Method and system for managing technical facility during occurrence of error state in controller

Abstract

The invention provides a method and a system for a technical facility during the occurrence of an error condition in a controller device of the technical facility. The method includes receiving, by a processing unit (202), a plurality of program execution parameters from each of a plurality of controller devices in a technical facility. The method further includes determining an error state in a first controller device of the plurality of controller devices. The method further includes determining a fail-safe logic associated with the first controller device from a plurality of fail-safe logics based on the determination of the error state in the first controller device. The method further includes initiating, by the processing unit (202), execution of fail-safe logic associated with the first controller device in a second controller device of the plurality of controller devices.

Description

[0001] The present invention relates to the field of industrial automation and more particularly to a method and a system for managing a technical installation during an error state occurring in a controller device of the technical installation.

[0002] A technical facility such as an industrial plant includes a plurality of field devices controlled by a plurality of controller devices, such as a programmable logic controller, an edge device, and an edge controller. Examples of a plurality of field devices include, but are not limited to, control valves, motors, pumps, and actuators. Each of the plurality of controller devices is configured to control one or more of the plurality of field devices. If a controller device in the plurality of controller devices enters an error state, the function of the controller device is hindered. Therefore, the function of one or more field devices controlled by the controller device is also hindered, resulting in downtime in the industrial plant.

[0003] In view of the above, there is a need for an efficient and cost-effective method and system for managing a technical facility during an error state in a controller device of the technical facility. Therefore, an object of the present invention is to provide a method and system for managing a technical facility during an error state in a controller device of the technical facility.

[0004] The purpose of the present invention is achieved by a method and system for managing technical facilities during an error state in a controller device of a technical facility. The technical facility includes a plurality of field devices and a plurality of controller devices. Examples of the plurality of controller devices include edge devices, programmable logic controller devices, microprocessors or processing units. Each of the plurality of controller devices is configured to execute an engineering program to control a plurality of field devices in the technical facility. In one example, the plurality of controller devices include one or more edge controllers. Examples of the plurality of field devices include, but are not limited to, field devices such as control valves, motors, pumps, robots, lathes, sensors and actuators. The plurality of field devices further include pressure sensors, temperature sensors and vibration sensors. Other examples of the plurality of field devices include human-machine interfaces such as keyboards, mice and touch screens, and a plurality of client devices such as smart phones, desktop computers and tablet computers connected to the plurality of controller devices by a network. Examples of technical facilities include manufacturing plants, power plants or chemical processing plants.

[0005] In a preferred embodiment, the method includes receiving, by a processing unit, a plurality of program execution parameters from each of a plurality of controller devices in a technical facility. The plurality of program execution parameters received from the controller device include information about the runtime execution of the engineering program in the controller device. For example, the plurality of program execution parameters include runtime information, such as information about memory fragmentation, scan cycle properties, system resource utilization, and memory utilization of the controller device during execution of the engineering program in the controller device. The engineering program includes a plurality of programming blocks, each of which includes one or more programming instructions. In one example, the engineering program is a graphical program including program logic. The engineering program includes a set of programmable instructions or statements corresponding to the program logic. Each of the plurality of programming blocks corresponds to a functional block under the engineering design of the technical facility.

[0006] In a preferred embodiment, the method includes determining, by a processing unit, an error state in a first controller device among a plurality of controller devices. The error state is determined based on an analysis of a plurality of program execution parameters received. In the case where the first controller device has stopped execution of an engineering program, the first controller device is determined to be in an error state. In one example, the processing unit is configured to compare one or more of the received plurality of program execution parameters with one or more threshold values ​​stored in a memory. During execution of an engineering program in a first programmable logic controller, one or more program execution parameters are received from the first controller device. In the case where one or more program execution parameters cross one or more threshold values, the first controller device is determined to be in an error state. In another example, the processing unit is configured to apply a pattern recognition machine learning model to one or more program execution parameters to determine an error state in the first controller device. In order to train the pattern recognition machine learning model, historical data including a set of program execution parameters received from a plurality of controller devices during a specific time interval is analyzed by the processing unit. The processing unit is further configured to identify a plurality of patterns in the set of program execution parameters based on the analysis. In addition, the processing unit is further configured to identify a plurality of relationships between the set of program execution parameters and the error states of one or more of the plurality of controller devices. Thus, the pattern recognition machine learning model is configured to recognize multiple patterns in the multiple program execution parameters and determine that the first controller device is in an error state. Examples of pattern recognition machine learning models include, but are not limited to, supervised learning models and unsupervised learning models.

[0007] In a preferred embodiment, the method includes determining, by a processing unit, a fail-safe logic associated with a first controller device from a plurality of fail-safe logics based on a determination of an error state in the first controller device. In one example, each of the plurality of fail-safe logics has an identification number that indicates a controller device associated with the fail-safe logic. Therefore, the processing unit is configured to determine the fail-safe logic based on an identification number of the fail-safe logic that matches the identification number of the first controller device. In one example, the plurality of fail-safe logics include a plurality of programming instructions that are configured to manage a plurality of field devices in a technical facility. Each of the plurality of fail-safe logics is associated with a particular controller device in the plurality of controller devices. The fail-safe logic associated with the first controller device includes a set of programming instructions that are configured to manage one or more field devices controlled by a first programming logic controller. The fail-safe logic can be executed in any of the plurality of controller devices to manage one or more field devices.

[0008] In a preferred embodiment, the method further includes determining, by the processing unit, that the second controller device is not in an error state based on an analysis of the received program execution parameters. For example, in a case where one or more program execution parameters of the second controller device do not cross one or more thresholds, the second controller device is determined to be not in an error state. In another example, determining that the second controller device is not in an error state is determined by a pattern recognition machine learning model.

[0009] In a preferred embodiment, the method further comprises transmitting, by the processing unit based on the determination that the second controller device is not in an error state, the fail-safe logic to the second controller device. The processing unit is configured to transmit the determined fail-safe logic to the second controller device via the network.

[0010] In a preferred embodiment, the method includes establishing, by a processing unit (202), a connection path between the second controller device and one or more field devices associated with the first controller device. In one example, the processing unit is configured to establish the connection path via a network.

[0011] In a preferred embodiment, the method includes initiating, by a processing unit, execution of a fail-safe logic associated with a first controller device in a second controller device among a plurality of controller devices. For example, the processing unit is configured to transmit a request to the second controller device via a network. The request is used to initiate execution of the fail-safe logic in the second programmable controller. Thus, the second programmable controller executes the fail-safe logic to control one or more field devices associated with the first controller device. Advantageously, even when the first controller device is in an error state, the one or more field devices are controlled and managed. Therefore, the processing unit 202 seamlessly transfers control of the one or more field devices from the first controller device to the second controller device, thereby avoiding downtime in the technical facility.

[0012] In a preferred embodiment, the method includes stopping, by the processing unit, runtime of the first controller device based on the determination of the error state of the first controller device. In one example, the processing unit is configured to transmit a stop command to the first controller device to stop runtime of the first controller device. In one example, when the first controller device is stopped, the first controller device terminates execution of the engineering program. Advantageously, the first controller device stops transmitting error outputs to one or more field devices.

[0013] In a preferred embodiment, the method includes stopping, by a processing unit (202), one or more field devices based on a determination of an error state in a first controller device. In one example, when the one or more field devices are stopped, a function of the one or more field devices is stopped. In addition, the processing unit is further configured to notify a user that the first controller device is in an error state. In addition, the user is enabled to resolve the error state of the first controller device by debugging an engineering program.

[0014] In a preferred embodiment, the method includes determining, by the processing unit, that the error state of the first controller device is resolved based on an analysis of the received plurality of program execution parameters. To determine that the error state is resolved, the processing unit is configured to determine that the received plurality of program execution parameters are within a plurality of thresholds. Advantageously, once the one or more errors in the engineering program are resolved, the first controller device resumes execution of the engineering program.

[0015] In a preferred embodiment, the method further includes resuming, by the processing unit, runtime of the first controller device based on a determination that the error state of the first controller device is resolved. In the event that the error state is determined to be resolved, the processing unit is configured to transmit a trigger to the first controller device to resume runtime execution of the engineering program.

[0016] In a preferred embodiment, the method further comprises determining, by the processing unit, a count of the number of times an error state is determined in the first controller device during the time interval. In a preferred embodiment, the method further comprises notifying, by the processing unit, a user about the determined count of the number of times. Advantageously, the user is enabled to evaluate the performance of the first controller device.

[0017] In one example, the plurality of program execution parameters include information about programming blocks of the engineering program executed by the first controller device at specific time intervals. In a preferred embodiment, the method further includes determining, by the processing unit based on an analysis of the plurality of program execution parameters, programming blocks of the engineering program executed by the first controller device at specific time intervals.

[0018] In a preferred embodiment, the method further comprises determining, by the processing unit, whether an error condition has occurred in the first controller device during execution of the determined programming block. In a preferred embodiment, the method further comprises notifying a user, by the processing unit, that an error condition has occurred in the first controller device during execution of the determined programming block by the first controller device.

[0019] In a preferred embodiment, the method further comprises executing processing logic by the processing unit (202) to control one or more field devices in the event that an error state is determined in the first programmable logic controller. The processing logic comprises a set of programming instructions configured to manage one or more field devices controlled by the first programmable logic controller. The processing logic is executable by the processing unit.

[0020] The object of the present invention is also achieved by an industrial control system for managing technical facilities during an error state in a controller device. The industrial control system includes a processing unit and a memory coupled to the processing unit. The memory includes a plant safety manager module stored in the form of machine-readable instructions executable by the processor. The plant safety manager module is configured to perform the method as described above.

[0021] The object of the present invention is also achieved by an industrial environment. The industrial environment includes an industrial control system, a technical facility including one or more physical components, and a plurality of human-machine interfaces communicatively coupled to the industrial control system and the technical facility. The industrial control system is configured to perform the above method steps.

[0022] The object of the present invention is also achieved by a computer program product having machine-readable instructions stored therein, which, when executed by one or more processors, cause the one or more processors to perform the method steps as described above.

[0023] The above and other features of the present invention will now be addressed with reference to the accompanying drawings of the present invention.The illustrated embodiments are intended to illustrate the present invention, not to limit the present invention.

[0024] The invention is further described hereinafter with reference to the illustrative embodiments shown in the accompanying drawings, in which:

[0025] Figure 1 is a block diagram of an industrial environment capable of managing a technical facility during an error state occurring in a controller device of the technical facility according to an embodiment of the present invention;

[0026] Figure 2 Examples of such embodiments in which the present invention may be implemented are Figure 1 Block diagrams of industrial control systems such as those shown in;

[0027] Figure 3 Examples of such embodiments in which the present invention may be implemented are Figure 2 A block diagram of a plant safety manager module such as those shown in ;

[0028] Figure 4A -D is a process flow diagram according to an embodiment of the present invention, which illustrates an exemplary method of managing a technical facility during an error state occurring in a controller device of the technical facility;

[0029] Various embodiments are described with reference to the accompanying drawings, wherein the same reference numerals are used to refer to the drawings, wherein the same reference numerals are used throughout to refer to the same elements. In the following description, for the purpose of explanation, numerous specific details are set forth in order to provide a thorough understanding of one or more embodiments. It may be apparent that such embodiments may be practiced without these specific details.

[0030] Figure 1 1 is a block diagram of an industrial environment 100 capable of managing a technical facility 106 during an error state occurring in a controller device of the technical facility 106 according to an embodiment of the present invention. Figure 1 , an industrial environment 100 includes an industrial control system 102, a technical facility 106, and a plurality of human-machine interfaces 120A-N. As used herein, an "industrial environment" refers to a processing environment that includes configurable computing physical and logical resources (e.g., networks, servers, storage, applications, services, etc.) and data distributed on a platform such as a cloud computing platform. The industrial environment 100 provides on-demand network access to a shared pool of configurable computing physical and logical resources. The industrial control system 102 is communicatively connected to the technical facility 106 via a network connection 104 (such as a local area network (LAN), a wide area network (WAN), Wi-Fi, the Internet, any short-range or wide-area communication). The industrial control system 102 is also connected to a plurality of human-machine interfaces 120A-N via the network connection 104.

[0031] The industrial control system 102 is connected to a plurality of field devices 126A-N in the technical facility 106 via a network connection 104. The plurality of field devices 126A-N may include servers, robots, switches, automation equipment, programmable logic controllers (PLCs), human-machine interfaces (HMIs), motors, valves, pumps, actuators, sensors, and (one or more) other industrial equipment. The plurality of field devices 126A-N may be connected to each other or to several other components ( Figure 1 (not shown). The physical connection may be through wiring between the plurality of field devices 126A-N. Alternatively, the plurality of field devices 126A-N may also be connected via a non-physical connection (such as the Internet of Things (IoT)) and a 5G network. Figure 1 The industrial control system 102 is illustrated as being connected to one technical facility 106, but one skilled in the art can envision that the industrial control system 102 can be connected to several technical facilities located at different geographical locations via the network connection 104. The plurality of field devices 126A-N further include sensors, such as pressure sensors, voltage sensors, temperature sensors, and vibration sensors. In such a case, the plurality of field devices 126A-N make one or more measurements from the technical facility 106. The one or more measurements include temperature measurements, pressure measurements, and vibration measurements.

[0032] The technical facility 106 further includes a plurality of controller devices 108A-N. Examples of the plurality of controller devices 108A-N include, but are not limited to, controller devices, such as controller devices, microprocessors, and other processing units. The plurality of controller devices 108A-N are configured to execute engineering programs stored in the industrial control system 102 in a plurality of scanning cycles. The plurality of controller devices 108A-N are configured to receive a plurality of input parameter values ​​from a plurality of field devices 126A-N. The plurality of controller devices 108A-N are further configured to transmit a plurality of output parameter values ​​to the plurality of field devices 126A-N. Each of the plurality of field devices 126A-N is connected to one or more of the plurality of controller devices 108A-N via the network connection 104. Each of the plurality of controller devices 108A-N is configured to control one or more of the plurality of field devices 126A-N. For example, the first controller device 108A is configured to control the first field device 126A and the second field device 126N of the plurality of field devices 126A-N.

[0033] Multiple human-machine interfaces 120A-N can be desktop computers, laptop computers, tablet computers, smart phones, and the like. Each of the multiple human-machine interfaces 120A-N is equipped with an engineering tool 122A-N for generating and / or editing engineering programs respectively. Multiple human-machine interfaces 120A-N can access the industrial control system 102 for automatically generating engineering programs. Multiple human-machine interfaces 120A-N can access cloud applications (such as providing performance visualization of multiple field devices 126A-N via a web browser). Throughout the specification, the terms "human-machine interface", "client device" and "user device" are used interchangeably. One or more of the multiple human-machine interfaces 120A-N are further configured to receive multiple user actions from multiple users. Multiple user actions include user input, user commands, user gestures, programming instructions, and user passwords. Multiple user actions are input by multiple users to perform one or more tasks using multiple controller devices 108A-N and multiple field devices 126A-N.

[0034] Note that the industrial control system 102 is connected to a controller device 124. Examples of the controller device 124 include, but are not limited to, controller devices, microprocessors, and other processing units. The controller device 124 is configured to execute an engineering program generated by the industrial control system 102 in a plurality of scan cycles. The controller device 124 is configured to receive a plurality of input parameter values ​​from a plurality of sensor devices 126A-N and a plurality of human-machine interfaces 120A-N. The controller device 124 is further configured to transmit a plurality of output parameter values ​​to a plurality of field devices 108A-N and a plurality of human-machine interfaces.

[0035] The industrial control system 102 may be a stand-alone server deployed at a control station, or may be a remote server on a cloud computing platform. In a preferred embodiment, the industrial control system 102 may be a cloud-based industrial control system. The industrial control system 102 is capable of delivering applications (such as cloud applications) for managing technical facilities 106 including multiple field devices 108A-N. The industrial control system 102 may include a digital platform 110 (such as a cloud computing platform), a plant safety manager module 112, a server 114 including hardware resources and an operating system (OS), a network interface 116, and a database 118. The network interface 116 enables communication between the industrial control system 102, the technical facilities 106, multiple human-machine interfaces 120A-N, multiple field devices 126A-N, and multiple controller devices 108A-N. For example, a cloud interface ( Figure 1 An interface (not shown) may allow engineers at multiple field devices 126A-N to access multiple controller devices 108A-N and perform multiple user actions on the controller devices 124 and the plant safety manager module 112.

[0036] The server 114 may include one or more servers on which an OS is installed. The server 114 may include one or more processors, one or more storage devices (such as memory units) for storing data and machine-readable instructions (such as applications and application programming interfaces (APIs)), and other peripheral devices required to provide computing (such as cloud computing) functions. In one example, the digital platform 110 may be implemented in the server 114. The digital platform 110 uses the hardware resources and OS of the server 114 to enable functions such as data reception, data processing, data rendering, data communication, etc., and delivers the aforementioned services using application programming interfaces deployed therein. The digital platform 110 may include a combination of dedicated hardware and software built on top of the hardware and OS. In an exemplary embodiment, the digital platform 110 may correspond to an integrated development environment (IDE) including a program editor and a compiler that allow users of multiple human-machine interfaces 120A-N to generate engineering programs. The digital platform 110 may further include a plant safety manager module 112, which is configured to implement management of the technical facility 106 during an error state of at least one controller device among the multiple controller devices 108A-N. Details of the plant safety manager module 112 are described in detail in the following. Figure 3 Explained in.

[0037] The database 118 stores information related to the technical facilities 106, the plurality of controller devices 108A-N, the plurality of field devices 126A-N, and the plurality of human-machine interfaces 120A-N. The database 118 is, for example, a structured query language (SQL) data store or a NoSQL data store. In an exemplary embodiment, the database 118 can be configured as a cloud-based database implemented in the industrial environment 100, where computing resources are delivered as a service through the platform 110. According to another embodiment of the present invention, the database 118 is a location on a file system that is directly accessible by the plant safety manager module 112.

[0038] In one example, the plant safety manager module 112 is implemented in a controller device 124 that is configured to manage the technical facility 106 during an error state that occurs in the first controller device 108A. The controller device 124 is communicatively coupled to a plurality of controller devices 108A-N, a plurality of field devices 126A-N, and the industrial control system 102. In one example, a user is enabled to write programming code in the controller device 124 using a plurality of human-machine interfaces 120A-N.

[0039] Figure 2 is an industrial control system 102 (such as Figure 1 In the block diagram (those shown in FIG), embodiments of the present invention may be implemented. Figure 2, the industrial control system 102 includes a processing unit 202 , an accessible memory 204 , a storage unit 206 , a communication interface 208 , an input-output unit 210 , a network interface 212 , and a bus 214 .

[0040] As used herein, processing unit 202 means any type of computing circuit, such as, but not limited to, a microprocessor unit, a microcontroller, a complex instruction set computing microprocessor unit, a reduced instruction set computing microprocessor unit, a very long instruction word microprocessor unit, an explicitly parallel instruction computing microprocessor unit, a graphics processing unit, a digital signal processing unit, or any other type of processing circuit. Processing unit 202 may also include an embedded controller, such as a general or programmable logic device or array, an application specific integrated circuit, a single chip computer, and the like.

[0041] The memory 204 may be a non-transitory volatile memory and a non-volatile memory. The memory 204 may be coupled for communication with the processing unit 202, such as as a computer-readable storage medium. The processing unit 202 may execute machine-readable instructions and / or source code stored in the memory 204. A variety of machine-readable instructions may be stored in the memory 204 and may be accessed from the memory 204. The memory 204 may include any suitable element for storing data and machine-readable instructions, such as a read-only memory, a random access memory, an erasable programmable read-only memory, an electrically erasable programmable read-only memory, a hard drive, a removable media drive for processing compact disks, digital video disks, floppy disks, cassettes, memory cards, and the like. In the present embodiment, the memory 204 includes an integrated development environment (IDE) 216. The IDE 216 includes the data acquisition and analysis module 112 stored in the form of machine-readable instructions on any of the above-mentioned storage media, and may communicate with and be executed by the processor (s) 202.

[0042] When executed by the processing unit 202, the plant safety manager module 112 causes the processing unit 202 to receive multiple program execution parameters from each of the multiple controller devices 108A-N in the technical facility. The multiple program execution parameters received from the controller device include information about the runtime execution of the engineering program in the controller device. For example, the multiple program execution parameters include runtime information, such as information about the memory fragmentation, scan cycle properties, system resource utilization, and memory utilization of the controller device during the execution of the engineering program in the controller device. The engineering program includes multiple programming blocks, each of which includes one or more programming instructions. In one example, the engineering program is a graphical program that includes program logic (such as an engineering program). The engineering program includes a set of programmable instructions or statements corresponding to the program logic. Each of the multiple programming blocks corresponds to a functional block under the engineering design of the technical facility 106.

[0043] When executed by the processing unit 202, the plant safety manager module 112 further causes the processing unit 202 to determine an error state in a first controller device 108A of the plurality of controller devices 108A-N. The error state is determined based on an analysis of the plurality of program execution parameters received. In the case where the first controller device 108A has stopped executing the engineering program, the first controller device 108A is determined to be in an error state. In one example, the processing unit 202 is configured to compare one or more of the plurality of program execution parameters received with one or more threshold values ​​stored in a memory such as the accessible memory 204. During the execution of the engineering program in the first programmable logic controller 108A, one or more program execution parameters are received from the first controller device 108A. In the case where one or more program execution parameters cross one or more threshold values, the first controller device 108A is determined to be in an error state. In another example, the processing unit 202 is configured to apply a pattern recognition machine learning model to one or more program execution parameters to determine an error state in the first controller device 108A. To train the pattern recognition machine learning model, historical data including a set of program execution parameters received from a plurality of controller devices during a specific time interval is analyzed by the processing unit 202. The processing unit 202 is further configured to identify a plurality of patterns in the set of program execution parameters based on the analysis. In addition, the processing unit 202 is further configured to identify a plurality of relationships between the set of program execution parameters and error states of one or more controller devices in the plurality of controller devices 108A-N. Thus, the pattern recognition machine learning model is configured to identify a plurality of patterns in the plurality of program execution parameters and determine that the first controller device 108A is in an error state. Examples of pattern recognition machine learning models include, but are not limited to, supervised learning models and unsupervised learning models.

[0044] When executed by the processing unit 202, the plant safety manager module 112 further causes the processing unit 202 to determine the fail-safe logic associated with the first controller device from the plurality of fail-safe logics based on the determination of the error state in the first controller device. In one example, each of the plurality of fail-safe logics has an identification number that indicates the controller device associated with the fail-safe logic. Therefore, the processing unit 202 is configured to determine the fail-safe logic based on the identification number of the fail-safe logic that matches the identification number of the first controller device. In one example, the plurality of fail-safe logics include a plurality of programming instructions that are configured to manage a plurality of field devices 126A-N in the technical facility 106. Each of the plurality of fail-safe logics is associated with a particular controller device in the plurality of controller devices 108A-N. The fail-safe logic associated with the first controller device 108A includes a set of programming instructions that are configured to manage one or more field devices (126A and 126B) controlled by the first programmed logic controller 108A. The fail-safe logic may be executed in any of the plurality of controller devices 108A-N to manage one or more field devices 126A and 126B.

[0045] When executed by the processing unit 202, the plant safety manager module 112 further causes the processing unit 202 to determine that a second controller device 108B among the plurality of controller devices 108A-N is not in an error state based on an analysis of the received plurality of program execution parameters. For example, in a case where one or more program execution parameters of the second controller device 108B do not cross one or more thresholds, then the second controller device 108B is determined to be not in an error state. In another example, the second controller device 108B is determined to be not in an error state by a pattern recognition machine learning model.

[0046] When executed by the processing unit 202, the plant safety manager module 112 further causes the processing unit 202 to transmit the fail-safe logic to the second controller device 108B based on the determination that the second controller device 108B is not in the error state. The processing unit 202 is configured to transmit the determined fail-safe logic to the second controller device 108B via the network 104.

[0047] When executed by the processing unit 202, the plant safety manager module 112 further causes the processing unit 202 to establish a connection path between the second controller device 108B and one or more field devices (126A and 126B) associated with the first controller device 108A. In one example, the processing unit 202 is configured to establish the connection path via the network 104.

[0048] When executed by the processing unit 202, the plant safety manager module 112 further causes the processing unit 202 to initiate execution of the fail-safe logic associated with the first controller device 108A in a second controller device 108B among the plurality of controller devices 108A-N. For example, the processing unit 202 is configured to transmit a request to the second controller device 108B via the network 104. The request is for initiating execution of the fail-safe logic in the second programmable controller 108B.

[0049] When executed by the processing unit 202, the plant safety manager module 112 further causes the processing unit 202 to stop execution of the engineering program by the first controller device 108A based on the determination of the error state of the first controller device 108A. In one example, the processing unit is configured to transmit a stop command to the first controller device 108A to stop the operation of the first controller device 108A. In one example, when the first controller device 108A is stopped, the first controller device 108A terminates execution of the engineering program.

[0050] When executed by the processing unit 202, the plant safety manager module 112 further causes the processing unit 202 to stop one or more field devices (126A and 126B) based on the determination of the error state in the first controller device 108A. In one example, when the one or more field devices (126A and 126B) are stopped, the functions of the one or more field devices (126A and 126B) are stopped. In addition, the processing unit 202 is further configured to notify the user that the first controller device 108A is in an error state. In addition, the user is enabled to resolve the error state of the first controller device 108A through a debugging engineering program.

[0051] When executed by the processing unit 202, the plant safety manager module 112 further causes the processing unit 202 to determine that the error state of the first controller device is resolved based on the analysis of the received plurality of program execution parameters. To determine that the error state is resolved, the processing unit 202 is configured to determine that the received plurality of program execution parameters are within a plurality of thresholds.

[0052] When executed by the processing unit 202, the plant safety manager module 112 further causes the processing unit 202 to resume runtime of the first controller device 108A based on a determination that the error state of the first controller device 108A is resolved. In the event that it is determined that the error state is resolved, the processing unit 202 is configured to transmit a trigger to the first controller device 108A to resume runtime execution of the engineering program.

[0053] When executed by the processing unit 202, the plant safety manager module 112 further causes the processing unit 202 to determine a count of the number of times the error state is determined in the first controller device 108A during the time interval. When executed by the processing unit 202, the plant safety manager module 112 further causes the processing unit 202 to notify a user via the plurality of human-machine interfaces 120A-N regarding the determined count of the number of times.

[0054] In one example, the plurality of program execution parameters include information about programming blocks of the engineering program executed at specific time intervals by the first controller device 108A. When executed by the processing unit 202, the plant safety manager module 112 further causes the processing unit 202 to determine programming blocks of the engineering program executed at specific time intervals by the first controller device 108A based on the analysis of the plurality of program execution parameters.

[0055] When executed by the processing unit 202, the plant safety manager module 112 further causes the processing unit 202 to determine whether an error condition has occurred in the first controller device 108A during execution of the determined programming block. When executed by the processing unit 202, the plant safety manager module 112 further causes the processing unit 202 to notify a user that an error condition has occurred in the first controller device during execution of the determined programming block by the first controller device 108A.

[0056] When executed by the processing unit 202, the plant safety manager module 112 further causes the processing unit 202 to execute processing logic to control one or more field devices 126A-B in the event that an error state is determined in the first programmable logic controller 108A. The processing logic includes a set of programming instructions configured to manage one or more field devices controlled by the first programmable logic controller. The processing logic is executable by the processing unit 202.

[0057] The communication interface 208 is configured to establish a communication session between the plurality of human-machine interfaces 120A-N, the industrial control system 102, and the controller device 124. The communication interface 208 allows one or more engineering applications running on the plurality of human-machine interfaces 120A-N to import / export engineering programs into the controller device 124. In an embodiment, the communication interface 208 interacts with interfaces at the plurality of human-machine interfaces 120A-N to allow an engineer to access engineering programs associated with an engineering project file and perform one or more actions on the engineering programs stored in the industrial control system 102.

[0058] The input-output unit 210 may include an input device (keyboard, touch-sensitive display, camera (such as a camera that receives gesture-based input), etc.) capable of receiving one or more input signals (such as user commands for processing engineering project files). In addition, the input-output unit 210 may be a display unit for displaying a graphical user interface that visualizes the behavioral model associated with the modified engineering program and also displays status information associated with each set of actions performed on the graphical user interface. The set of actions may include executing predefined tests, downloading, compiling, and deploying graphical programs. The bus 214 serves as an interconnection between the processor 202, the memory 204, and the input-output unit 210.

[0059] The network interface 212 may be configured to handle network connections, bandwidth, and network traffic between the industrial control system 102 , the plurality of human-machine interfaces 120A-N, and the technology facilities 106 .

[0060] Those of ordinary skill in the art will understand that Figure 2 The hardware depicted in the can vary for a particular implementation. For example, other peripheral devices (such as optical drives and the like), local area networks (LANs), wide area networks (WANs), wireless (e.g., Wi-Fi) adapters, graphics adapters, disk controllers, input / output (I / O) adapters can be used in addition to or in place of the hardware depicted. The depicted examples are provided for purposes of explanation only and are not meant to imply architectural limitations with respect to the present disclosure.

[0061] Those skilled in the art will recognize that, for simplicity and clarity, the complete structure and operation of all data processing systems applicable to use with the present disclosure are not depicted or described herein. Instead, only the industrial control system 102 that is unique to the present disclosure or necessary to understand the present disclosure is depicted and described. The remaining structure and operation of the industrial control system 102 can conform to any of the various current implementations and implementations known in the art.

[0062] Figure 3 is a plant safety manager module 112 (such as Figure 2 In the block diagram (those shown in FIG), embodiments of the present invention may be implemented. Figure 3 In the example, the plant safety manager module 112 includes a request processor module 302, a controller device selector module 304, an analysis module 306, a modifier module 308, an engineering object database 310, a verification module 312, and a deployment module 314. Figure 1 and Figure 2 explain Figure 3 .

[0063] The request processor module 302 is configured to receive a request for managing the technical facility 106. For example, the request is received from one of the one or more users external to the industrial environment 100 via a network. In an alternative embodiment, the request is received from one or more human-machine interfaces 120A-N via a network. The request processor module 302 is further configured to capture a plurality of program execution parameters transmitted by the plurality of controller devices 108A-N.

[0064] The controller device selector module 304 is configured to determine that the second controller device 108B executes the fail-safe logic associated with the first controller device.

[0065] The analysis module 306 is configured to analyze a plurality of program execution parameters to determine an error condition in the first controller device.

[0066] The modifier module 308 is configured to modify the fail-safe logic before transmitting the fail-safe logic to the second programmable logic controller 108B.

[0067] The engineering object database 310 is configured to generate an engineering object library that includes a plurality of fail-safe logics, information about the plurality of field devices 126A-N, and physical connections between the plurality of field devices 126A-N and the plurality of controller devices 108A-N.

[0068] The verification module 312 is configured to verify the engineering program executed by the plurality of controller devices 108A-N. The verification module 312 is configured to simulate the execution of the plurality of controller devices 108A-N.

[0069] The deployment module 314 is configured to deploy the fail-safe logic associated with the first controller device 108A to the second controller device 108B.

[0070] Figure 4A -E shows a process flow diagram illustrating an exemplary method 400 for managing a technical facility during an error state of a controller device according to an embodiment of the present invention. Figures 1 to 3 To explain Figure 4A -E.

[0071] At 402, the plant safety manager module 112 causes the processing unit 202 to receive a plurality of program execution parameters from each of a plurality of controller devices 108A-N in the technical facility. The plurality of program execution parameters received from the controller device include information about the runtime execution of the engineering program in the controller device. For example, the plurality of program execution parameters include runtime information, such as information about the memory fragmentation, scan cycle properties, system resource utilization, and memory utilization of the controller device during execution of the engineering program in the controller device. The engineering program includes a plurality of programming blocks, each of which includes one or more programming instructions. In one example, the engineering program is a graphical program including program logic. The engineering program includes a set of programmable instructions or statements corresponding to the program logic. Each of the plurality of programming blocks corresponds to a functional block under the engineering design of the technical facility 106.

[0072] At 404, the plant safety manager module 112 further causes the processing unit 202 to determine an error state in a first controller device 108A of the plurality of controller devices 108A-N. The error state is determined based on an analysis of the plurality of program execution parameters received. In the case where the first controller device 108A has stopped the execution of the engineering program, the first controller device 108A is determined to be in an error state. In one example, the processing unit 202 is configured to compare one or more of the plurality of program execution parameters received with one or more threshold values ​​stored in a memory such as an accessible memory 204. During the execution of the engineering program in the first programmable logic controller 108A, one or more program execution parameters are received from the first controller device 108A. In the case where one or more program execution parameters cross one or more threshold values, the first controller device 108A is determined to be in an error state. In another example, the processing unit 202 is configured to apply a pattern recognition machine learning model to one or more program execution parameters to determine the error state in the first controller device 108A. To train the pattern recognition machine learning model, historical data including a set of program execution parameters received from a plurality of controller devices during a specific time interval is analyzed by the processing unit 202. The processing unit 202 is further configured to identify a plurality of patterns in the set of program execution parameters based on the analysis. In addition, the processing unit 202 is further configured to identify a plurality of relationships between the set of program execution parameters and error states of one or more controller devices in the plurality of controller devices 108A-N. Thus, the pattern recognition machine learning model is configured to identify a plurality of patterns in the plurality of program execution parameters and determine that the first controller device 108A is in an error state. Examples of pattern recognition machine learning models include, but are not limited to, supervised learning models and unsupervised learning models.

[0073] At 406, the plant safety manager module 112 further causes the processing unit 202 to determine a fail-safe logic associated with the first controller device from a plurality of fail-safe logics based on the determination of the error state in the first controller device. In one example, each of the plurality of fail-safe logics has an identification number that indicates the controller device associated with the fail-safe logic. Therefore, the processing unit 202 is configured to determine the fail-safe logic based on the identification number of the fail-safe logic that matches the identification number of the first controller device. In one example, the plurality of fail-safe logics include a plurality of programming instructions that are configured to manage a plurality of field devices 126A-N in the technical facility 106. Each of the plurality of fail-safe logics is associated with a particular controller device in the plurality of controller devices 108A-N. The fail-safe logic associated with the first controller device 108A includes a set of programming instructions that are configured to manage one or more field devices (126A and 126B) controlled by the first programmed logic controller 108A. The fail-safe logic may be executed in any of the plurality of controller devices 108A-N to manage one or more field devices 126A and 126B.

[0074] At 408, the plant safety manager module 112 further causes the processing unit 202 to determine that the second controller device 108B is not in an error state based on the analysis of the received plurality of program execution parameters. For example, in a case where one or more program execution parameters of the second controller device 108B do not cross one or more thresholds, then the second controller device 108B is determined to be not in an error state. In another example, the second controller device 108B is determined to be not in an error state by a pattern recognition machine learning model.

[0075] At 410 , the plant safety manager module 112 further causes the processing unit 202 to transmit the fail-safe logic to the second controller device 108B based on the determination that the second controller device 108B is not in the error state. The processing unit 202 is configured to transmit the determined fail-safe logic to the second controller device 108B via the network 104 .

[0076] At 412 , the plant security manager module 112 further causes the processing unit 202 to establish a connection path between the second controller device 108B and one or more field devices ( 126A and 126B) associated with the first controller device 108A. In one example, the processing unit 202 is configured to establish the connection path via the network 104 .

[0077] At 414, the plant safety manager module 112 further causes the processing unit 202 to initiate execution of the fail-safe logic associated with the first controller device 108A in a second controller device 108B among the plurality of controller devices 108A-N. For example, the processing unit 202 is configured to transmit a request to the second controller device 108B via the network 104. The request is for initiating execution of the fail-safe logic in the second programmable controller 108B.

[0078] At 416, the plant safety manager module 112 further causes the processing unit 202 to stop the operation of the first controller device 108A based on the determination of the error state of the first controller device 108A. In one example, the processing unit is configured to transmit a stop command to the first controller device 108A to stop the operation of the first controller device 108A. In one example, when the first controller device 108A is stopped, the first controller device 108A terminates execution of the engineering program.

[0079] At 418, the plant safety manager module 112 further causes the processing unit 202 to stop one or more field devices (126A and 126B) based on the determination of the error state in the first controller device 108A. In one example, when the one or more field devices (126A and 126B) are stopped, the functions of the one or more field devices (126A and 126B) are stopped. In addition, the processing unit 202 is further configured to notify the user that the first controller device 108A is in an error state. In addition, the user is enabled to resolve the error state of the first controller device 108A through a debugging engineering program.

[0080] At 420, the plant safety manager module 112 further causes the processing unit 202 to determine that the error state of the first controller device is resolved based on the analysis of the received plurality of program execution parameters. To determine that the error state is resolved, the processing unit 202 is configured to determine that the received plurality of program execution parameters are within a plurality of thresholds.

[0081] At 422, the plant safety manager module 112 further causes the processing unit 202 to resume runtime of the first controller device 108A based on a determination that the error state of the first controller device 108A is resolved. In the event that it is determined that the error state is resolved, the processing unit 202 is configured to transmit a trigger to the first controller device 108A to resume runtime execution of the engineering program.

[0082] At 424, the plant safety manager module 112 further causes the processing unit 202 to determine a count of the number of times the error state was determined in the first controller device 108A during the time interval. At 426, the plant safety manager module 112 further causes the processing unit 202 to notify a user via the plurality of human-machine interfaces 120A-N regarding the determined count of the number of times.

[0083] In one example, the plurality of program execution parameters include information about programming blocks of the engineering program executed by the first controller device 108A at specific time intervals. At 428, the plant safety manager module 112 further causes the processing unit 202 to determine programming blocks of the engineering program executed by the first controller device 108A at specific time intervals based on the analysis of the plurality of program execution parameters.

[0084] At 430, the plant safety manager module 112 further causes the processing unit 202 to determine whether an error condition occurred in the first controller device 108A during execution of the determined programming block. At 432, the plant safety manager module 112 further causes the processing unit 202 to notify a user that an error condition occurred in the first controller device during execution of the determined programming block by the first controller device 108A.

[0085] At 434, the plant safety manager module 112 further causes the processing unit 202 to execute processing logic to control one or more field devices 126A-B in the event that an error state is determined in the first programmable logic controller 108A. The processing logic includes a set of programming instructions configured to manage one or more field devices controlled by the first programmable logic controller. The processing logic is executable by the processing unit 202.

[0086] The present invention may take the form of a computer program product, including program modules accessible from a computer-usable or computer-readable medium storing program code, for use by or in combination with one or more computers, processors, or instruction execution systems. For the purposes of this description, a computer-usable or computer-readable medium may be any device that can contain, store, transmit, propagate, or transfer a program for use by or in combination with an instruction execution system, device, or apparatus. The medium may be an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or device or apparatus) or a propagation medium itself, since signal carriers are not included in the definition of physical computer-readable media, including semiconductor or solid-state memory, magnetic tape, removable computer floppy disk, random access memory (RAM), read-only memory (ROM), hard disk, and optical disk, such as compact disk read-only memory (CD-ROM), compact disk read / write, and DVD. Both the processor and program code used to implement each aspect of the present technology may be centralized or distributed (or a combination thereof), as known to those skilled in the art.

[0087] Although the present invention has been described in detail with reference to certain embodiments, it will be understood that the present invention is not limited to those embodiments. In view of this disclosure, many modifications and variations will exist for those skilled in the art without departing from the scope of the various embodiments of the present invention as described herein. Therefore, the scope of the present invention is indicated by the following claims rather than by the foregoing description. All changes, modifications and variations within the meaning and scope of the equivalents of the claims are to be considered within their scope. All advantageous embodiments claimed in the method claims may also be applied to the system / device claims.

Claims

1. A method for managing a technical facility (106) during an error condition occurring in a controller device (108A) of the technical facility (106), the method comprising: Receiving, by a processing unit (202), a plurality of program execution parameters from each of a plurality of controller devices (108A-N) in a technical facility (106), wherein the plurality of program execution parameters associated with each controller device include runtime information of the controller device during runtime execution of an engineering program in the controller device; determining, by a processing unit (202), an error status in a first controller device (108A) of a plurality of controller devices (108A-N), wherein the error status is determined based on an analysis of a plurality of received program execution parameters; Determining, by the processing unit (202), a fail-safe logic associated with the first controller device (108A) from a plurality of fail-safe logics based on a determination of an error state in the first controller device (108A); as well as Execution of fail-safe logic associated with a first controller device (108A) is initiated, by a processing unit (202), in a second controller device (108B) of a plurality of controller devices (108-N).

2. The method of claim 1, wherein the technical installation further comprises one or more field devices (126A-B) controlled by the first controller device.

3. The method of claim 1 or 2, wherein initiating execution of the fail-safe logic in the second controller device (108B) by the processing unit (202) comprises: determining, by the processing unit (202) based on an analysis of the received program execution parameters, that the second controller device (108B) is not in an error state; transmitting, by the processing unit (202), fail-safe logic to the second controller device (108B) based on a determination that the second controller device is not in an error state; as well as A connection is established by a processing unit (202) between a second controller device (108B) and one or more field devices associated with the first controller device.

4. The method according to claims 1 to 3, further comprising stopping, by the processing unit (202), execution of the engineering program in the first controller device based on the determination of the error state of the first controller device (108A).

5. The method of claims 2 to 4, further comprising stopping, by the processing unit (202), execution of the first controller device (108A) based on the determination of the error state of the first controller device (108A).

6. The method according to claim 5, further comprising: deactivating, by the processing unit (202), one or more field devices (126A-B) based on a determination of an error condition in the first controller device (108A); determining, by the processing unit (202), that an error condition of the first controller device (108A) is resolved, wherein the resolution of the error condition is determined based on an analysis of the received plurality of program execution parameters; as well as The operation of the first controller device (108A) is resumed by the processing unit (202) based on a determination that the error state of the first controller device (108A) is resolved.

7. The method according to claims 1 to 6, further comprising: determining, by the processing unit (202), a count of the number of times an error state is determined in the first controller device 108A during a time interval; as well as The processing unit (202) notifies the user of the count of the determined number of times.

8. The method according to claims 1 to 7, further comprising: Determining, by the processing unit (202), programming blocks of an engineering program to be executed by the first controller device 108A based on an analysis of program execution parameters; determining, by a processing unit (202), whether an error condition is determined in a first controller device during execution of the determined programming block; as well as A user is notified by the processing unit (202) that an error condition was determined in the first controller device 108A during execution of the determined programming block by the first controller device 108A.

9. The method according to claims 1 to 8, further comprising: Processing logic is executed by the processing unit (202) to control one or more field devices (126A-B) when an error condition is determined in the first programmable logic controller 108A.

10. An industrial control system (102) for managing a technical facility during an error state in a controller device, wherein the industrial control system (102) comprises: Processing unit (202); as well as A memory (204) coupled to the processing unit (202), wherein the memory includes a plant safety manager module (112) stored in the form of machine-readable instructions executable by one or more processors, wherein the plant safety manager module (112) is capable of executing the method according to any one of claims 1-9.

11. An industrial environment (100), comprising: An industrial control system (102) as claimed in claim 10; A technical facility (106) comprising one or more physical components; and A plurality of human-machine interfaces (120A-N) are communicatively coupled to an industrial control system (102) via a network (104), wherein the industrial control system (102) is configured to perform the method according to any one of claims 1 to 9.

12. A computer program product having machine-readable instructions stored therein, which, when executed by a processing unit (202), cause the processor to perform the method according to any one of claims 1-9.

Images