Multiple network redundancy protocols for data streams using the same physical interface

Abstract

The present invention discloses a process control system (PCS), which includes a cable connection, which includes a physical cable, which includes: a first cable, which is used to connect between a process controller and an I / O access device; and an independent second cable, which is used to connect the process controller and a second node that is an I / O access device or another device. The I / O access device is used to couple to an I / O module to receive the output of the I / O access device. The output of the I / O module is coupled to a field device, which is coupled to a processing device. The process controller and the I / O access device each include a processor and a memory, and the processor and the memory implement sending and receiving logic for communicating using any of a plurality of redundant protocols including a first redundant protocol and a second redundant protocol. The cable connection is used to support simultaneous communication between the process controller and the second node using both the first redundant protocol and the second redundant protocol.

Description

Technical Field

[0001] The disclosed aspects relate to wiring arrangements in a network that implement multiple redundant protocols for a process control system (PCS). Background Art

[0002] Industrial control systems (ICS), also known as process control systems (PCS), adopted IEEE 802.3 Ethernet in the mid to late 90s to achieve increased bandwidth, full-duplex capabilities, and improved connectivity to pass more data, increase productivity, and help reduce costs. The adoption of these standards further allowed systems to evolve and become more distributed. While PCS is using more and more Ethernet-based networked data flows, the same or better level of fault tolerance is expected compared to smaller and closed proprietary coax-based network deployments. The recent trend of critical data flows in PCS (controller to input / output (I / O) communications) has moved to Ethernet networks, where I / O modules are now accessed from anywhere within the PCS. Summary of the invention

[0003] This Summary is provided to introduce a brief selection of disclosed concepts in a simplified form, which are further described below in the Detailed Description including the provided figures. This Summary is not intended to limit the scope of the claimed subject matter.

[0004] The disclosed aspects recognize the problem of process controller to I / O module communication, because its criticality and application in PCS deployment impose strict requirements for rapid recovery once a fault condition is sensed. Therefore, nodes participating in controller-I / O module communication provide multiple connection interfaces, and suppliers of associated control system equipment use multiple fabric connection interfaces and fabric connection modes to meet these strict fault tolerance requirements. Conventional PCS implementations in the art for this purpose use separate physical networks for I / O module deployment and direct access to IO modules from process controllers, where the process controllers each have dedicated IO modules.

[0005] For the disclosed aspects, the access of the process controller to the I / O module is indirect access through a device referred to herein as an "I / O access device", such as an I / O access device including a gateway device or an interface module, so that the disclosed communication between the process controller and the I / O module passes through the I / O access device. As used herein, an I / O access device is any network equipment device type or system type that allows communication access between the I / O module and the process controller. Network availability and fault tolerance protocols, such as tree / star networks such as the Parallel Redundancy Protocol (PRP), and ring networks such as High Availability Seamless Redundancy (HSR) or Media Redundancy Protocol (MRP), are applied to these separate physical networks that are used to access I / O modules to provide faster fault recovery.

[0006] For non-controller-I / O related communications in the PCS, since such communications typically do not require fast fault recovery, such communications may use nodes with single interface connectivity that have high levels of bandwidth requirements (backup and archiving), or may have requirements for high network availability with relatively less stringent fault condition recovery requirements (e.g., process views, warnings, and events). These requirements are typically met by using multiple paths (or channels) with fault-tolerant schemes, including network interface card (NIC) teaming, fault-tolerant Ethernet (FTE), or device-level ring networks (DLR). Network redundancy protocols such as FTE provide four paths for dual-connected interface (or port) nodes, and two paths for single-connected interface nodes, with only one path being used at any given time. For ring networks, network redundancy protocols such as DLR provide high network availability for less stringent fault condition recovery requirements (e.g., configuration, firmware updates).

[0007] When the PCS deploys such connection nodes to meet different bandwidths and fault-tolerant recovery rates of data flows using separate network segments, the disclosed aspects recognize the problems of complexity and increased costs introduced in several areas including configuration, asset management, security, and time distribution. The disclosed aspects provide a solution to address the complexity introduced for multiple PCS functions (e.g., configuration, security, time distribution, and asset management) by using more than one network redundancy protocol on two separate (independent) physical cables. The implementation of two or more redundancy protocols can each utilize two cables together, where the first redundancy protocol is a fault-tolerant Ethernet protocol, which means a network that will not fail due to a single component / cable failure, such as FTE, and the second redundancy protocol is a PRP that each utilizes the same two physical cables. The first redundancy protocol and the second redundancy protocol both have different fault recovery rate capabilities.

[0008] One disclosed aspect includes a PCS that includes a cabling connection that includes a physical cable that includes a first cable for connecting between a process controller and an I / O access device; and an independent second cable that is used to connect the process controller and a second node that is an I / O access device or another device. The I / O access device is used to couple to an I / O module to receive an output of the I / O access device. The output of the I / O module is coupled to a field device (e.g., a sensor and an actuator), which is coupled to a processing device. The process controller and the I / O access device each include a processor and a memory that implements send and receive logic (e.g., using code or hardware logic, such as a field programmable gate array (FPGA)) for communicating using any of a plurality of redundant protocols including a first and a second redundant protocol. The send and receive logic is used to configure the cabling connection to support simultaneous communication between the process controller and the second node using the first redundant protocol and the second redundant protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1A A PCS is depicted according to an exemplary aspect including a communication network that includes the disclosed switched cable connection configured for use in a non-ring network that provides multiple network redundancy protocols for data flows shown between multiple nodes on the same physical interface, the multiple nodes being shown as a first process controller, an I / O access device, and a second process controller.

[0010] Figure 1B Depicted is a disclosed cable connection according to an exemplary aspect, the cable connection being configured for use in a ring network that provides multiple network redundancy protocols for data flows shown between multiple nodes, shown as a first process controller and I / O access devices, over the same physical interface.

[0011] Figure 1C Depicted is a disclosed cable connection according to an exemplary aspect, the cable connection being configured for use in another ring network that provides multiple network redundancy protocols for data flows shown between multiple nodes, shown as first and second process controllers and three I / O access devices, on the same physical interface.

[0012] Figure 2 Packet processing (routing) for critical traffic in a non-ring network according to exemplary aspects is depicted.

[0013] Figure 3 Depicted is packet processing (reception) for critical traffic in a non-ring network according to an exemplary aspect.

[0014] Figure 4 Depicted is packet processing (transmission) for normal (non-critical) traffic in a non-ring network according to exemplary aspects.

[0015] Figure 5 Depicts packet processing (reception) for normal (non-critical) traffic in a non-ring network. DETAILED DESCRIPTION

[0016] The disclosed aspects of the present invention are described with reference to the accompanying drawings, wherein similar reference numerals are used to refer to similar or equivalent elements in all drawings. The accompanying drawings are not drawn to scale, and they are provided only to illustrate certain disclosed aspects. Several disclosed aspects are described below with reference to exemplary applications for illustration. It should be understood that many specific details, relationships, and methods are set forth to provide a complete understanding of the disclosed aspects.

[0017] As used herein, a PCS operates industrial processes involving tangible materials to which the disclosed aspects are applicable. For example, oil and gas, chemicals, beverages, pharmaceuticals, pulp and paper, petroleum processing, electricity including renewable energy, and water. Thus, a PCS is distinct from a data processing system that performs only data manipulation.

[0018] Figure 1A A PCS 100 is depicted that includes a communication network that includes a disclosed switched cable connection 105 that includes multiple switches 105a coupled to multiple physical cables 105b, wherein the switched cable connection 105 is configured for use in a non-ring network that provides multiple network redundancy protocols for data flows shown between multiple nodes (also referred to as network devices) on the same physical interface (cable). The multiple nodes are shown as a first controller 131 and a second node and another (third) node, the second node is shown as an I / O access device 132, which can also be another device type such as another controller, the other (third) node is shown by way of example as a second controller 133. The I / O access device 132 may include an interface module or a gateway device. As used herein, a gateway or interface module is networking hardware for allowing data to flow from one discrete network to another discrete network. The I / O access device 132 is connected to at least one I / O module 140 , which is connected to a plurality of field devices 145 that are connected to provide control and sensing of multiple instances of processing equipment 150 .

[0019] I / O access device 132 is in the process controller (in Figure 1AThe positioning between the first process controller 131 and the second process controller 133 (shown in FIG. 1 ) and the I / O module 140 is in contrast to the arrangement in a conventional PCS, in which the process controller is directly coupled to the I / O module, such as through a dedicated cable connection. The I / O module 140 typically includes multiple channels for communication, such as having 2 channels to 32 channels. The I / O module 140 is coupled to a field device 145. The field device 145 typically includes sensors, actuators, and valves, which are coupled to the process equipment 150. The process equipment 150 may include various equipment, including, for example, a burner, a heating furnace, or a mixer.

[0020] A plurality of switches 105b are shown including switches shown as 105a1 and 105a2, such as including CISCO switches, and physical cables 105b are provided at Figure 1A 105a. The Ethernet cable pairs are shown as Ethernet cable pairs (two cables per cable pair), which include a first cable pair 105b1 / 105b2, a second cable pair 105b3 / 105b4, a third cable pair 105b5 / b6, and a fourth cable pair 105b7 / b8. The first ends of the first cable pair, the second cable pair, the third cable pair, and the fourth cable pair are respectively connected to the first controller 131, the I / O access device 132, the second controller 133, and the operator station 160. The second ends of the first cable pair 105b1 / 105b2, the second cable pair 105b3 / 105b4, the third cable pair 105b5 / b6, and the fourth cable pair 105b7 / b8 are connected to a plurality of switches 105a.

[0021] The first controller 131, the I / O access device 132, the second controller 133, and the plurality of switches at 105a each implement two VLANs, which are shown as separate virtual local area networks (VLANs), which are shown as VLAN 20 (for critical communications) and VLAN 101 (for so-called normal communications), for simultaneous communications to occur in the communications network. The operator station 160 implements one VLAN, which is shown as a separate virtual local area network (VLAN), which is shown as VLAN 101 (for so-called normal communications).

[0022] VLAN is defined herein as any broadcast domain that is segmented and isolated in a computer network at the data link layer (Open Systems Interconnection (OSI) layer 2). The disclosed cable connections are such as Figure 1A The illustrated switched cabling 105 provides for cable sharing between multiple nodes, rather than having conventional dedicated cables between nodes in a PCS.

[0023] The disclosed aspects facilitate implementation of certain value-added features because the separation of networks as described above can be implemented in software or using hardware logic devices, such as through FPGAs or application specific integrated circuits (ASICs) instead of hardware - physical cables. Figure 1A The security lock 118 shown in the plurality of switches 105a in the embodiment indicates a link, and the communication on the link is protected by using authentication and data encryption. The security lock feature is disclosed in U.S. Patent No. 9,438,628 assigned to Honeywell International, as applied herein. Each of the nodes including the first controller 131, the I / O access device 132 and the second controller 133 is provided with Figure 1A The certificate symbol 119 shown indicates that the node has a manufacturer's certificate to be able to prove its authenticity. This feature is disclosed in U.S. Patent No. 10,587,421, also assigned to Honeywell International. Although Figure 1A Described as including a first process controller 131, an I / O access device 132, and a second process controller 133, but each of the network nodes may more generally each include a process controller or an I / O access device.

[0024] The separate VLANs 20 and 101 implemented by the switched cable connection 105 are used to separate data communications for different data flows. The plurality of switches 105a may be based on IEEE Standard 802.3. Although Figure 1A , but three or more VLANs may optionally exist on the same two cables. The corresponding VLANs are shown as VLAN 20 for critical communications that are considered to require rapid recovery under failure to operate normally, and VLAN 101 for normal communications that can use relatively high bandwidth levels to operate normally because the communications can tolerate slower recovery in the event of a failure.

[0025] Critical communications in the PCS may include communications for operating substations, synchronous drives, valves, and actuators. Normal communications may include communications related to ensuring normal plant operations, including monitoring PCS health, process controllers, alarms, and events.

[0026] The first VLAN and the second VLAN are implemented in each cable pair 105b1 / b2, 105b3 / b4, and 105b5 / b6 by utilizing FTE and / or PRP as the underlying exemplary network redundancy protocol, each cable pair including two independent physical cables. It is known that FTE is a topology with two parallel tree hierarchies of switches, which are connected at the top by a crossover cable to form a fault-tolerant network. In the case of FTE, although there are redundant paths, only one path is used for any given packet at any given time. PRP follows the method of using two independent parallel tree hierarchies of switches, which are not connected to each other to form a fault-tolerant network, where PRP is an example of a second redundancy mechanism. PRP uses two paths at the same time. The LAN in this VLAN context virtualization refers to a physical object that is recreated and changed by additional logic. The disclosed separation of data flows across different VLANs enables the use of multiple network-level redundancy capabilities (FTE and PRP) to achieve the benefits described in Table 1 described below.

[0027] exist Figure 1A In FIG. 1 , two VLANs (shown as VLAN 20 and VLAN 101) generally carry data traffic in the form of data packets, but with different criticalities. Compared to VLAN 101, VLAN 20 provides substantially immediate recovery in the event of a failure, where Figure 1A In the example, VLAN 20 is used to carry critical communication traffic using PRP, where Figure 1A VLAN 101 is shown as providing a relatively lower criticality or higher level of bandwidth for carrying normal communication traffic using FTE VLANs.

[0028] exist Figure 1A Each node shown as a first controller 131, an I / O access device 132, and a second controller 133 has a processor 106 that provides the functionality of a processing controller, such as a central processing unit (CPU), a microcontroller, or other processing device, and a user configuration stored in a memory 107 associated with the processor 106. The first controller 131, the second controller 133, and the I / O access device 132 each implement a transmission and reception logic for communicating using any of a plurality of redundant protocols. The transmission and reception logic may be implemented by code stored in the memory 107 or by the processor 106 comprising a hardware logic device.

[0029] The programming in one arrangement may be logic provided by Honeywell International for the nodes, including the first controller 131, the I / O access device 132, and the second controller 133. In the case where FTE is a redundant protocol in a redundant protocol, where FTE as a redundant protocol is a communication language, and the FTE device index is an identification of a node that is allowed to talk in the FTE communication language, the programming includes the FTE device index which may have a validity range of 1 to 999 in one arrangement. Again, the VLAN IDs shown herein are used only as examples and in Figure 1A VLAN 20 and VLAN 101. The valid range for programming the tag representation (sometimes referred to herein as the VLAN ID) can be 1 to 4095 in one arrangement of a 12-bit representation along with the VLAN policy.

[0030] The plurality of switches 105a may include high-speed switches, such as each including a Cisco switch. The plurality of switches 105a are generally not controlled by any device or system. However, instead, each is independently configured once to pass packets / data from one node to another.

[0031] Figure 1B Depicted is a disclosed cable connection 150 according to an exemplary aspect configured in a ring network having a portion shown that provides multiple network redundancy protocols on the same physical interface for data flows shown between multiple nodes, shown as a first process controller 131 and an I / O access device 132. There are two instances of a single Ethernet physical cable shown as 155b1 and 155b2 between the first process controller 131 and the I / O access device 132, wherein the cable connection 150 is shown to support two different protocols, shown as VLAN 20 (HSR VLAN) using HSR and VLAN 101 (DLR VLAN) using DLR. The ring network as described above may more generally implement two protocols selected from HSR, DLR, and MRP.

[0032] Figure 1C Depicted is a disclosed cabling connection 170 configured in a ring network according to an exemplary aspect that provides multiple network redundancy protocols for data flows shown between multiple nodes on the same physical interface (cable), the multiple network redundancy protocols being shown by way of example to support both VLAN 20 using HSR and VLAN 101 using DLR. The cabling connection 170 as shown includes five single Ethernet physical cables, shown as 175b1, 175b2, 175b3, 175b4, and 175b5, wherein Figure 1BThe depicted cables are cylinders.The nodes in the network are a first process controller 131, a second process controller 133, and there are three I / O access device instances shown as I / O access device 132a, I / O access device 132b, and I / O access device 132c.

[0033] Therefore, each process controller including the first process controller 131 and the second process controller 133 has two cables, wherein cable 2 175b2 is connected to the second process controller 133, and cable 1 175b1 is connected to the I / O access device 132a. The second process controller 133 has two cables (cable 2 175b1 connected to the first process controller 131 and cable 3 175b3 connected to the I / O access device 132c). Cable 4 175b4 and cable 5 175b5 are two independent cables that are not connected to any process controller. Cable 4 175b4 connects the I / O access device 132a to the I / O access device 132b. Similarly, cable 5 175b5 connects the I / O access device 132b and the I / O access device 132c.

[0034] FTE and PRP are exemplary network-level redundancy protocols that are selected on each created VLAN. In addition, by utilizing separate VLANs, data security can also be automatically enabled on VLANs with critical communications without requiring additional user configuration. VLAN 20 communications are enabled through Figure 1A The illustrated security lock 118 is shown as encrypted, which represents data security between nodes through the use of authentication and encryption.

[0035] Ethernet frames are typically sent in data packets, such as as IEEE 802.3 compliant frames, and the sending and receiving of critical traffic is implemented, for example, on VLAN 20, where packets designated as critical or normal traffic can be represented based on applied network tags applied to all nodes in the network and multiple switches (if present in the network) (usually configured by the user). For example, in the case of VLAN, for each of the redundant protocols, there will be a separate VLAN tag that is used to redirect for transmission on both (or parallel redundant protocol routes). From there, the packets can be transmitted on all available cable paths.

[0036] Thus, the method also includes configuring all devices in the network, typically by a network user, with a tag representation, the devices including at least a process controller and a second node, the second node may include an I / O access device or another device, and if there are multiple switches in the communication network, each of the multiple switches may also include the tag representation including a first tag representation for a first redundant protocol (such as PRP) and a second tag representation for a second redundant protocol (such as for fault-tolerant Ethernet), wherein the tag representation will be 1 to 4095 for 12 bits, wherein the tag representation is a field in a packet transmitted / sent by the node. More generally, for each redundant protocol, there will be a separate digital representation, such as three representations for three different redundant protocols. The valid value range of the tag representation is typically set by the number of bits of the tag representation in the packet used for the network. The number of bits fixed at 12 bits is based on the industry standard 802.1Q. The first tag representation and the second tag representation are used to direct the data flow in the cable connection to communicate simultaneously by selecting between the first redundant protocol and the second redundant protocol.

[0037] Figure 2 Depicts packet processing (transmission) of critical traffic using the PRP protocol running in process controllers and I / O access devices (such as gateway devices). Figures 2 to 5 , 'PHY' is shown to refer to a physical cable, such as an Ethernet cable. 'I buy is no you' is shown as an IP stack 205, which applies its configured VLAN tag representation (one tag representation for each redundancy protocol) to data packets handed over to a block shown as a group driver block 215, which contains transmit logic 215c, a PRP block 215a, and a FTE block 215b, where logic from the transmit logic 215c is provided to the PRP block 215a. As described above, the transmit logic 215c can be implemented by code stored in a memory of the node or by hardware logic. PHY1 corresponds to a first network represented by connecting to one physical cable, and PHY2 represents a second network by connecting to a second physical cable.

[0038] There is a solid line from PRP 215a to Gigabit Media Access Control (GMAC), which is shown as GMAC1 220 and GMAC2 221, where GMAC1 220 and GMAC2 221 each represent a connection to a physical cable representing the selected packet path. GMAC1 220 associated with PHY1 is connected to switch 105a1 using cable 105b1, for example. Figure 1A GMAC 2 221 associated with PHY2 is connected to switch 105a2 using cable 105b2, for example. Figure 1AAs shown. The PRP redundancy protocol using both GMAC 220 and 221 is also supported, thus enabling connection to cable 105b1 and two cables 105b2. The FTE redundancy protocol using one of GMAC 220 and 221 at a time, thus one of cable 105b1 and cable 105b2, but not both at the same time, is also supported.

[0039] Packets for critical traffic arrive on both available paths (channel 1 and channel 2) and will be redirected to duplicate packet detection logic, such as PRP based on a VLAN tag indicating PRP, or Ethernet based duplicate packet detection logic in the case where the VLAN tag indicates fault-tolerant Ethernet. In the case of PRP or Ethernet, duplicate packets may be discarded so that a single packet may flow through the device's IP stack.

[0040] Figure 3 Packet processing (receive) for critical traffic is depicted, where the solid line from GMAC1 220 to receive logic 215d represents a first data packet received on PHY1, and the solid line from GMAC2 221 to receive logic 215d represents a second data packet received on PHY2. As described above, receive logic 215d may be implemented by code stored in a memory of the node or by hardware logic.

[0041] Packets for critical traffic arrive at nodes on both available physical networks (PHY1 and PHY2) and will be redirected to duplicate detection logic, such as a PRP based on a label representation in the packet identified as a PRP. Duplicate packets can be discarded and a single packet will flow through the IP stack 205 again. In this example, two paths are selected again. As described above, on the receiving side, the packet received on PHY1 is matched with the packet received on PHY2, and the redundant packet is discarded. This is critical logic that is performed based on the previous label representation identification, and is different logic applied compared to the transmitting end. Therefore, Figure 3 In relative to Figure 2 The change in data direction indicates the selection of the PRP logic for execution and duplicate discarding based on the VLAN tag indicating the PRP.

[0042] Regarding the packet transmission / reception of normal traffic, the packet transmission of normal traffic can be redirected to the Figure 4FTE 215b is shown. FTE 215b transmits on the best available path. Two nodes, each coupled to have two cables, which may be represented as Phy1-A and Phy2-B, have four possible paths between each other. An algorithm may be defined to select Phy1-A-Phy1-A, Phy2-B-Phy2-B, Phy1-A-Phy2-B, and Phy2-A-Phy1-B in order of priority. Figure 4 The dashed lines shown represent alternate paths that FTE 215b may choose if the primary PRP path becomes unavailable.

[0043] Figure 4 Packet processing (transmission) for normal traffic is shown. Solid lines represent the selected path. Dashed lines represent backup paths when the solid path is unavailable. In this example, when Phy2 is used as a backup, FTE 215b to GMAC1 220 on Phy1 is selected as FTE 215b to GMAC 2 221, where GMAC1 220 is again associated with PHY1 and GMAC2 221 is again associated with PHY2.

[0044] Figure 5 Packet processing (reception) for normal traffic in a non-ring network is depicted.Packets for normal traffic may only reach one of the available paths, which may be redirected to FTE 215b based on the VLAN tag representation of the FTE. Figure 5 The dashed lines in show alternative paths that packets can take to reach a terminal device, which may be the first controller 131, the I / O access device 132, or the second controller 133 as described above. As described above, the logic provided is typically executed by a processor 107 in each node.

[0045] The disclosed aspects also include a method of operating a PCS, the PCS including a first node, the first node including a process controller; and a second node, the second node including an I / O access device, wherein the process controller and the I / O access device are communicatively connected via a cable connection. The cable connection includes a plurality of physical cables, the plurality of physical cables including a first cable located between the process controller and the I / O access device, and a second cable connected between the process controller and a second node independent of the first cable, the second node including the I / O access device or another device.

[0046] There is at least one I / O module coupled to receive an output of the I / O access device, wherein the output of the I / O module is coupled to a field device, which is coupled to the processing equipment. The process controller and the I / O access device each include a processor and a memory, which implements send and receive logic (code or hardware logic stored in the memory) for communicating using any of a plurality of redundant protocols including a first redundant protocol and a second redundant protocol. The send and receive logic is used to configure the cable connection for simultaneous communication between the process controller and the second node using the first redundant protocol and the second redundant protocol.

[0047] The first cable and the second cable may be parallel relative to each other to form a first cable pair, and the cable connection may also include a second cable pair, the second cable pair including a third cable and a fourth cable parallel to the third cable, wherein the second cable pair is connected in series with the first cable pair. In this arrangement, a plurality of switches located between the first cable pair and the second cable pair are also typically included, so that the cable connection includes a switched cable connection. In this arrangement, the first redundancy protocol may include FTE, and the second redundancy protocol may include PRP.

[0048] In another arrangement, the other device comprises an I / O access device, and the first cable, the second cable, the process controller and the I / O access device are all connected in a ring. In this arrangement, the first redundancy protocol may comprise HSR, and the second redundancy protocol may comprise DLR or MRP.

[0049] The I / O modules may include a plurality of I / O modules configured in Honeywell International Highly Integrated Virtual Environment (HIVE), wherein the I / O access device is configured such that when the plurality of I / O modules are multi-channel, any one of the plurality of I / O modules or any one of its channels may be used by the process controller for communication. The cabling may implement a tag representation, which typically includes a digital tag, wherein the source and criteria for VLAN tag selection may be configured for a user of the network, wherein the valid value range of the tag representation is based on the number of bits allocated, such that for a 12-bit representation valid tag representation values ​​are 1 to 4095 for directing data flow to achieve simultaneous communication.

[0050] The cable connection 105 may also include a security lock (described above in FIG. 1 , the security lock is shown as 118) that automatically adds encryption to only one of the first redundant protocol and the second redundant protocol (e.g., two VLANs 20 instead of VLAN 101) to allow automatic encryption of communications between the corresponding process controllers and between the process controllers and the I / O access device in the case of two or more process controllers. In this arrangement, the process controller and the I / O access device may include a manufacturer certificate (described above in FIG. 1 , where the manufacturer's security certificate is shown as 119) for establishing a security lock for only one of the first redundant protocol and the second redundant protocol, such as a manufacturer certificate implemented only on VLAN 20. The manufacturer certificate may be presented by the process controller to the I / O access device (or vice versa) to establish a subsequent security lock.

[0051] With the conventional data model for PCS, there is a choice between the complexity of having multiple networks and being limited to only one redundancy scheme for network redundancy, and this choice is because different network redundancy protocols cannot coexist on the same physical network. Multiple networks are complex due to the activities involved in planning, duplication of PCS software, managing different switches and cabling costs. However, conventional PCS users are forced to come up with either adding additional physical networks on the same equipment or follow the gateway model simply because they need different network redundancy schemes and need to create dedicated physical networks to support different redundancy schemes, or be satisfied with a single redundancy scheme with its recovery characteristics.

[0052] The disclosed aspects provide multiple network redundancy protocols that can be deployed on the disclosed physical network to help achieve multiple benefits of network simplification within a PCS, such as implemented as a distributed control system (DCS). In addition, because each node / network device contains embedded manufacturer credentials (e.g., X.509 manufacturer certificates), security policies for automatically encrypting critical traffic can be set. In order to enable security policies for authentication and then allow communication, an identity may be required. For example, this identity can be established using an X.509 certificate, which can be embedded in the node as part of the node's manufacturing. An X.509 certificate is an example of a credential for establishing trust and authenticating a node. Encryption of communications allows nodes to exchange data confidentially.

[0053] The disclosed physical network architecture overcomes the limitations described above in the Summary of the Invention under Problems Solved.

[0054] Notable benefits of the disclosed physical network include the following:

[0055] i) Unified I / O module accessibility. Regarding unified accessibility, in the traditional connection mode before the present disclosure, as described above, the I / O module is dedicated to and accessed by a single process controller. With the disclosed network architecture, the I / O module is not dedicated to a single process controller, but can be equally accessed by different process controllers to I / O devices from multiple process controllers;

[0056] ii) No need to duplicate several functions. By defining a single network segment, thus allowing the process controller and I / O access devices to reside, configuration and time distribution do not need to be duplicated as in conventional network architectures that require multiple network segments.

[0057] iii) Necessary network separation. Network separation can be defined as involving the development and enforcement of a set of rules for controlling communications between specific hosts, and services can be implemented with minimal configuration and built-in security due to the availability of necessary functions for authenticating and encrypting packets. Identification is required to authenticate devices through their credentials (e.g., X.509 certificates). Confidentiality is achieved through encryption (in Figure 1A Another security measure implemented by the user (shown as a security lock 118) and which is typically only implemented by the availability of an ID, such as by a manufacturer certificate;

[0058] iv) Failure recovery can be based on data flow requirements, which are usually critical for I / O module access and normal for traffic requirements of other device types in the PCS.

[0059] Example

[0060] The disclosed aspects are further illustrated by the following specific examples, which should not be construed as limiting the scope or content of the present disclosure in any way.

[0061] Table 1 shown below depicts an exemplary manner in which the disclosed network traffic policy can be established. In this example, three different label representations are shown as VLAN IDs, where critical communications corresponding to VLAN ID 20 can utilize PRP, and normal communications corresponding to VLAN ID 101 can utilize FTE, where the traffic policy is set by the VLAN ID. The VLAN ID is only one exemplary representation of setting the traffic policy. Other exemplary representation methods include internal firewalls, access control lists, and micro-segmentation. Therefore, the VLAN ID is only an example of a label representation for setting the traffic policy by selecting between two or more redundant protocols.

[0062] VLAN ID Traffic strategy 101 normal 20 critical 10 normal

[0063] Table 1: Example of a network traffic policy for data packets

[0064] Traffic strategy Network-level redundancy solution critical Parallel Redundancy Plan (PRP) normal Fault Tolerant Ethernet (FTE)

[0065] Table 2: Examples of network redundancy protocols for different network traffic policies shown as critical and normal

[0066] Although various disclosed aspects have been described above, it should be understood that they are presented by way of example only and not as limitations. Many changes may be made to the subject matter disclosed herein in accordance with the present disclosure without departing from the spirit or scope of the present disclosure. In addition, although specific features may be disclosed with respect to only one of several implementations, such features may be combined with one or more other features of other implementations as may be desired or advantageous for any given or particular application.

Claims

1. A method for operating a process control system PCS, comprising: The PCS is provided, and the PCS includes: A communication network, the communication network comprising a first node and a second node, the first node comprising a process controller, the second node comprising an input / output (I / O) access device, wherein the process controller and the I / O access device are communicatively connected via a cable connection, wherein the cable connection comprises: a plurality of physical cables, the plurality of physical cables comprising a first cable between the process controller and the I / O access device, and a second cable independent of the first cable connected between the process controller and a second node, the second node including the I / O access device or another device; wherein there is at least one I / O module coupled to receive an output of the I / O access device, wherein the output of the I / O module is coupled to a field device, the field device being coupled to processing equipment; wherein the process controller and the I / O access device each include a processor and a memory, the processor and the memory implementing send and receive logic for communicating using any of a plurality of redundant protocols including a first redundant protocol and a second redundant protocol, and communicating simultaneously between the process controller and the second node using the cable connection using both the first redundancy protocol and the second redundancy protocol, wherein, for the simultaneous communication, the first redundancy protocol is implemented for critical communication by utilizing the first cable and the second cable, and the second redundancy protocol is implemented for normal communication, and The process controller, I / O access device and multiple switches each implement two separate virtual local area network VLANs, as a first VLAN and a second VLAN, wherein simultaneously, the first VLAN is used for the critical communication and the second VLAN is used for the normal communication, wherein the two separate VLANs are implemented to separate data communications for different data flows across the two separate VLANs.

2. The method according to claim 1, wherein the first cable and the second cable are parallel to each other to provide a first cable pair, and further includes a second cable pair, the second cable pair including a third cable and a fourth cable parallel to the third cable, wherein the second cable pair is connected in series with the first cable pair, and further includes a plurality of switches located between the first cable pair and the second cable pair, so that the cable connection includes a switched cable connection.

3. The method of claim 2, wherein the first redundancy protocol comprises a Fault Tolerant Ethernet protocol, and wherein the second redundancy protocol comprises a Parallel Redundancy Protocol (PRP).

4. The method of claim 1, wherein another device comprises the I / O access device, and wherein the first cable, the second cable, the process controller, and the I / O access device are connected in a ring-shaped manner. 5 . The method of claim 4 , wherein the first redundancy protocol comprises High Availability Seamless Redundancy (HSR), and wherein the second redundancy protocol comprises Device Level Ring (DLR) or Media Redundancy Protocol (MRP).

6. The method of claim 1, wherein the I / O module comprises a plurality of I / O modules, wherein the I / O access device is configured to enable the process controller to communicate therethrough using any one of the plurality of I / O modules.

7. The method according to claim 1 also includes configuring the process controller and the second node using a first tag representation for the first redundant protocol and a second tag representation for the second redundant protocol, wherein the first tag representation and the second tag representation are used to be inserted as fields into packets for transmission for the simultaneous communication to implement directing data flow in the cable connection by selecting between the first redundant protocol and the second redundant protocol.

8. The method of claim 1, wherein the cable connection includes a security lock that automatically adds encryption to only one of the first redundancy protocol and the second redundancy protocol.

9. The method of claim 8, wherein the process controller and the I / O access device contain manufacturer certificates for establishing the security lock.

10. A process control system PCS, comprising: a communication network comprising a cable connection, the cable connection comprising a plurality of physical cables, the plurality of physical cables comprising a first cable connected between a process controller and an I / O access device, and a second cable independent of the first cable connected between the process controller and a second node, the second node comprising the I / O access device or another device, the I / O access device coupled to at least one I / O module coupled to receive an output of the I / O access device, wherein the output of the I / O module is coupled to a field device, the field device is coupled to processing equipment, wherein the process controller and the I / O access device each include a processor and a memory, the processor and the memory implementing sending and receiving logic for communicating using any of a plurality of redundant protocols including a first redundant protocol and a second redundant protocol, and wherein the transmit and receive logic is to configure the cable connection to support simultaneous communication between the process controller and the second node using both the first redundancy protocol and the second redundancy protocol, for the simultaneous communication, implementing the first redundancy protocol for critical communication and implementing the second redundancy protocol for normal communication by utilizing the first cable and the second cable, and The process controller, I / O access device and multiple switches each implement two separate virtual local area network VLANs, as a first VLAN and a second VLAN, wherein the first VLAN is used for critical communications and, simultaneously, the second VLAN is used for normal communications, wherein the two separate VLANs are implemented to separate data communications for different data flows across the two separate VLANs.

11. The PCS of claim 10, wherein the first cable and the second cable are parallel to each other to provide a first cable pair, further comprising a second cable pair, the second cable pair comprising a third cable and a fourth cable parallel to the third cable, wherein the second cable pair is connected in series with the first cable pair, and further comprising a plurality of switches located between the first cable pair and the second cable pair, such that the cable connection comprises a switched cable connection.

12. The PCS of claim 11, wherein the first redundancy protocol comprises a Fault Tolerant Ethernet protocol, and wherein the second redundancy protocol comprises a Parallel Redundancy Protocol (PRP).

13. The PCS of claim 10, wherein another device comprises the I / O access device, and wherein the first cable, the second cable, the process controller, and the I / O access device are connected in a ring fashion.

14. The PCS of claim 13, wherein the first redundancy protocol comprises High Availability Seamless Redundancy (HSR), and wherein the second redundancy protocol comprises Device Level Ring (DLR) or Media Redundancy Protocol (MRP).

15. The PCS of claim 10, wherein the I / O module comprises a plurality of I / O modules, wherein the I / O access device is configured to enable the process controller to communicate therethrough using any one of the plurality of I / O modules.

16. The PCS of claim 10, wherein the communication network implements a first tag representation for a first redundant protocol and a second tag representation for a second redundant protocol configured at the process controller and the second node, the first tag representation and the second tag representation being used for simultaneous communication to implement directing a data flow in the cable connection by selecting between the first redundant protocol and the second redundant protocol.

17. The PCS of claim 10, wherein the cable connection includes a security lock that automatically adds encryption to only one of the first redundancy protocol and the second redundancy protocol.

18. The PCS according to claim 17, wherein the I / O access device comprises a gateway device or an interface module.

19. The PCS of claim 10, wherein the transmit and receive logic each comprises code stored in the memory.

20. The PCS of claim 10, wherein the transmit and receive logic each comprises hardware logic.

Images