Diagnostics for process control systems

Abstract

The embodiment of the invention relates to a diagnostic method for a process control system. The process control system is configured to communicate with at least one network device via a network. The process control system includes a first component and a second component. The method includes running a diagnosis on the network to determine whether a network fault causes the first component to be necessary for the second component to connect to the at least one network device.

Description

Technical Field

[0001] The present invention relates to a diagnostic system and method for a process control system. Background Art

[0002] In today's process control systems, redundant protocols are used where component roles are clearly defined as "primary" or "backup". It is acceptable to take a backup component out of operation without affecting the primary component. When the primary component is taken out of operation, the backup component becomes the new primary component and takes over the work. It is always safe to take a backup component out of operation to perform maintenance, reconfiguration, or upgrade. Summary of the Invention

[0003] As the topology of process control systems becomes more complex, a more intelligent and flexible method is desired for taking components out of operation in the presence of an active fault without compromising automation functionality. To better address one or more of these issues, in a first aspect of the present invention, there is provided a diagnostic method for a process control system, where the process control system is configured to communicate via a network with at least one network device, where the process control system includes a first component and a second component, and the method includes running a diagnosis on the network to determine whether a network fault makes the first component necessary for the second component to connect to at least one network device.

[0004] In this way, the diagnostic method can indicate whether it is safe to take the first component out of operation. By "safe" it is meant that the first component can be taken out of operation without including the ability of the second component to connect to at least one field network device, without loss of availability or processing functionality, or without compromising automation functionality considering an active network fault. While most high-availability systems tolerate one fault, a second fault can lead to a loss of availability. The described diagnostic method and system improve the indication of network faults in order to reduce the risk of adding a second fault, for example, during maintenance, etc.

[0005] In one example, the first component and the second component form a set of redundant components, where the first component is a backup component and the second component is a primary component, and where the backup component serves as a backup for the primary component. In another example, the first component and the second component form a set of single components sharing a common network.

[0006] The first component and the second component can be installed in the same mounting terminal unit (MTU) or different MTUs.

[0007] In one example, the diagnostics can be operable to classify each of a first component and a second component as having a status of "primary", "active backup", or "inactive backup". Other classifications can be used in addition to or instead of those listed herein. The primary component is the component that is actively used by the process control system to control the process. The active backup component is the component that becomes necessary for at least one primary component connected to at least one network device (such as a field device) due to a network failure. In contrast, the inactive backup component can be disconnected from the network without affecting the ability of at least one primary component to be connected to at least one network device, despite the network failure.

[0008] The diagnostics can be operable to make the above determination by performing a rule-based algorithm that depends on the network topology and / or protocol. In one example, the rule-based algorithm evaluates the network topology affected by the network failure with respect to one or more predefined topology rules of the implemented redundancy protocol. The first step can include determining the presence of the network failure. A first non-limiting example of a rule states that in the case of a ring topology with more than one controller and a network failure, it is not safe to take any controller out of operation. A second non-limiting example of a rule states that in the case of a redundant network having a first network connected to a first controller and a second network connected to a second controller and having a connectivity issue to any network device on one or both of the first controller and the second controller, only the controller having the connectivity issue can be safely taken out of operation. A third non-limiting example of a rule states that for a line topology, if an adjacent network element is a controller and uses more than one port, that controller is designated as active.

[0009] The term "component" as used herein can, for example, include or refer to any controller, switch, fieldbus communication module, MTU, or other component of an automation system that can be shared.

[0010] The diagnostic method can be executed by a part of the process control system, such as by one or more controllers of the process control system, or it can be executed by a separate or independent diagnostic system or module that communicates with the process control system. In any case, the method can be computer-implemented, as further described below.

[0011] The diagnostic method may further include outputting a notification after determining that the first component has been presented as being necessary and thus cannot be safely exited from operation. The notification may include the class or status assigned to the first component, namely, primary backup, active backup, or inactive backup. The notification may include a binary indication of whether the first component can be safely exited from operation. This may be displayed via any suitable user interface, such as the user interface of the first component itself, or via the UI of an engineering tool or an operating console. For example, an LED may be used to display the binary indication. For example, the LED may be labeled "Do not remove". The notification may be included in or included by an alarm or an event.

[0012] According to a second aspect, there is provided a controller for a process control system, the controller being configured to perform the diagnostic method of the first aspect.

[0013] According to a third aspect, there is provided a process control system configured to perform the diagnostic method of the first aspect.

[0014] According to a fourth aspect, there is provided an industrial automation system including the controller of the second aspect and / or the process control system of the third aspect.

[0015] The method of the first aspect may be computer-implemented. With necessary modifications, the optional features of the first aspect may form part of any one of the second to fourth aspects.

[0016] According to a fifth aspect, there is provided a computing system configured to perform the method of the first aspect.

[0017] According to a sixth aspect, there is provided a computer program (product) including instructions that, when executed by a computing system, enable or cause the computing system to perform the method of the first aspect.

[0018] According to a seventh aspect, there is provided a computer-readable (storage) medium including instructions that, when executed by a computing system, enable or cause the computing system to perform the method of the first aspect. The computer-readable medium may be transient or non-transient, volatile or non-volatile.

[0019] By running a diagnostic to determine whether a component can be safely exited from operation, as described herein, incorrect or unintentional disabling of the component can be prevented, which would otherwise interrupt communication to the process.

[0020] The diagnostics described herein enable high availability and can be used to drive down the mean time to repair (MTTR).

[0021] As used herein, the phrase "take a component out of operation" and the like may include, for example, removing the component physically, disconnecting the component, stopping the operation of the component, upgrading the component, reconfiguring the component, or otherwise degrading the functionality of the component for a period of time to remove the component.

[0022] A "(process) automation system" refers to an industrial or production device that includes one or more pipelines, production lines, and / or assembly lines for converting one or more isolates into products and / or for assembling one or more components into a final product.

[0023] As used herein, the term "network device" relates to, for example, any device that can be connected to a network, such as a network switch, a controller, a remote I / O, a field device, or an engineering tool.

[0024] As used herein, the term "obtain" may include, for example, receiving from another system, device, or process via interaction with a user; loading or retrieving from a storage or memory; measuring or capturing using a sensor or other data acquisition device.

[0025] As used herein, the term "determine" encompasses a variety of actions and may include, for example, calculating, computing, processing, deriving, investigating, looking up (e.g., looking up in a table, database, or another data structure), ascertaining, etc. Additionally, "determine" may include receiving (e.g., receiving information), accessing (e.g., accessing data in a memory), etc. Moreover, "determine" may include parsing, selecting, picking, establishing, etc.

[0026] The indefinite articles "a" or "an" do not exclude a plurality. Additionally, the articles "a" and "an" as used herein shall generally be construed to mean "one or more" unless otherwise stated or clearly indicated as the singular form from the context.

[0027] Unless otherwise stated or clearly apparent from the context, the phrases "one or more of A, B, and C", "at least one of A, B, and C", and "A, B, and / or C" as used herein are intended to represent all possible permutations of one or more of the listed items. That is, the phrase "A and / or B" means (A), (B), or (A and B), and the phrase "A, B, and / or C" means (A), (B), (C), (A and B), (A and C), (B and C), or (A, B, and C).

[0028] The term "comprise" does not exclude other elements or steps. Additionally, the terms "comprising", "including", "having", etc. may be used interchangeably herein.

[0029] The present invention may include one or more aspects, examples, or features, either alone or in combination, whether specifically disclosed in such combination or separately. Any optional feature or sub-aspect of one of the above aspects is suitably applied to any other aspect.

[0030] The above aspects will become apparent and be elucidated with reference to the detailed description provided hereinafter. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] A detailed description will now be given, by way of example only, with reference to the accompanying drawings, in which

[0032] Figures 1-3 a controller of a process control system is shown that is connected to field devices via a network presenting various different topologies to an automation system. DETAILED DESCRIPTION

[0033] Figures 1-3 A process control system 100 is shown for controlling an industrial process executed by an automation system (not shown). The process control system 100 includes a plurality of controllers 102-A, 102-B, 102-C, 102-D, collectively referred to as controllers 102, which are physically and communicatively coupled to each other via a mounting terminal unit (MTU) 110, commonly referred to as a backplane. The controllers 102 are configured to communicate with other components of the automation system, which are network devices such as field devices 114-A and 114-B, collectively referred to as field devices 114, or engineering tools as described herein. The engineering tools (commonly implemented as software packages) are used to create configuration data for the process control system 100, which can be downloaded to the controllers 102. For the purpose of such communication, the controllers 102 are equipped with Ethernet ports, as shown at 112, and associated communication interface circuitry. Each of the controllers 102 also includes its own network switch. The mounting terminal unit 110 may also include circuitry (not shown) for powering the controllers 102 and / or for accommodating a power module.

[0034] Each of the controllers 102 is configured to control a respective process performed by an automation system (not shown). The process control system 100 can be applied to any industrial field that requires process automation, such as energy, oil and gas, chemicals, petrochemicals, etc. The controller 102 processes process control and monitoring of the automation system by receiving input signals from sensors and instruments and outputting control signals for controlling plant equipment such as pumps, valves, conveyor belts, mixers, and heaters. Any such sensor, instrument, or plant equipment can form part of one or more field devices 114. The controller 102 is configured to execute a process control application to generate a control signal based on the input signal. Each control application can include control logic that instructs the respective controller how to respond to all input signals with appropriate control signals to maintain normal operation of the process. In one non-limiting example, the control application complies with the international standard IEC 61131. Each of the controllers 102 includes logic circuitry configured to execute the respective control application. The logic circuitry can include a CPU, MCU, SoC, FPGA, DSP, and / or an AI engine, as well as any memory used in signal processing. The logic circuitry can also be configured to execute any one or more of the other operations described herein.

[0035] The present inventors have recognized that in such a process control system 100 that includes various network devices (such as switches), it is useful to indicate whether it is "safe" to take a component out of operation. Even if one of the controllers 102 can act as a backup, its presence may be necessary for the controller 102 that acts as the primary for accessing other network devices, such that taking the backup controller out of operation is not safe. A typical usage scenario is an open network loop where some field devices are connected only via the primary controller, while other field devices are connected only via the backup controller.

[0036] To this end, a diagnostic method for a process control system is provided, which includes running a diagnosis on the network to determine whether a network failure makes a backup component necessary for a primary component to connect to a field device. Specifically, the diagnosis labels the components as having a status of "(active) primary", "active backup", or "inactive backup". Taking an "active" component (active primary or active backup) out of operation always has a harmful effect on the system 100 (e.g., via loss of fieldbus capacity), and depending on the nature of the network failure, may result in a loss of process control.

[0037] Any of the controllers 102 can run the diagnosis, regardless of whether the controller is a "single" component or the "primary" or "backup" in a redundant pair.

[0038] In the first stage, diagnostics are run on the network to determine if a network fault exists. The test run depends on the network topology and redundancy protocol being used. In various non-limiting embodiments:

[0039] - For a ring topology with Media Redundancy Protocol (MRP), MRP test frames are used to evaluate the state of the ring. If the ring is not intact, a network fault is determined to exist.

[0040] - For a ring topology with High-Availability Seamless Redundancy (HSR), HSR monitoring frames are used to evaluate the state of the ring. Again, a damaged ring indicates a network fault exists.

[0041] - For a stand-alone redundant network with Parallel Redundancy Protocol (PRP), the monitoring frames of both networks are evaluated to determine if both are available. An unavailable network indicates a network fault exists.

[0042] - For a line topology, the Link Layer Discovery Protocol (LLDP) is used to evaluate adjacent network elements. Unavailability of an adjacent element indicates the presence of a network fault.

[0043] The state of the network is evaluated against predefined topology rules to determine if a component can be safely taken out of operation. In various non-limiting embodiments:

[0044] - In the case of a ring topology with more than one controller and a network fault, it is not safe to take any controller out of operation (discussed further below with reference to Figure 1 ). This rule can be applied independent of the ring protocol.

[0045] - In the case of a redundant network with a first network connected to a first controller 102 and a second network connected to a second controller 102 having connectivity issues to any field device 114 on one or both of the controllers 102, only the controller with the connectivity issue can be safely taken out of operation (discussed further below with reference to Figure 2 ).

[0046] - For a line topology, if the adjacent network element is a controller and more than one port is used, the controller is designated as active (discussed further below with reference to Figure 3 ).

[0047] After applying the topology rules, classifications can be assigned to represent the current state of the controllers, taking into account the current network fault. In the non-limiting examples described here, a controller can be designated as "active master", "active backup", or "inactive backup". Taking an "active" component out of operation always has an adverse effect on the system 100 and, depending on the nature of the network fault, can result in a loss of process control.

[0048] Figure 1 FIG. 1 shows a process control system 100 using a network 116 that presents a ring topology to connect to two field devices 114. A network failure 118 causes a disconnection between field device 114-A and field device 114-B. In this case, the controller 102-A acting as the master can still communicate with field device 114-A, but can only communicate with field device 114-B via the controller 102-B acting as the backup. Thus, taking the controller 102-B out of operation will compromise the system. In this case, the controller 102-A can be designated as "master", and the controller 102-B can be designated as "active backup".

[0049] Figure 2 FIG. 2 shows that the controller 102-A is connected to two field devices 114 using a primary network 216, while the controller 102-B uses a redundant network 220 for the same purpose. A network failure 118 compromises the ability of the controller 102-B to connect to the field device 114-B. If the controller 102-B was initially the master, the controller 102-A that becomes the master due to the network failure cannot be safely taken out of operation. If the controller 102-A was initially the master, the controller 102-B can be safely taken out of operation as an inactive backup.

[0050] Figure 3 FIG. 3 shows the controllers 102-A and 102-B connected to field devices 114-A and 114-B via a network 316 that presents a line topology. In this case, it is clear that the controller 102-A cannot be taken out of operation without compromising the ability of the controller 102-B to communicate with the field device 114, that is, it cannot be "safely" taken out of operation.

[0051] Indicate to the user in the HMI the status of the controller 102 determined using the method described herein. This can be an alarm, an event in a list, a status in the UI, or simply an LED. Based on this indication, the user can easily judge whether it is safe to take a component out of operation, or whether doing so will result in a loss of process control.

[0052] To understand the scenario that caused a component to become active, the user can connect a tool (such as the engineering tool mentioned here) and read out further information. This can then be used to determine what must be fixed before the component can be safely taken out of operation.

[0053] It should be understood that although the specific examples described herein relate to Ethernet-based fieldbuses and their associated network topologies and / or redundancy protocols, the method and system are equally applicable to non-Ethernet-based fieldbuses.

[0054] Any unit, module, circuit system, or method described herein may be implemented using hardware, software, and / or firmware configured to perform any of the operations described herein. The hardware may include one or more processor cores, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system on a chip systems (SOCs), complex programmable logic devices (CPLDs), etc. The software may be implemented as a software package, code, instructions, instruction sets, and / or data recorded on at least one transient or non-transient computer-readable storage medium. The firmware may be implemented as code, instructions, or instruction sets and / or hard-coded data in a memory device (e.g., a non-volatile memory device).

[0055] If implemented in software, the functions may be stored or transmitted as one or more instructions or code on a computer-readable medium. The computer-readable medium includes computer-readable storage media. The computer-readable storage media may be any available storage media accessible by a computer. By way of example and not limitation, such computer-readable storage media may include flash storage media, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and that can be accessed by a computer. Disk and optical disks as used herein include compact disks (CDs), laser disks, optical disks, digital versatile disks (DVDs), floppy disks, and Blu-ray disks (BDs), where disks typically reproduce data magnetically, while optical disks typically reproduce data optically with a laser. Additionally, propagated signals may be included within the scope of computer-readable storage media. The computer-readable medium also includes communication media that includes any medium that facilitates transfer of a computer program from one place to another. For example, a connection may be a communication medium. By way of example, if software is transferred from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technology such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technology such as infrared, radio, and microwave are included in the definition of communication medium. Combinations of the above should also be included within the scope of computer-readable media.

[0056] The applicant hereby discloses each individual feature described herein and any combination of two or more such features in isolation, to the extent that such features or combinations are capable of being implemented by a person skilled in the art based on the common general knowledge of the entire specification, regardless of whether such features or combinations of features solve any of the problems disclosed herein, and without limitation to the scope of the claims. The applicant points out that aspects of the present invention may include any such individual feature or combination of features.

[0057] It should be noted that the embodiments of the present invention are described with reference to different categories. In particular, some examples are described with reference to methods, while other examples are described with reference to devices. However, those skilled in the art will conclude from the specification that any combination between features belonging to different categories is also considered to be disclosed by the present application, unless otherwise stated, in addition to any combination of features belonging to one category. However, all features can be combined to provide more synergistic effects than a simple summation of the features.

[0058] Although the present invention has been described in detail and illustrated in the accompanying drawings and the foregoing description, such description and illustration should be considered exemplary rather than restrictive. The present invention is not limited to the disclosed embodiments. By studying the drawings, the disclosure, and the appended claims, those skilled in the art can understand and implement other variations of the disclosed embodiments.

[0059] The fact that certain measures are recited in mutually different dependent claims does not mean that a combination of these measures cannot be used advantageously.

[0060] Any reference signs in the claims should not be construed as limiting the scope.

Claims

1. A diagnostic method for a process control system, wherein the process control system is configured to communicate with at least one network device via a network, and wherein the process control system includes a first component and a second component, the method comprising running a diagnosis on the network to determine whether a network failure renders the first component necessary for the second component to connect to the at least one network device.

2. The method according to claim 1, wherein the diagnosis is operative to classify each of the first component and the second component as having a "primary", "active backup", or "inactive backup" status.

3. The method according to claim 1 or 2, wherein the diagnosis is operative to make the determination by executing a rule-based algorithm that depends on the network topology and / or redundancy protocol in use.

4. The method according to claim 3, wherein the rule-based algorithm evaluates the network topology affected by the network failure against one or more predefined topology rules for the redundancy protocol being implemented.

5. The method according to claim 3 or 4, comprising first determining the presence of the network failure.

6. The method according to any one of claims 3 to 5, wherein the rule states that in the case of a ring topology with more than one controller and a network failure, it is unsafe to take any controller out of operation.

7. The method according to any one of claims 3 to 6, wherein the rule states that in the case of a redundant network where a first network is connected to a first controller and a second network is connected to a second controller and there is a connectivity problem to any network device on one or both of the first controller and the second controller, only the controller with the connectivity problem can be safely taken out of operation.

8. The method according to any one of claims 3 to 7, wherein the rule states that for a line topology, if adjacent network elements are controllers and more than one port is in use, it is unsafe to take the controller out of operation.

9. The method according to any one of the preceding claims further comprises: After determining that the first component has been rendered necessary and thus cannot be safely taken out of operation, output a notification.

10. The method according to claim 9, further comprising displaying the notification on a user interface.

11. A controller for a process control system, the controller being configured to execute the method according to any one of claims 1 to 10.

12. A process control system, configured to execute the diagnostic method according to any one of claims 1 to 10.

13. An industrial automation system, comprising the controller according to claim 11 and / or the process control system according to claim 12.

14. A computer-readable medium comprising instructions that, when executed by a computing system, cause the computing system to execute the method according to any one of claims 1 to 10.

Images