port ID and sequence number included in the frames of the transmitted frame pairs, wherein the rejection of duplicate frames on the receiving side is a feature that can be used as a component of the first path fault diagnosis method disclosed in this invention.

[0013] Figure 1B An exemplary PRP data stream is shown, which includes a transmit stream in the leftmost column and a receive stream in the rightmost column, with some text in the receive stream underlined to highlight the novel functionality related to the first method of path fault diagnosis disclosed in this invention, which includes identifying individual path faults.

[0014] Figure 2 This is a block diagram of an exemplary electronic device for implementing PRP over a communication network. The exemplary electronic device includes a redundancy manager disclosed in this invention, which is used to implement a receive processing stream for identifying path failures in the communication network.

[0015] Figure 3 This is a block diagram of an exemplary PRP frame that can be used to implement aspects of the present invention. The RCT includes a sequence counter and a port ID, such as for identifying a port as originating from a first port or a second port.

[0016] Figure 4 This is a flowchart illustrating the steps in a method for detecting and reporting path failures in a PRP-based communication network, according to an exemplary aspect.

[0017] Figure 5A A block diagram representation of a PCS capable of implementing PRP communication and thus utilizing aspects disclosed in this invention is shown. This exemplary PCS illustrates how a parallel network can be used in an industrial environment. Generally, any device with a processor, transceiver, and two ports can be used for PRP communication.

[0018] Figure 5B A block diagram of the PCS is shown, illustrating a double-fault disconnection of PRP connectivity between controllers (each disconnection is shown as X) and an example of the connection between the controller and the switch. FTE connectivity is maintained between these controllers because it crosses over to the FTE after a PRP path failure. Detailed Implementation

[0019] The aspects of the invention disclosed herein are described with reference to the accompanying drawings, wherein similar reference numerals are used throughout the drawings to denote similar or equivalent elements. The drawings are not drawn to scale and are provided only for illustrating certain disclosed aspects. Several disclosed aspects are described below with reference to exemplary applications for illustration. It should be understood that numerous specific details, relationships, and methods are set forth to provide a complete understanding of the disclosed aspects.

[0020] For the aspects of this invention disclosed in exemplary applications applied to a PCS, as used herein, the PCS operates industrial processes involving tangible materials to which the aspects disclosed herein apply. Examples include oil and natural gas, chemicals, beverages, pharmaceuticals, pulp and paper, petroleum processes, electricity including renewable energy sources, and water. Therefore, industrial process facilities are distinctly different from data processing systems that merely perform data manipulation.

[0021] Honeywell Fault-Tolerant Ethernet (IEC 62439-4 Coupled Redundancy Protocol) is an example of fault-tolerant Ethernet, representing one way to achieve robust multi-fault-tolerant communication networks, but its fault recovery time is often too long in some high-speed applications. Such high-speed applications include substation applications and, in the case of PCS, components such as synchronous drives, valves, and actuators. PRPs (which include the associated Ring-Based High Availability Seamless Protocol (HSR)) are all considered PRPs in this document, both being redundancy protocols defined under IEC-62439-3T. They use a common replicated frame structure but different topologies to provide protection against individual communication failures. These protocols can be implemented either in software or as hardware (HW) logic implementations within the device, such as as application-specific integrated circuits (ASICs) or field-programmable gate arrays (FPGAs). The advantages of using HW for protocol implementations include less processor load compared to software implementations, faster speeds in most cases, and, in the case of HW implementations, the HW logic can run in parallel with the software to further improve speed.

[0022] Typically, resource-constrained implementations of such protocol-specific hardware devices cannot offer many fault diagnosis methods. One such vendor discloses configuring devices to periodically enter a transparent mode, allowing their software to track every frame received from any device in the network. This can increase the load on unsupported central processing units (CPUs) during periods of high data traffic. The first method disclosed in this invention, which tracks the difference (count / number) between rejected copy frames and expected copy frames, is considered a low-overhead and early warning system for identifying individual PRP faults. This early fault alert / reporting to system operators can trigger maintenance to quickly resolve the fault.

[0023] To make the fault identification method disclosed in this invention practically feasible, all devices using HSR or PRP frame structures should generally have the same number of ports. As mentioned above, generally, there are 2 ports for PRP and exactly 2 ports for HSR. Two methods are described below, including diagnosis of fault detection and reporting for PRP, and additional fault detection and reporting when PRP is used with FTE.

[0024] Figure 1A Various aspects of PRP communication are illustrated, including two key features: the port ID, as described above, is located within the RCT of the frame included in the transmitted frame pair, and duplicate frame rejection is located on the receiving side. Both of these features can be used for PRP fault diagnosis as disclosed in this invention. Figure 1A As shown, all frames, along with their sequence numbers and port IDs, are sent and received on two electronic device ports, shown as port 1 and port 2. Both the sequence number and port ID are part of the RCT and are added to the first and second frames of each frame pair, where the first frame is subsequently transmitted from port 1 and the second frame from port 2. On the receiving side, duplicate frames are removed based on the sequence number and source address in the received frame. The PRP suffix is ​​also removed from the frame before it is provided to the application (or IP stack). Therefore, an application running on the electronic device can only see frames transmitted from one port, and thus only sees one copy of the received frame.

[0025] The replication rejection feature of the first method disclosed in this invention will now be described as a path fault diagnosis method disclosed in this invention. As described above, PRP provides redundant communication over a parallel network (independent paths), so each device has two ports that transmit the same frames at the same time. This parallelism means that there will be no communication interruption in the event of a single fault or a combination of faults. When using PRP on Ethernet, this specific implementation uses a dual-port and parallel Ethernet switch tree. While intelligent Ethernet switches can detect and report device disconnections (via Simple Network Management Protocol), PRP itself does not provide path fault detection until, as described above, a large number of faults exist, making it impossible for applications running on the devices to observe path fault problems.

[0026] The frame structures of HSR and PRP provide two features that are considered useful for path fault diagnosis in this paper. The use of a port ID in each frame allows the receiver to identify the port from which the frame was transmitted. For PRP, if a port (e.g., the first port of any network device used for communication on the first channel) receives a frame with the ID of another port (e.g., the second port of any network device used for communication on the second channel), this implies a connection of separate network paths (first channel and second channel), thus compromising the robustness of the HSR or PRP network. In the case of HSR, this results in incorrect ring port ordering (from outside to inside).

[0027] Regarding the duplicate frame rejection feature, each frame is emitted from the device from multiple ports, typically two ports. Figure 1A The first and second ports are shown in the diagram, and the same sequence number is provided in the frames transmitted from the corresponding ports. The rejection feature, which can operate on the receiving end, allows the PRP to be transparent to the application, preventing duplicate traffic from reaching the application and ensuring that the application only sees a copy of the received frame.

[0028] The aspects disclosed in this invention include a first method that utilizes the duplicate frame rejection provided by a conventional PRP to provide an early warning of a PRP path failure by adding a new count of uniquely received frames. For a normally functioning PRP, these corresponding counts should be equal to each other, so that no duplicates should be lost. Any discrepancies in these counts are considered a potential indication of a path failure, since in a real system, the possibility of random frame loss always exists. A warning can be issued in response to an increase in the number of lost duplicates, and normal operation resumes when the increase in the number of lost duplicates stops. The increase in the number of lost duplicates will stop when the path failure is repaired or the device causing the problem is shut down. A device in the process of shutdown or failure may cause one or two lost duplicates, so a small amount of filtering or hysteresis as described in the following paragraphs can help prevent false alarms.

[0029] For example, a low rate of lost replicas (such as one or two lost replicas per minute) can generally be ignored, as this may not be an indication of a port / path failure. When the rate of lost replicas decreases from a high rate to a low rate, this decrease can be used as an indication of recovery. To prevent unnecessary failure notifications, in one example, warnings associated with the detection of a path failure are not cleared until a predetermined amount of time (such as a full minute) has been maintained at a low rate of lost replicas.

[0030] Figure 1BAn exemplary PRP data stream is shown, comprising a transmit stream in the leftmost column and a receive stream in the rightmost column. Some text in the receive stream is shown underlined to highlight novel features related to the first method disclosed in this invention capable of identifying single-path failures. These novel features, shown underlined, include checking whether the sequence number is higher than the last sequence number received from the same source address after receiving a first frame via a first channel on a first port and a second frame via a second channel on a second port. If so, a counter sequence number is saved, and the count for unique frames is incremented. The RCT including the counter sequence number is removed from the frame, and the frame is passed up to the application (passed to the IP stack).

[0031] If the counter sequence number is not greater than the last counter sequence number from the same source address, the frame is identified as a duplicate frame, which is discarded. The count of duplicate frames is incremented. Then, the count of lost duplicates disclosed in this invention, relevant to the first method disclosed in this invention, is found by comparing the number of unique frames with the number of duplicate frames. An additional small overhead in implementing the first method disclosed in this invention is the small per-frame overhead in the new feature of counting lost duplicate frames, rather than simply ignoring them conventionally. Furthermore, this first method disclosed in this invention provides full compatibility with the PRP standard.

[0032] As described below, this disclosure also includes a second correlation method involving the detection of multiple path failures, which is described in detail below with respect to method 400. This second method involves a redundancy manager (see Redundancy Manager 209, which is shown as being used for the purposes described below). Figure 2 The intelligent electronic device 200 further implements state checks, wherein the network utilizes protocols other than PRP, such as fault-tolerant Ethernet protocols. Implementing this second method disclosed in this invention also incurs only minor additional overhead, and this second method primarily relates to implementing the state checks disclosed in this invention.

[0033] Figure 2 A block diagram of a smart electronic device 200 used in a system employing a PRP standard that can be used with aspects disclosed in this invention is shown. In one embodiment, at least one smart electronic device in the smart electronic device 200 is included in a PCS. The smart electronic device 200 includes a first port 217 and a second port 218, wherein the smart electronic device 200 is configured to communicate with a remote monitoring control and data acquisition (SCADA) system or a distributed control system (DCS) that interacts with the PCS. Packet data transmitted from the smart electronic device 200 to the SCADA or DCS includes data measured, processed, and / or received by the smart electronic device 200.

[0034] Generally, a smart electronic device 200 includes processing circuitry 202, which may include digital and / or analog circuitry such as one or more controllers, processors, or ASICs (Application-Specific Integrated Circuits) for executing program code to implement the functions of the electronic device (including the PRP-related functions described herein). For this purpose, processing circuitry 202 includes or is associated with: a PRP processor 204 for constructing PRP frames and implementing PRP-related functions; and a protocol stack 206 for implementing different layers of packet-based communication at the smart electronic device 200. Therefore, Figure 2 The boxes used for PRP handler 204 and protocol stack 206 are shown as dashed boxes (rectangles).

[0035] In one scenario, protocol stack 206 may implement Hypertext Transfer Protocol (HTTP) at the application layer, Transmission Control Protocol (TCP) at the transport layer, IP (Internet Protocol) at the Internet / network layer, Ethernet at the data link / link layer, and the IEEE 802.3u (wired) or IEEE 802.11 (wireless) standard at the physical layer. These protocol layer examples are considered non-limiting and merely illustrate the types of communication protocols that can be implemented by protocol stack 206.

[0036] The intelligent electronic device 200 further includes: volatile and / or non-volatile memory 208, such as dynamic random access memory (DRAM) or flash memory; and persistent storage device 210, shown as a storage device such as a hard disk drive (HDD) and / or optical drive, for storing relevant data processed and accessed by the processing circuitry 202 during program code execution. The redundancy manager 209 disclosed herein is shown as being implemented by the processing circuitry 202, which interacts with the code in the memory 208. The redundancy manager 209 implements the receive processing stream disclosed herein for identifying at least one path failure in a communication network, and may also implement state checks for the second method disclosed herein involving the detection of multiple path failures. The intelligent electronic device 200 also has transmit and receive (TX / RX) circuitry 212, which is used to transmit data packets constructed by the PRP processor 204 in conjunction with the protocol stack 206, and to receive data packets for processing by the PRP processor 204 and the protocol stack 206.

[0037] Figure 3This is a block diagram of an exemplary PRP frame 300 that can be used to implement aspects of the present invention. The PRP frame 300 includes a preamble 301, a destination address 302, a source address 303, a logical link control (LLC) 304, and a payload 305. The PRP frame 300 also includes an RCT 312, followed by a Frame Check Sequence (FCS) 310. The RCT 312 includes a sequence counter 306, a port ID 307, a size 308, and a PRP suffix 309. As described above, the port ID 307 is used to identify the port from which the frame was transmitted (e.g., from a first port or from a second port).

[0038] Regarding the use of FTE status for additional PRP fault determination, when a system loses network communication from one node to one or more other nodes, it is desirable to take the measures most likely to restore communication and / or normal system operation. In the case of redundant equipment, switching primary operation to a backup device with a full view (full view means one device can see other devices on the network while another cannot, with the better device assuming the primary role) is considered the best solution for network communication loss. In addition to control functions, in the case of multiple process controllers configured to implement orchestration functions, the recovery of orchestrator functionality with one master device and multiple monitor controllers should also be handled.

[0039] In this configuration, the PRP system is built on fault-tolerant Ethernet (such as Honeywell International's Fault-Tolerant Ethernet (FTE)), which, in a specific example, might have a two-second single-failure recovery time. Fault-tolerant Ethernet (such as FTE) can also maintain communication in certain scenarios with multiple failures. Because of the cross-connection used between the two networks, FTE provides four possible paths between any two nodes A and B: A->A, B->B, A->B, and B->A. Each FTE node typically maintains a table showing the status of each of the four paths to every other FTE node. For example, if the primary device loses all communication, Honeywell International's EXPERION redundancy will result in a switchover to the backup device. If redundancy determines that a switchover will not restore connectivity, no switchover will occur.

[0040] At the top of the tree path between two FTE parallel switches, but without using cross-connect capabilities, the PRP is single-fault tolerant and therefore does not require fault recovery. When communication loss does occur (usually determined by timeout), the node can use its local FTE path information to determine its course of action. If the FTE reports at least one valid path to the node, the problem is limited to the PRP. This PRP failure condition typically issues a warning.

[0041] Regarding redundancy in process controller scenarios, Honeywell International's orchestrator on a highly integrated virtual environment (HIVE) controller presents a different case than traditional process controller redundancy. This is because the HIVE controller itself is not redundant; rather, the multiple HIVE control applications deployed on it are redundant. When a controller switchover is required, the HIVE control applications are configured to switch to the backup independently and separately.

[0042] All HIVE controllers have an orchestrator function; one orchestrator instance is the master controller, and the other controllers are monitor controllers. When a monitor does not "see" its master controller, it will attempt to assume the master controller role. Among the communicable orchestrators, the monitor controller with the lowest hardware index value may become the master controller. When an orchestrator cannot see all other orchestrators, the result may be multiple master controllers. This is a situation that should generally be avoided or minimized and should be warned about. PRP path errors and abnormal orchestrator conditions should be notified to system operators so that maintenance personnel can restore normal communication. Sending warnings and notifications via FTE usually has a higher chance of success.

[0043] As described above, PRP transmits identical frames, where the communication unit (of the electronic device) can be configured for wireless or cable connections on multiple ports. Each port resides on its own channel and has an additional sequence counter number. Before transmitting each frame, the sequence counter number is incremented such that the source address added to the sequence counter number provides a unique pair. As mentioned above, the source address is unique, therefore, when combined with the source address, the sequence number maintained in each device is unique. All receiver nodes use the sequence number they received from the received frames to remove duplicate frames before passing the stack to their application.

[0044] Figure 4 This is a flowchart illustrating steps in a method 400 for detecting and reporting path failure problems in a PRP-based communication network according to an exemplary aspect. Step 401 includes providing a first device and a second device, each having a processor, a memory configured to support PRP communication, and implementing a redundancy manager for implementing a receive processing stream for identifying path failures in the communication network. The plurality of electronic devices each include a first port and at least a second port, a transmitter, and a receiver. The communication network includes a first channel used by the first port and a second channel used by the second port.

[0045] Step 402 includes a first device transmitting: a frame pair, comprising a first frame transmitted via a first channel and a second frame transmitted via a second channel, both the first and second frames including a destination address, a source address, and a payload; and an RCT, the RCT including a sequence counter incremented after the frame pair is transmitted. Step 403 includes a second device receiving the frame pair via the first and second channels and implementing a receive processing stream, which includes steps 404 and 405 described below. Step 404 includes deleting redundant frames when either the first or second frame is identified as a redundant frame. Step 405 includes comparing the parameters of the first frame with parameters of the second frame that are different from the parameters of the first frame.

[0046] The first method disclosed in this invention is used to identify individual path failures in networks such as PRP networks. In this first method, after removing redundant frames (step 404), only one of a first frame and a second frame is added to generate a unique frame count. In this first method disclosed in this invention, the first frame parameter includes the unique frame count, and the second frame parameter includes the count of redundant frames to determine whether there is a count discrepancy.

[0047] Therefore, the received unique frame count and redundant frame count (equal to the deleted duplicates) form the basis of the path fault diagnosis disclosed in this first method. For a normally operating communication system, any discrepancy between these corresponding counts is an indication of a path fault problem. This discrepancy will continue to increase as long as the path fault problem persists.

[0048] In the second method for identifying multiple path failures disclosed in this invention, the redundancy manager further utilizes a protocol other than PRP (a non-PRP protocol, such as a fault-tolerant Ethernet protocol) to perform state checks. This second method includes a first device transmitting a pair of frames as port status frames, the pair including a first frame as a first port status frame and a second frame as a second port status frame. The first port status frame includes a state check of the first port via a first channel, and the second port status frame includes a state check of the second port via a second channel. The first and second ports are allowed to cross between the first and second channels without being rejected by the receiver's implemented reception logic. The second device receiving (step 403) includes receiving a first copy of the port status frame pair via the first channel and a second copy of the port status frame pair via the second channel, and realizing a port status availability matrix from the first and second copies of the port status frame pair.

[0049] The port status availability matrix includes a first port status frame, which is a first frame parameter received via a first channel and a first port status frame received via a second channel, indicating the path availability from the first channel on the first device to the first and second channels on the second device. A second port status frame, which is a second frame parameter received via the first channel and a second port status frame received via the second channel, indicates the path availability from the second channel on the first device to the first and second channels on the second device. In this second method disclosed in the present invention, the comparison (step 405) includes comparing the received first port status frame (as a first parameter) with the received second port status frame (as a second parameter) to determine if there is a difference, thereby identifying when multiple path failures exist.

[0050] Method 400 may further include sending an alarm message to the operator and maintenance logs in response to a path failure, enabling corrective action to be taken. Since device entry or exit from the communication network can cause inconsistencies, some filtering may be used to prevent false alarms. Although filtering is not necessary, it is often helpful because there is always the possibility of frame loss due to transient traffic overload. Once the count difference stops increasing, the communication network can return to normal after issuing a warning and taking possible corrective actions.

[0051] The RCT may further include port identifiers and channel indicators, including a first port identifier and a first channel indicator for the first frame and a second port identifier and a second channel indicator for the second frame. In this arrangement, the identification of redundant frames may include comparing the source address and the sequence counter number to determine that the source address and the sequence counter number are the same for both the first and second frames.

[0052] The communication network can be located in the PCS (see PCS 500 and PCS 500 described below). Figure 5A Within the PCS, the PCS includes at least one operator workstation and at least one process controller coupled to at least one I / O module, wherein the I / O module is coupled to at least one field device, which in turn is coupled to at least one processing unit. The PRP may include the HSR protocol, and in this arrangement, multiple electronic devices are arranged in a ring within a communication network.

[0053] The first method may further include using a predetermined measurement period of the time taken to identify when a path failure exists, once the count difference is determined to increase over time. In communication networks, PRP can be used in conjunction with fault-tolerant Ethernet protocols.

[0054] Figure 5AA block diagram representation of a PCS 500 enabling PRP communication is shown. The PCS is shown to include: operator interfaces 520a and 520b coupled to controllers 512a and 512b (optionally also shown with I / O) and an industrial protocol gateway 514 via Ethernet switches 515a and 515b. Controllers 512a and 512b are shown with I / O coupled to a sensor and actuator 506a, which is coupled to a processing unit 501a. The industrial protocol gateway 514 is shown coupled to field devices 509b1, 509b2, and 509b3 with I / O, which are coupled to the processing unit 501b via the sensor and actuator 506b. This exemplary PCS 500 illustrates how parallel networking can be used in an industrial environment. Generally, any type of device with a processor, transceiver, and two ports (also referred to as interfaces) can be used for PRP communication.

[0055] Figure 5B A block diagram of the PCS 550 is shown, illustrating an example of dual-fault disconnect (shown as X) PRP connectivity between controllers and the connection between the controllers and a switch shown to enable cross-connection to the FTE after a PRP path failure, thus maintaining FTE connectivity between these controllers. The PCS 550 is shown to include an operator interface 575a coupled to FTE Ethernet switches A 565a and B 565b. An FTE crossover cable 566 is shown connecting the top-level FTE Ethernet switch A 565a to the top-level FTE Ethernet switch B 565b. The top-level FTE Ethernet switch A 565a is connected to level 2 FTE switches A1 570a1 and A2 570a2. The top-level FTE Ethernet switch B 565b is connected to level 2 FTE switches B1 570b1 and B2 570b2. PCS 550 is also shown as including four process controllers, which are shown as controller 1 562a1, controller 2 562a2, controller 3 562b1 and controller 4 562b2.

[0056] Controller 1 562a1 is shown coupled to Level 2 FTE switch 570a1 and Level 2 FTE switch B1 570b1. Controller 2 562a2 is shown coupled to Level 2 FTE switch 570a2 (but its connection is faulty) and Level 2 FTE switch B1 570b1. Controller 3 562b1 is shown coupled to Level 2 FTE switch 570a2 and Level 2 FTE switch B1 570b1 (but its connection is faulty). Controller 4 562b2 is shown coupled to Level 2 FTE switch A2 570a2 and Level 2 FTE switch B2 570b2.

[0057] When a PCS, such as the PCS 550 (e.g., the EXPERION PKS R520 for Honeywell International), is used to implement HIVE control, a PRP can be added to the FTE to make time-critical communication more robust to failures than a traditional FTE. For example, specific Honeywell International products may include process controllers (including the C300, UOC, CN100, and operator workstations) with process controller software that typically runs on a virtual machine host.

[0058] Example

[0059] The disclosed aspects are further illustrated by the following specific examples, which should not be construed as limiting the scope or content of this disclosure in any way.

[0060] In an exemplary application scenario of a PCS, multiple Honeywell C300H process controllers are connected to the same Honeywell International FTE switch, and a dual failure scenario exists: the first cable on C300H-1 (assumed to be the master orchestrator in the network) is disconnected, and the second cable on another controller, C300H-2 (a monitor controller), is disconnected. A problem arises in this situation because there is now no PRP path between the orchestrators deployed on C300H-1 and C300H-2, allowing C300H-2 to decide to take over as the master orchestrator based on its hardware device index. The result is often multiple master orchestrators in the PCS.

[0061] When the HIVE controller (not the master controller) is unreachable from the master controller, one solution is for the HIVE controller to check the node availability of the FTE based on the last known master device index and multiple slave device indices. If the master controller becomes inoperable and not visible via PRP, a slave controller can be promoted, for example, by promoting the lowest device index, and the FTE index can be switched to the master orchestrator, allowing the FTE to return a 4-path status result for paths A->A, A->B, B->A, and B->B. If any of these four communication paths are operational, the C300H-2 should generally report a separate status warning (isolated, master controller unreachable) and take appropriate action (or no action). Regarding action, the orchestrator on the affected node can command the master HIVE control application (HCA). This is software running on the process controller that generally needs access to I / O modules to switch to backup or shut them down so that backup can take over.

[0062] The following describes an example of a path failure for a PCS based on a generic PRP. A dual failure scenario exists in systems that simultaneously support PRP and FTE devices, as well as in devices that simultaneously support both PRP and FTE, where neither device has connectivity via PRP but may still have connectivity via FTE. The PCS corresponding to this example is shown above. Figure 5B In this scenario, the first port of controller 2 562a2 is disconnected from the Level 2 FTE switch A2570a2, and the second port of controller 3 562b1 is disconnected from the Level 2 Ethernet switch 570b1. If controllers 2 562a1 and 3 562b1 have the lowest device hardware (HW) device index, they can then agree on which controller assumes the master role. They typically assume the master controller role when these controllers cannot communicate. Other controllers in the PCS550 will then see two master controllers, but they typically cannot resolve this situation. Controllers 2 562a2 and 3 562b1 can still use the FTE to detect if other devices are operating, report / warn of dual-master status, and report / warn of connection drops. Other controllers can also report / warn of the existence of a dual-master situation.

[0063] Although various disclosed aspects have been described above, it should be understood that they are presented by way of example only and not as limitations. Many changes may be made to the subject matter disclosed herein without departing from the spirit or scope of this disclosure. For example, although aspects of the invention disclosed are generally described as applicable to PCS, they may also be applied to other systems. Furthermore, while a particular feature may be disclosed only with respect to one of several implementations, such feature may be combined with one or more other features of other implementations, as may be desired or advantageous for any given or particular application.

Claims

1. A method (400) for detecting problems in a communication network utilizing a Parallel Redundancy Protocol (PRP), wherein the communication network includes a first channel and a second channel and a plurality of electronic devices, the plurality of electronic devices including a first device and at least a second device, the method comprising: Provided are a first device and a second device, each having a processor and a memory, the memory being configured to support the PRP and implementing a redundancy manager, the redundancy manager being used to implement a receive processing stream, the receive processing stream being used to identify path failures in the communication network, and each of the plurality of electronic devices including a first port and at least a second port, a transmitter and a receiver; The first device transmits a frame pair, the frame pair including a first frame transmitted from the first port via the first channel and a second frame transmitted from the second port via the second channel. Both the first and second frames include a destination address, a source address, a payload, and a redundancy control tail. The redundancy control tail includes a sequence counter that increments after the frame pair is transmitted. The second device receives the frame pair via the first and second channels and implements the receive processing stream, including: When either the first frame or the second frame is identified as a redundant frame, the redundant frame is deleted. The parameters of the first frame are compared with those of the second frame, which are different from the parameters of the first frame, to identify when the path failure occurs. After deleting the redundant frames, only one of the first frame and the second frame is added to generate a unique frame count, wherein the first frame parameter includes the unique frame count, and the second frame parameter includes the count of the redundant frames, to determine whether there is a count discrepancy. When a path failure is detected, an alert message is sent to the operator and maintenance logs. The redundancy manager (209) utilizes a protocol other than the PRP to perform status checks for identifying multiple path failures, and the method further includes: The first device transmits the frame pair as a port status frame pair, the port status frame pair including the first frame as a first port (217) status frame and including the second frame as a second port (218) status frame, the first port status frame including the status check of the first port through the first channel, the second port status frame including the status check of the second port through the second channel, and wherein the first port and the second port are allowed to cross between the first channel and the second channel without being rejected by the receive logic implemented by the receiver; The second device receives a first copy of the port status frame pair via the first channel and a second copy of the port status frame pair via the second channel, and implements a port status availability matrix from the first copy and the second copy of the port status frame pair. The first port status frame indicates the path availability from the first channel on the first device to the first channel and the second channel on the second device, using the first frame parameters received through the first channel and the first port status frame received through the second channel. The second port status frame is the second frame parameter received through the first channel, and the second port status frame received through the second channel indicates the path availability from the second channel on the first device to the first channel and the second channel on the second device. The comparison includes comparing the received first port status frame with the received second port status frame to determine whether there is a difference, thereby identifying when the multiple path failures exist.

2. The method (400) of claim 1, wherein the comparison comprises comparing the source address and the sequence counter in the first frame and the second frame to determine that the number of the source address and the number of the sequence counter are the same.

3. The method (400) according to claim 1, wherein the communication network is located within a process control system (PCS) (500), the process control system (PCS) (500) including at least one operator workstation, at least one process controller (562a1, 562a2, 562b1, 562b2) coupled to at least one input / output I / O module (512a, 512b), the I / O module being coupled to at least one field device (509b1, 509b2, 509b3), the at least one field device (509b1, 509b2, 509b3) being coupled to at least one processing unit (501a, 501b).

4. An electronic device (200) within a communication network utilizing a Parallel Redundancy Protocol (PRP), wherein the communication network includes a first channel and a second channel, and wherein at least one other electronic device is present in the communication network, each of the electronic devices comprising: The first port (217) and at least the second port (218); The processing circuit (202) includes or is associated with the following: a PRP processing program (204) for constructing PRP frames and implementing PRP-related functions; Protocol stack (206), the protocol stack (206) is used to implement different layers of packet-based communication; A memory (208) and a permanent storage device (210), each accessible by the processing circuitry, and A transmit and receive TX / RX circuit (212), the TX / RX circuit being configured to transmit data packets constructed by the PRP processor in conjunction with the protocol stack, and to receive the data packets for processing by the PRP processor and the protocol stack. A redundancy manager (209), implemented in the memory, is used to implement a receive processing stream for identifying path faults in the communication network. The processing circuit is configured to implement a method for detecting problems in the communication network, the method comprising: The other electronic devices transmit frame pairs, each frame pair including a first frame transmitted from the first port via the first channel and a second frame transmitted from the second port via the second channel. Both the first and second frames include a destination address, a source address, a payload, and a redundancy control tail. The redundancy control tail includes an incrementing sequence counter following the transmission of the frame pair. The electronic device receives the frame pairs through the first channel and the second channel and implements the receiving processing stream, including: When either the first frame or the second frame is identified as a redundant frame, the redundant frame is deleted. A first frame parameter is compared with a second frame parameter that is different from the first frame parameter to determine when the path failure exists, wherein after the redundant frame is deleted, only one of the first frame and the second frame is added to generate a unique frame count, wherein the first frame parameter includes the unique frame count and the second frame parameter includes the count of redundant frames, to determine whether there is a count discrepancy. When a path failure is detected, an alarm message is sent to the operator and maintenance logs, wherein the redundancy manager (209) further utilizes a protocol other than the PRP to perform status checks for identifying multiple path failures, wherein the method further includes: The first device transmits the frame pair as a port status frame pair, the port status frame pair including the first frame as a first port (217) status frame and including the second frame as a second port (218) status frame, the first port status frame including the status check of the first port through the first channel, the second port status frame including the status check of the second port through the second channel, and wherein the first port and the second port are allowed to cross between the first channel and the second channel without being rejected by the receive logic implemented by the receiver; The second device receives a first copy of the port status frame pair received through the first channel and a second copy of the port status frame pair received through the second channel, and implements a port status availability matrix from the first copy and the second copy of the port status frame pair, including: The first port status frame indicates the path availability from the first channel on the first device to the first channel and the second channel on the second device, using the first frame parameters received through the first channel and the first port status frame received through the second channel. The second port status frame is the second frame parameter received through the first channel, and the second port status frame received through the second channel indicates the path availability from the second channel on the first device to the first channel and the second channel on the second device. The comparison includes comparing the received first port status frame with the received second port status frame to determine if there is a difference, thereby identifying when the multiple path failures occur.

5. The electronic device (200) according to claim 4, wherein the communication network is located within a process control system PCS (500), the process control system PCS (500) comprising at least one operator workstation, at least one process controller (562a1, 562a2, 562b1, 562b2) coupled to at least one input / output I / O module (512a, 512b), the I / O module being coupled to at least one field device (509b1, 509b2, 509b3), the at least one field device (509b1, 509b2, 509b3) being coupled to at least one processing unit (501a, 501b).

6. The electronic device (200) according to claim 5, wherein in the communication network, the PRP is used in conjunction with a fault-tolerant Ethernet protocol.

Images