Redundant automation system and method for operation

Abstract

The invention relates to a redundant automation system and a method for operating, in particular to a redundant automation system, comprising a first subsystem and a second subsystem, each having a control program for controlling a technical process and designed to be consistent, between which a synchronous connection exists, in the first subsystem, state information is stored in a source file, the state information comprises static configuration data and dynamic runtime data, in order to realize seamless updating of the second subsystem, the first data tuning device is equipped with a first independent program unit, and the second data tuning device is equipped with a second independent program unit. And a second data tuning device which is in turn designed to read out write access from the dynamic runtime data of the first subsystem to the source data in order to update the dynamic runtime data of the second subsystem and to synchronously transmit the data content of the updated write access to the second subsystem, the second data tuning device being equipped with a second independent program unit, it is in turn designed to stepwise receive updated write access and save it in a target file.

Description

Technical Field

[0001] The present invention relates to a redundant automation system, comprising a first subsystem and a second subsystem, wherein the subsystems respectively have control programs for controlling a technical process and are designed to be consistent, wherein a synchronous connection exists between the first subsystem and the second subsystem, wherein in the first subsystem, status information is stored in a source file, wherein the status information includes static configuration data and dynamic runtime data, wherein the first subsystem has a first data tuning device, which is designed for data tuning of the status information of the first subsystem with the status information of the second subsystem, wherein the second subsystem has a second data tuning device. Background Art

[0002] In the automation environment, there is a growing demand for high availability solutions (H systems) that are suitable for minimizing any downtime that may occur in a facility. The development of such high availability solutions is very costly, wherein the H systems commonly used in the automation environment are characterized by two or more subsystems in the form of automation devices or computer systems that are coupled to each other via a synchronization connection. In principle, both subsystems have read and / or write access to the peripheral units connected to the H system. One of the two subsystems is dominant with respect to the peripherals connected to the system. This means that the output to the peripheral units or the output of information for these peripheral units is performed only by one of the two subsystems, which acts as the master or takes over the master function. Thus, the two subsystems can operate synchronously, which are synchronized regularly via the synchronization connection. Depending on the frequency of the synchronization and the scope of the synchronization, different versions can be distinguished (warm backup, hot backup).

[0003] Furthermore, it must be ensured that when the process control is transferred from standalone or non-redundant operation to redundant operation, for example after replacing a faulty subsystem, this transfer or this transition can be completed without collision. In the context of this transfer, it is necessary to transfer the relevant data from the subsystem that previously operated the process to the new or additionally connected or already connected subsystem. As part of this transfer, which is called coupling or updating, the technical process to be controlled or the process control must not be disturbingly influenced during the so-called coupling phase and updating phase (AuA phase), and the process control must be carried out without collision during this AuA phase (hereinafter referred to as updating phase for simplicity).

[0004] A method for operating a redundant automation system is known from EP 2 667 269 B1. EP 2 657 797 B1 also proposes a method for operating a redundant automation system.

[0005] During the coupling process and the update process, all status-related data are transferred from the currently running SPS (Programmable Logic Controller) to the SPS that should be integrated into the redundant system. This status information also includes persistent data, which is usually stored in files on the file system. This persistent data is constantly changed by the control program, for example when new log data is to be stored on the file system. Data acquisition must be seamless, even during the coupling process and the update process, the same data must be constantly changed and synchronized with the newly added SPS.

[0006] In previously known methods or devices, write access to the persistent data is blocked during the synchronization process, and the data is copied to the newly added SPS. After the update process is completed, the control program can only have write access again.

[0007] Disadvantageously, therefore, the status information stored in the first subsystem, in particular the current dynamic runtime data, can be lost or must be stored temporarily in a complex manner. Summary of the invention

[0008] The object of the present invention is to eliminate this disadvantage.

[0009] This object is achieved in that the first data tuning device is designed to transfer static configuration data to the second subsystem, wherein the second data tuning device is designed to back up the static configuration data and create a target file for the dynamic runtime data, wherein the first data tuning device is configured with a first independent program unit, which is further configured to gradually read out the write accesses from the dynamic runtime data of the first subsystem to the source data to update the dynamic runtime data of the second subsystem, and to transfer the data content of these updated write accesses to the second subsystem for synchronization, wherein the second data tuning device is equipped with a second independent program unit, which is further configured to gradually receive the updated write accesses and then save them in the target file, wherein the first subsystem is designed so that the first control program is synchronized with the first independent program unit, and the second subsystem is designed so that the second control program is synchronized with the second independent program unit, whereby the order of write accesses to the source file and the target file is consistent on the two subsystems.

[0010] As soon as the source file has been completely read and transferred on the first subsystem, the content of the source file is identical to that of the target file, since write accesses during this period are also performed synchronously on both subsystems. From this point on, redundant operation is achieved and the independent program unit for data transfer that was active during this period can be terminated again.

[0011] Data collection is now seamless, since even during the synchronization phase data continues to be recorded and continuously synchronized by independent program units, without which data which would have been lost before without the invention will gradually be embedded in the system again.

[0012] It is also proposed that the first subsystem performs process guidance, and in the event that the first subsystem may fail or have an error, the second subsystem takes over the process guidance, and is further designed so that the failed or erroneous first subsystem is updated after the error is corrected or replaced using status information from the still-running second subsystem so as to work synchronously again with respect to the control program of the subsystem and the control program of the second subsystem so as to take over the process guidance when the corresponding subsystem fails again.

[0013] In order to reduce subsequent time delays, update phases are used in addition to synchronization. When transferring process control from single or non-redundant operation to redundant operation, for example after replacing a faulty subsystem, this transfer or changeover should take place as non-disruptive as possible. In the context of such a transfer, it is necessary to transfer the relevant data from the subsystem that previously led the process to the new or additionally connected or applied subsystem. In the context of such a transfer, which is referred to as coupling and updating, the technical process to be controlled or the process control must not be affected in a destructive manner during the so-called coupling phase and update phase (AuA phase), and the process control continues to run without disruption in this AuA phase (hereinafter referred to as update phase).

[0014] For this purpose, the redundant automation system is designed to transfer process control from the independent operation of one of the subsystems to the redundant control operation of the other subsystem, wherein the one subsystem is designed to transfer the second file to the other subsystem in segments within the scope of the update phase via a synchronous connection and to temporarily store process input values ​​and permissions of one subsystem, wherein the permissions indicate which processing parts of the control program the one subsystem has already processed, wherein the other subsystem is further designed to process the permitted processing parts of the control program after receiving the second file taking into account the temporarily stored process input values ​​with a time delay, the permitted processing parts corresponding to the processing parts of the control program of the one subsystem, wherein the automation system is designed to process the processing parts of the control program relatively faster than the processing of the processing parts of the control program in order to reduce the time delay of the processing to a predetermined value.

[0015] In order to reduce the communication load, the redundant automation system is designed so that the first data tuning device breaks down the second file into data slices for segmented transmission, wherein the size of these data slices is selected so that the size has no negative impact on the responsiveness of the first subsystem due to the additional load caused by the data transmission.

[0016] The object mentioned at the outset is also achieved by an operating method for a redundant automation system, wherein a first subsystem and a second subsystem respectively process a control program for controlling a technical process, wherein the first subsystem guides the process using the first control program and the second subsystem synchronously processes the second control program, and in the event of a failure of one of the two subsystems, the failed or faulty subsystem is updated by a data tuning device after the error has been corrected or replaced using status information from the subsystem that is still in operation, in order to operate synchronously with its control program again in order to take over the process guidance when the corresponding subsystem fails again, wherein the status information includes static configuration data and dynamic runtime data, the static configuration data being transmitted to the second subsystem by the first data tuning device and being saved by the second data tuning device. Statically configuring data and creating a target file for dynamic runtime data on a second subsystem, a first data tuning device starts a first independent program unit, which gradually reads out write accesses from the dynamic runtime data of the first subsystem to the source data to update the dynamic runtime data of the second subsystem, and transmits the data content of these updated write accesses to the second subsystem for synchronization, wherein a second data tuning device starts a second independent program unit, which gradually receives the data content of the updated write accesses and then saves them in the target file, wherein a first control program runs synchronously with the first independent program unit, and a second control program runs synchronously with the second independent program unit, so that the sequence of write accesses to the source file and the target file is performed consistently on the two subsystems.

[0017] The methods used so far would block write access during a synchronization process or an update process. The method proposed by the invention allows the control program to access the persistent data as a write even during the synchronization process. The advantage is that there is a seamless capture of the persistent data even during the synchronization process. Therefore, the control program does not have to implement any special behavior (such as data buffering) for the synchronization process, which simplifies the implementation of the control program and reduces the testing effort.

[0018] In order to retain parameters (e.g. controller parameters, position values, limit values) when a subsystem is powered off and restarted, they must be permanently saved beforehand. The parameters can be backed up as remanent data or using the write functions of the SPS, e.g. in a CSV file.

[0019] The invention is meant to make people understand that "persistence" in computer science refers to the property of a system to maintain the data state of the system, the object model of the system and / or the logical connections of the system for a long period of time, in particular beyond the planned or unplanned program termination. Non-volatile storage media are required for this purpose; file systems or databases as well as bidirectional and transaction-oriented data transmission protected by protocols can also be regarded as non-volatile media. Since the program may be interrupted unexpectedly at any time, persistent data storage means in particular that any changes in the data state must be immediately saved on non-volatile media. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The invention, its embodiments and advantages are explained in more detail below with reference to the drawings, in which exemplary embodiments of the invention are shown.

[0021] The figure shows:

[0022] Figure 1 shows the process of time asynchronous coupling of two subsystems,

[0023] Figure 2 The update process is shown.

[0024] Figure 3 shows a redundant automation system,

[0025] Figure 4 A redundant automation system with a data tuning device and

[0026] Figure 5 The process of synchronization with the first file and the second file in the first subsystem is shown. DETAILED DESCRIPTION

[0027] First reference Figure 3(Prior Art), wherein a known redundant automation system 100 comprising two subsystems is shown. A first subsystem 1 and a second subsystem 2 are connected to a peripheral unit Pe via a fieldbus Fb. For example, the fieldbus Fb complies with the PROFINET IO (communication protocol) specification. In principle, other bus systems are also suitable, for example, Ethernet, fieldbus, Modbus (communication protocol) or also parallel bus systems. The peripheral unit Pe receives a signal from a measuring transducer or a measured value sensor via an input line Es, which is used to capture the process state, and outputs a signal to an actuator that affects the process via an output line As. For the sake of clarity, the process as well as the measuring transducer, the measuring sensor and the actuator are not shown in the figure. The two subsystems 1, 2 execute the same control program cyclically and synchronously. A synchronization connection 3 is provided for their synchronization, wherein the redundancy function and the monitoring function are realized by this synchronization connection 3. As explained, from the point in time when the update phase is completed, the automation system 100 works in a redundant operating mode, and in terms of process control, the subsystems 1, 2 are switched from single operation to redundant operation with another subsystem. From this point in time, both subsystems 1 , 2 run the same program path in an event-synchronous manner, for example due to an event in the form of a process alarm, wherein operation using the first subsystem 1 and operation using the second subsystem 2 preferably take place asynchronously in time.

[0028] In order to explain the event synchronization processing of the control programs P1 and P2 and to better understand the present invention, the following reference is made to this. Figure 1 , wherein the proposed process is shown for the time-asynchronous coupling of two subsystems 1 , 2. In this context, "event-synchronous processing" means that the master and the slave run the same program path of the respective control program due to an event, wherein the execution is carried out asynchronously in time.

[0029] It is assumed that one of the subsystems 1, 2 is operated as a master M and one of the subsystems 1, 2 is operated as a slave S or as a reserve. The master M is thus the master in terms of controlling the technical process and takes over the process control, wherein the master M receives data from the peripheral units Pe ( Figure 3 ) reads the process input information or process input value and provides it to the slave S asynchronously in time. The slave S takes over the master function or master role only when the master M fails due to a fault.

[0030] The master M processes a program P1 for controlling a technical process, wherein the slave S also processes a second control program P2 corresponding to this first control program P1. Both control programs P1, P2 have a large number of processing parts Va of different durations, wherein the control programs P1, P2 are interruptible at the respective beginning and the respective end of each processing part Va. The beginning and the end of each processing part Va therefore represent interruptible program points or interruption points 0, 1, 2, ... y, which usually include a large amount of program code. If necessary, the master M and the slave S can interrupt the corresponding control program P1, P2 at these interruption points 0, 1, 2, ... y in order to be able to take appropriate reactions after the occurrence of an event or process alarm. In addition, the corresponding control program P1, P2 can be interrupted at these interruption points 0, 1, 2, ... y, so that the master M and the slave S can communicate via the fieldbus Fb or via the synchronization connection Sv ( Figure 4 ) can exchange permissions, responses or other information. At a corresponding predeterminable or predetermined time interval Zi, i=1, 2, ... has elapsed and at a corresponding time when an interruption point occurs after the corresponding time interval Zi has elapsed (preferably at the first interruption point after the corresponding time interval Zi), the master M transmits a permission or permission signal to the slave S, which indicates to the slave S up to which processing parts Va of the control program P2 of the slave S is allowed. These processing parts Va of the control program P2 correspond to the processing parts that the master M has already processed during the processing of the control program P1.

[0031] In the present embodiment, it is assumed that after the time interval Z1 has passed at the time point t1, and at the time point t2, at which the first interruption point P1_6 (interruption point 6) follows the time interval Z1, the master M transmits a license F1 to the slave S. The license F1 includes information for the slave S, namely, that the slave is allowed to process the control program P2 to be processed by the slave until the interruption point P2_6 (interruption point 6), wherein the interruption point P2_6 of the control program P2 corresponds to the interruption point P1_6 of the control program P1. This situation means that, due to the license, the slave S can process the processing part Va of the control program P2, which corresponds to the processing part Va of the control program P1 until the time point when the license or the license signal is generated, wherein, in this example, for simplicity, it is assumed that the time point when the license is generated corresponds to the time point when the license is sent to the slave S. Therefore, the processing of these processing steps Va by the slave S is performed asynchronously in time with the processing of the corresponding processing parts Va by the host M, wherein, after the slave S processes the processing part Va of the control program P2, the slave S will only process the additional processing part Va when the host M sends another permission to the slave S.

[0032] The time points at which these interruption points P1_6 , P2_6 (interruption point 6 ) occur represent the beginning of the time interval Z2 following the time interval Z1 .

[0033] The further time-asynchronous processing of the control programs P1, P2 takes place in the manner described. At the time point t3, when the first interruption point P1_A occurs after the time interval Z2 has elapsed, the master M sends a further grant F2 to the slave S, which indicates to the slave S that it can process further processing portions Va up to the interruption point P2_A. These processing portions Va again correspond to the processing portions that the master M has already processed from the time point t2 to the time point t3 (i.e. up to the interruption point P1_A). This situation means that the slave S processes the processing portion Va from the time point t2 of the previous grant F1 to the time point t3 of the current grant F2. The time point t3, at which the first interruption point P1_A occurs after the time interval Z2 has elapsed, is the beginning of the time interval Z3 after the time interval Z2.

[0034] It may now happen that an event occurs during the time interval, for example in the form of a process alarm. In the exemplary embodiment, E denotes an event to which the master M must react appropriately during the time interval Z3 to the time point t4 according to the provisions of the control program P1. In this case, the master M sends a permission F3 to the slave S not at the time point after the time interval Z3, when the interruption point following the time interval Z3 occurs, but at the time point t5 when the interruption point P1_C (interruption point C) occurs after the occurrence of the event E. This situation means that the time interval Z3 is shortened by the event E, wherein the time point t5 is the beginning of the subsequent time interval Z4. Due to the permission F3 sent to the slave S, the slave S processes the processing part Va of the control program P2, which corresponds to the processing part Va of the first control program P1 that the master M has already processed between the time points t3 and t5.

[0035] Due to event E, the master M processes the higher-priority processing section Va during the time interval Z4, for example, the master M performs a thread change at time t5 and again at time t6 sends a permission F4 after the time interval Z4 at time t7, at which time the first interruption point P1_12 (interruption point 12) following the time interval Z4 occurs. Due to this permission, the slave S also processes the processing sections Va up to the interruption point P2_12 (interruption point 12) of the control program P2, wherein these processing sections Va correspond to the processing sections Va of the control program P1 between the time points t5 and t7 and wherein the slave S also performs a thread change.

[0036] As explained, the permission of the master M enables the slave S to traverse the same "thread stack" as the master M, which means that the slave S performs a "thread change" at a position in the control program P2, which is a position in the corresponding control program P1. The slave S will only continue the slave processing if the master device M requires it through permission. In terms of the processing of the processing part, the master M processes it in real time in an independent or non-redundant operation, and issues permission for the processing of the corresponding processing part by the slave S at regular time intervals and after the occurrence of an event, wherein the master M continues to process the first control program P1 and does not actively wait for a response from the slave S. The slave S follows the master M in the processing of the corresponding processing part and processes it due to the issued master permission.

[0037] It is assumed below that the process control is transferred from the single operation of the master M to the redundant control operation of the slave S. Such a transfer is necessary, for example, if the slave S is coupled back to the master M again after repair. For this purpose, reference is made to Figure 2 , wherein an update process of the automation system 100 is shown.

[0038] The transmission starts at time t11 and continues until the time when the master M has recognized that the slave S is coupled to the fieldbus Fb ( Figure 3 ), wherein the update phase of the master M and the slave S begins from this time t11. From this time t11, the master M creates a local copy K of all relevant data, which represents its internal state up to the time t11, wherein the master M continues to control the technical process in a separately running manner and processes the processing part Va of the control program P5. From the time t12 to the time t13, at the time point where the update phase of the master M is completed, the master M transmits this copy K in sections to the slave S (this is indicated by the arrow Kf in the figure), and the slave S receives the copy completely until the time t14. At the time t14, the slave S now has the same internal state as the master at the time t11. From the time t12, all permissions of the host M and the data received by the host M from the peripheral unit Pe ( Figure 3) are temporarily stored on the master M, the slave S or another subsystem of the automation system, wherein these permissions processed by the slave S are unlocked only after the complete receipt of the copy K. In the present exemplary embodiment, it is assumed that during the time period from the time point t11 ​​to the time point t13, the transfer of the copy K is completed at the time point, which generates permissions F13, F14, F15, F16 and further reads in process input values ​​Ew3, Ew4 in the master M running alone. These permissions F13 to F16 and these process input values ​​Ew3, Ew4 are only granted to the slave S from the time point t14 (i.e. the time point at which the internal state of the master M is completely available to the slave S), which is indicated by the arrow Fs in the figure and by the arcs L3, L4. After being unlocked by the master M, the slave S approaches the internal state of the master Ms by processing the data of the copy K according to the provisions of the permissions F13 to F16. The slave S processes a processing part Va of its control program P6 which corresponds to the processing part Va of the control program P5 of the master M up to time t13 , wherein the slave S takes into account the process input values ​​Ew3 , Ew4 in the processing of the control program P6 .

[0039] Since the slave S brings itself into the internal state of the master M asynchronously in terms of time, the slave S lags behind the master M in the processing of the corresponding processing part Va of the control program P6, wherein this time lag must be reduced to a tolerable level; since a time lag that is too high can lead to redundancy losses. In order to reduce this time lag, it is proposed that the processing speed of the slave S is higher than the processing speed of the master M, which is shown in the figure in the form of a "shortened" processing part Va in the control program P6. The relative increase in the processing speed of the slave S can, for example, be caused by the slave S processing the processing part Va of its program P6 faster or the master M processing the processing part Va of its program P5 more slowly. Only when the lag has been caught up or reduced to a tolerable level or a predetermined value, the update phase of the slave S and therefore the update phase of the automation system 100 starting at the time t12 is completed.

[0040] In the present embodiment, it is assumed that the lag at time point t15 is reduced to a tolerable level. This level is selected or specified so that in the event of a failure of the master M, the slave S can take over the master role without any problems. In the figure, the time difference between time point t16 and time point t15 represents a tolerable level, which in a practical embodiment of the invention is in the millisecond range. Within the scope of the update phase of the slave S, the slave S processes the licenses F13 to F16 temporarily stored during the transmission of the copy K and the licenses F17, F18, F19 from time point t14 to time point t15, which the master M transmits to the slave S after the transmission. These licenses F17 to F19 indicate to the slave S which processing parts Va of the control program P6 the slave S will further process, wherein these processing parts Va correspond to the processing parts Va of the control program P5, which the master M has already processed since time point t14. In other words: when the host M completely sends the copy to the slave S or the slave S completely receives the copy K, the slave S processes all permitted processing parts Va of its control program P6 from time point t14 to time point t16, which correspond to those that the host M has processed from time point t11 ​​to time point t15.

[0041] From time t15 onwards, the update phase is completed and the automation system 100 switches to redundant operation. The process control has changed from a separate operation of the master M to a redundant operation with the slaves S, wherein from time t16 onwards, the further execution of the corresponding program paths on the master M and the slaves S is done asynchronously in time in the manner described or can be done synchronously in time in a known manner.

[0042] Figure 4 The expanded automation system 100 described above is shown with data tuning devices 11, 12, wherein the first subsystem 1 has a first data tuning device 11 and the second subsystem 2 has a second data tuning device 12. The first subsystem 1 has a first control program P1 for controlling a process and the second subsystem 2 also has a second control program P2 for controlling a process. A synchronization connection 3 is provided for synchronizing the first subsystem 1 with the second subsystem 2. State information Z1 is stored in the first subsystem 1, the state information comprising static configuration data K1 and dynamic runtime data L1. The first subsystem 1 is designed to perform data tuning of the state information Z1 of the first subsystem 1 with the state information Z2 of the second subsystem 2 using the first data tuning device 11 of the subsystem, wherein the second subsystem 2 has the second data tuning device 12.

[0043] The first data tuning device 11 is designed to transfer the static configuration data K1 to the second subsystem 2, and the second data tuning device 12 is designed to back up the static configuration data K1 and create a target file ZD for the dynamic runtime data L1. The first data tuning device 11 is also equipped with a first independent program unit T1, which is also designed to gradually read out the write accesses from the dynamic runtime data L1 of the first subsystem 1 to the source data QD to update the dynamic runtime data L2 of the second subsystem 2. It can also be performed in the update phase, and the data content of these updated write accesses is transmitted to the second subsystem 1 for synchronization.

[0044] The independent program unit T1 can be designed as a task or a synchronous transmission thread.

[0045] The second data tuning device 12 is designed with a second independent program unit T2, which is designed to gradually receive updated write accesses and then store them in the target file ZD. The second independent program unit T2 can also be designed as a task or a synchronous transmission thread.

[0046] To ensure synchronization, the first subsystem 1 is designed to synchronize the first control program P1 with the first independent program unit T1 and the second subsystem 2 is designed to synchronize the second control program P2 with the second independent program unit T2, so that the write access sequence to the source file QD and the target file ZD is consistent on the two subsystems.

[0047] To achieve this, the static configuration data K1 are transferred to the second subsystem 2 by the first data tuning device 11 , the static configuration data ( K1 ) are protected by the second data tuning device 12 and a target file (ZD) for the dynamic runtime data L1 is created on the second subsystem 2 .

[0048] Then, the first data tuning device 11 starts the first independent program unit T1, which gradually reads the write access of the dynamic runtime data L1 of the first subsystem to the source file QD to update the dynamic runtime data L2 of the second subsystem 2, and transmits the updated write access data content to the second subsystem 2 for synchronization. Then, the second data tuning device 12 starts the second independent program unit T2, which then gradually receives the updated write access data content and then stores it in the target file (ZD).

[0049] The first subsystem 1 and the second subsystem 2 are configured such that the first control program P1 runs synchronously with the first independent program unit T1 and the second control program P2 runs synchronously with the second independent program unit T2, whereby the write access sequence to the source file QD and the target file ZD is consistent on the two subsystems 1, 2.

[0050] As soon as the source file QD has been completely read and transferred on the first subsystem 1, the content of the source file QD is considered to be identical to the content of the target file ZD, since write accesses are also carried out synchronously in the meantime on both subsystems 1, 2. From this point in time, redundant operation is achieved and the independent program units T1, T2 for data transfer that were active in the meantime can be terminated again.

[0051] according to Figure 5 , shows a flow according to a method for "updating" or synchronizing from a first subsystem 1 to a second subsystem 2. The first subsystem 1 is initially operated in a separate operation 50. In the first subsystem 1, write and read accesses to the source file QD are implemented for the dynamic runtime data L1. The first static configuration data K1 are transferred in a start synchronization step 51. In step 52, a memory image is created and a target file ZD is created on the second subsystem. Thus, a data transfer 55 is started or a first independent program unit T1 is started. Redundant operation is again realized via step 56.

Claims

1. A redundant automation system (100), comprising a first subsystem (1) and a second subsystem (2), wherein the first subsystem and the second subsystem each have a control program (P1, P2) for controlling a technical process and are implemented in a consistent manner, wherein a synchronization connection (3) exists between the first subsystem (1) and the second subsystem (2), In the first subsystem (1), state information (Z1) is stored in a source file (QD), and the state information includes: Static configuration data (K1), and Dynamic runtime data (L1), The first subsystem (1) has a first data tuning device (11), which is implemented to perform data tuning on the state information (Z1) of the first subsystem (1) and the state information (Z2) of the second subsystem (2), wherein the second subsystem (2) has a second data tuning device (12), It is characterized in that The first data tuning device (11) is implemented to transmit the static configuration data (K1) to the second subsystem (2), The second data tuning device (12) is implemented to back up the static configuration data (K1) and create a target file (ZD) for the dynamic runtime data (L1), The first data tuning device (11) is equipped with a first independent program unit (T1), which is in turn implemented to gradually read out the write accesses of the dynamic runtime data (L1) of the first subsystem to the source file (QD) to update the dynamic runtime data (L2) of the second subsystem (2) and to transmit the data content of the repeated write accesses to the second subsystem (1) for synchronization purposes, The second data tuning device (12) is equipped with a second independent program unit (T2), which is in turn implemented to gradually receive repeated write accesses and subsequently save the write accesses in the target file (ZD). The first subsystem (1) is implemented to synchronize the first control program (P1) with the first independent program unit (T1), and The second subsystem (2) is implemented to synchronize the second control program (P2) with the second independent program unit (T2), Thereby, the order of the write access of the source file (QD) and the target file (ZD) is consistent on the two subsystems.

2. The redundant automation system (100) according to claim 1 is implemented to enable the first subsystem (1) to perform process control and, in the event of a possible error or failure of the first subsystem (1), to enable the second subsystem (2) to take over the process control. The redundant automation system is also implemented to enable the faulty or erroneous first subsystem (1) to be updated using status information (Z2) from the still-operating second subsystem (2) after the error has been corrected or replaced, so that the control program (P2) of the second subsystem (2) can be run synchronously again with respect to the control program (P1) of the subsystem, so as to take over the process control when the corresponding subsystem (1, 2) fails again.

3. The redundant automation system (100) according to claim 1 or 2, which is designed to transfer process control from a separate operation of one of the subsystems (1, 2) to a redundant control operation using the other subsystem (1, 2), wherein: A subsystem (1) is designed to transfer the content of the source file (QD) in the form of segments to another subsystem (2) via the synchronization connection (3) within the scope of an update phase and to temporarily store process input values ​​(Ew3, Ew4) and a license (F13 to F16) of the one subsystem (1), wherein the license indicates which processing parts (Va) of the control program (P1) the one subsystem (1) has processed, and the other subsystem (2) is also designed to, upon receiving the source file (QD ), processing a permitted processing part (Va) of a control program (P2) of a subsystem corresponding to a processing part (Va) of a control program (P1) of the one subsystem (1) when taking into account the temporarily stored process input values ​​(Ew3, Ew4) with a time delay, wherein the automation system is implemented to process the processing part (Va) of the control program (P2) faster than the processing part (Va) of the control program (P1) in order to reduce the time delay of the processing to a predetermined value.

4. The redundant automation system (100) according to claim 3, wherein: The first data tuning device (11) decomposes the content of the source file (QD) into data slices for segmented transmission, wherein the size of the data slices is selected so that the size has no negative impact on the responsiveness of the first subsystem (1) due to the additional load of data transmission.

5. A method for operating a redundant automation system, wherein: A first subsystem (1) and a second subsystem (2) each process a control program (P1, P2) for controlling a technical process, wherein the first subsystem (1) uses the first control program (P1) to guide the process and the second subsystem (2) synchronously processes the second control program (P2) so that in the event of a failure of one of the two subsystems (1, 2), the failed or faulty subsystem (1, 2) is updated by a data tuning device (11, 12) with status information (Z1, Z2) from the subsystem (1, 2) that is still in operation, respectively, after the error has been corrected or replaced, so that it can be operated synchronously again with the control programs (P1, P2) of the subsystems in order to take over the process guidance in the event of a repeated failure of the respective subsystem (1, 2), wherein the status information (Z1, Z2) includes: Static configuration data (K1, K2), and Dynamic runtime data (L1, L2), It is characterized in that transmitting the static configuration data (K1) to the second subsystem (2) by means of the first data tuning device (11), The static configuration data (K1) are backed up by means of the second data tuning device (12) and a target file (ZD) is created on the second subsystem (2) for the dynamic runtime data (L1), The first data tuning device (11) starts a first independent program unit (T1), which gradually reads out the write accesses of the dynamic runtime data (L1) of the first subsystem to the source file (QD) to update the dynamic runtime data (L2) of the second subsystem (2) and transmits the data content of the repeated write accesses to the second subsystem (1) for synchronization purposes, The second data tuning device (12) starts a second independent program unit (T2), which gradually receives the data content of the repeated write accesses and then saves the data content of the write accesses into the target file (ZD). The first control program (P1) is executed by the first independent program unit (T1) in a synchronous manner, and The second control program (P2) is executed by the second independent program unit (T2) in a synchronous manner, Thereby, the order of the write accesses to the source file (QD) and the target file (ZD) is performed in a consistent manner on both subsystems.

6. The method according to claim 5, wherein: As soon as the source file (QD) has been completely read and transferred on the first subsystem, the content of the source file (QD) is considered to be consistent with the content of the target file, because in the meantime the write access has also been executed in a synchronous manner on both subsystems (1, 2), redundant operation is achieved from the point in time of this execution and the independent program unit for data transmission that has been activated in the meantime can be terminated again.

Images