Redundant switches for ethernet networks

Abstract

Embodiments of this disclosure relate to redundant switches for Ethernet networks. A redundant network switch for an Ethernet network includes: at least a first uplink port and a second uplink port connectable to the Ethernet network; a plurality of downlink ports connectable to an end device to provide connectivity to the Ethernet network; and at least a first switching component and a second switching component, the first switching component being at least connected to the first uplink port, the second switching component being at least connected to the second uplink port, each downlink port being connected to at least one of the first and second switching components, each of the first and second switching components being configured to: upon receiving an Ethernet frame from an uplink port or from a downlink port, forward the Ethernet frame to the uplink port or downlink port toward the destination of the Ethernet frame.

Description

Technical Field

[0001] This invention relates to a switch for Ethernet networks, particularly for use in industrial plants, which has internal redundancy to mitigate component failures. Background Technology

[0002] Industrial plants comprise multiple field devices. These field devices include, in particular, sensors that collect measurement data, and actuators that, instructed by controllers, exert certain physical effects on industrial processes. A distributed control system (DCS) has one or more controllers that take the measurement data from these sensors as input and then decide which setpoint value or other command to send to which actuator among these actuators.

[0003] This back-and-forth communication within an industrial plant requires a network through which sensors and actuators connect to one or more controllers. Previously, special types of networks for industrial purposes, such as 4-20mA current loops or HART, were used. Sensors and actuators were connected to the controller's I / O cards. The desire is to utilize standard Ethernet networks instead of these, as they offer several advantages. For example, Ethernet allows for much higher communication bandwidth, the use of standard IP-based communication protocols, and is therefore easier to integrate with IT applications. In Ethernet networks, end devices are typically connected to switches in a star topology. The switches are interconnected via a backbone network.

[0004] The disadvantage of Ethernet in a star topology is that the switches are single points of failure. Each end device connects to only one switch. If one switch fails, a large number of devices (e.g., 8, 16, 24, or even 32) immediately lose connectivity, rendering them unusable for process control. This can lead to critical process status or even safety risks. Summary of the Invention

[0005] Purpose of the invention

[0006] Therefore, the purpose of this invention is to improve the reliability of network switches in Ethernet networks, thereby reducing the possibility that all connected terminal devices will simultaneously and completely lose their connection in the event of a component failure in the switch.

[0007] This objective is achieved by a redundant network switch according to the first independent claim and a connection device according to the second independent claim for coordinating the connection between the redundant network switch and at least one terminal device. Other advantageous embodiments are detailed in the corresponding dependent claims.

[0008] Invention disclosure

[0009] This invention provides a redundant network switch for Ethernet networks. The redundant network switch has at least a first uplink port and a second uplink port that can be connected to the Ethernet network. Specifically, the Ethernet network can be a backbone network that interconnects multiple switches and also connects them to the outside world, such as a larger network in an industrial plant, or even the Internet. For example, the larger network may include a higher-level controller in a DCS that calculates setpoints for lower-level controllers or makes other control decisions to guide the operation of the industrial plant.

[0010] Redundant network switches have multiple downlink ports that can be connected to end devices to provide connectivity to an Ethernet network. These end devices may include sensors and / or actuators configured to physically interact with industrial processes performed in an industrial plant. Specifically, redundant network switches may have 8, 16, 24, or 32 downlink ports.

[0011] The redundant network switch includes at least a first switching component and a second switching component. The first switching component is connected at least to a first uplink port. The second switching component is connected at least to a second uplink port. Each downlink port is connected to at least one of the first or second switching components. Specifically, the first and second switching components can be implemented as first and second switching chips. Each of the first and second switching components is configured to, upon receiving an Ethernet frame from an uplink port or a downlink port, forward the Ethernet frame to the uplink port or downlink port toward the destination of the Ethernet frame. Specifically, as is common in Ethernet networks, the switching component can store in a MAC address table which destination (specified by its MAC address) is connected to which port.

[0012] In this way, the failure of any one component will no longer immediately affect all connected terminal devices. If a switching component fails, in the worst case, only the terminal devices connected to that switching component may lose connectivity. Furthermore, a terminal device can be connected to at least two downlink ports of a redundant network switch, that is, connected to one downlink port of the first switching component and one downlink port of the second switching component. If one switching component fails, the terminal device will still have connectivity via the other switching component. Terminal devices equipped with two Ethernet ports can support this redundancy scheme by connecting to different downlink ports of the corresponding switching components.

[0013] To support terminal devices with only one Ethernet port, this invention envisions a means of connecting the device and a process for coordinating the connection between a redundant network switch and at least one terminal device. This connecting device is also provided by this invention and will be described later.

[0014] By having the ability to provide at least one port per switching component to the Ethernet backbone, the new redundant network switches can support different network redundancy protocols, such as Media Redundancy Protocol (MRP), Parallel Redundancy Protocol (PRP), or High Availability Seamless Redundancy Protocol (HSR).

[0015] Alternatively, known mitigations for the availability issues of switches as single points of failure include deploying fully redundant networks (e.g., PRP protocols) or ring networks (e.g., MRP, HSR), as compared to, for example, IEC 62439-3. This requires more hardware redundancy than that included in the redundant Ethernet switches presented in this paper.

[0016] In a particularly advantageous embodiment, the redundant network switch also includes a redundant link interconnecting the first and second switching components. In this way, if one of the switching components loses its connectivity to the Ethernet backbone via its connected uplink port, it can forward traffic to its destination on the Ethernet network via the redundant link and another switching component. This covers, for example, a failure of the Ethernet transceiver associated with an uplink port.

[0017] A redundant link can be a network link that connects the ports of two switching components respectively. In such an embodiment, the redundant link can also transmit regular network traffic, for example, in a closed loop, such as an MRP ring between the first and second switching components, and also transmit proprietary messages between the switching components to manage redundancy. In another embodiment, the redundant link can be a dedicated electrical, optical, or RF connection that links the two switching components. A redundant link can also be implemented as a combination of a network link and a dedicated electrical, optical, or RF connection. In specific embodiments of the invention, to implement redundancy management functions and / or additional monitoring, diagnostic, and management functions, one or more MCUs or CPUs can be deployed in the redundant link, or one or more MCUs or CPUs can be deployed in parallel with the redundant link connected to the two switching components and optionally connected to a connection device.

[0018] That is, in another particularly advantageous embodiment, the redundant network switch further includes a management entity connected to both the first and second switching components. This management entity can implement redundancy management functions and / or additional monitoring, diagnostic, and management functions. For example, the management entity may be an Ethernet microcontroller (MCU) or a central processing unit (CPU). Specifically, the management entity can be configured to suppress duplicate forwarding of the same Ethernet frame by both the first and second switching components. The redundancy management algorithm implemented by the management entity at least ensures that telegrams received from redundant channels arriving at the first and second switching components are not duplicated on the backbone network, and that telegrams from the backbone network are sent only once to the connected terminal device (field device). The redundancy management algorithm can be implemented in a distributed manner on the switching chip, or optionally centrally in the MCU / CPU, or in a combination of the switching chip and the MCU / CPU.

[0019] In possible embodiments, the redundancy management algorithm is designed to influence the behavior of ports of the first and second switching components to avoid traffic duplication. A particular embodiment anticipates this configuration of creating collision domains for ports of the first and second switching components connected to the same connectivity device. In other example embodiments, the switch port configuration anticipates blocking forwarding in the uplink and / or downlink of one switching component based on the health status of other switching components. In another, more detailed example embodiment of the redundancy management algorithm, forwarding decisions are made based on a packet inspection mechanism to selectively block only certain types of messages. In a preferred embodiment of the redundancy management algorithm, port behavior is decided based on automatic detection of the type of connectivity device connected to the corresponding port. In a particular effective embodiment of the redundancy management algorithm, forwarding decisions are made on the uplink ports of the switching components.

[0020] In another particularly advantageous embodiment, at least a first downlink port connected to the first switching component and at least a second downlink port connected to the second switching component are arranged side-by-side. That is, the sockets corresponding to these downlink ports can be arranged side-by-side on the front panel, the back panel, or in another location designated for connecting terminal devices. In this way, redundant connections from the switch to the connecting device can be achieved by inserting a connecting device into the first and second downlink ports, which coordinates the connection between the redundant network switch and the terminal device. In particular, for connecting each terminal device, the user can be given the option to use a connecting device that is connected to only one downlink port of the redundant network switch, or a connecting device that is connected to both downlink ports of the redundant network switch. In conventional DCS, not all terminal devices are equally important to the functionality of the DCS as a whole. If a particular terminal device is less important to the functionality of the DCS as a whole, a non-redundant connection to the Ethernet network is sufficient. In this way, the total number of required downlink ports can be reduced, and associated costs can be saved. Modular design allows decisions to be made on a port-by-port basis regarding whether any particular end device should have a single or redundant connection to the Ethernet network, and optionally also how much voltage or power should be supplied to it.

[0021] In another particularly advantageous embodiment, the first and second switching components are housed in modules separable from the redundant network switch. The redundant network switch is configured to allow replacement of these modules during operation. In this way, in the event of a failure in one of the switching components, the redundant network switch can be restored to full functionality without temporarily shutting it down.

[0022] The present invention also provides a connection device for coordinating the connection between the aforementioned redundant network switch and at least one terminal device. The connection device includes at least one uplink port connectable to a downlink port of the redundant network switch, and at least one downlink port connectable to the at least one terminal device. The uplink ports do not need to conform to Ethernet standards. Instead, they can be an internal format understood only by the redundant Ethernet switch and the connection device.

[0023] Specifically, at least one terminal device may reside in an Ethernet network, which may optionally include other participants. Optionally, in a particularly advantageous embodiment, the connecting device may also be configured to deliver power from a redundant network switch to the terminal device via at least one downlink port.

[0024] This approach makes it easier to provide different end devices with varying power levels. Simply providing each end device with the maximum power it might require is not a solution if the end devices are in a potentially explosive environment. "Inherent safety" requirements dictate that there can only be a maximum voltage and / or a maximum power output on the end devices that is insufficient for ignition. That is, the power available under traditional "Power over Ethernet" standards is often too much for such hazardous areas and needs to be reduced through connectivity. A modular configuration with a redundant network switch and pluggable connectivity allows for flexible configuration of different end devices with varying power levels on top of different levels of redundant connectivity.

[0025] Optionally, the connection device can also provide surge protection toward the Ethernet network. That is, the connection device may include one or more components that are grounded and / or absorb any voltage surges from the Ethernet network to prevent these surges from reaching the end devices. Ethernet networks typically cover long distances across sites, making the Ethernet cabling susceptible to voltage surges, such as those caused by nearby lightning strikes. Another source of voltage surges is that Ethernet can interconnect different buildings at different ground potentials. For example, components grounded for voltage surges may include: a Z-diode that becomes conductive when a certain voltage is applied; or a gas discharge tube that short-circuits overvoltages. The component may also absorb the energy provided by the overvoltage in the sense that the overvoltage is destroyed after a sufficiently high voltage surge. In particular, having surge protection in the connection device is advantageous in this case because it can be easily replaced, and a failure in the connection device only affects a single end device.

[0026] The connection between the connecting device and the redundant network switch can be implemented, for example, as a media-independent interface such as MMI, RMII, or RGMII. In another example, the 10BASE-T1L PHY can be implemented at a port close to the switching component, so that the power module only needs to add power to the connection to the end device (field device). Depending on the most efficient implementation of the voting, routing, or coupling functions implemented on the redundant connection device, other internal interface technologies, such as SPI-based, are also possible.

[0027] In a particularly advantageous embodiment, the connection device includes at least two uplink ports that can be connected to the downlink ports of a redundant network switch. The connection device may also include decoupling elements that allow Ethernet frames to be passed from the uplink ports and / or forwarded to the downlink ports, and vice versa, without creating a direct electrical connection between the data contacts of the two uplink ports. Preferably, by inserting the connection device into the redundant network switch, at least two uplink ports of the connection device can be connected to corresponding downlink ports of the redundant network switch. In this way, redundant connectivity can be provided to the end device via the first and second switching components. That is, if one switching component fails, the end device still has connectivity via the other switching component. The absence of a direct electrical connection between the data contacts of the two uplink ports ensures that the failed switching component does not bring down the uplink ports of the other switching component. Alternatively, electrical isolation can also be implemented on the "switch side" of the internal interface.

[0028] In another particularly advantageous embodiment, the connection device further includes an Ethernet switch. At least two uplink ports and at least one downlink port of the connection device are connected to the ports of the Ethernet switch. In this way, the Ethernet switch of the connection device can be used as a decoupling element. A failure of something connected to one port will not prevent the operation of anything connected to other ports.

[0029] Connecting end devices via APL offers several advantages over traditional twisted-pair Ethernet, such as the ability to connect end devices using a single pair of wires and to bridge longer distances between redundant network switches and end devices.

[0030] In an advantageous embodiment, the connectivity device is also configured to output voltage and / or power from a redundant network switch to the terminal device via at least one downlink port. Thus, the connectivity device becomes a power module in a Power over Ethernet (PoE) setup.

[0031] In a possible embodiment within this context, the PHY chip (e.g., 10BASE-T1L PHY) may be implemented close to the port of the switching component, so that the connecting device only needs to add power to the connection to the end device.

[0032] In a particularly advantageous embodiment, at least one downlink port of the connecting device is an Ethernet Advanced Physical Layer (APL) port that meets the given requirements of inherent explosion safety. The requirement of "inherent safety" dictates that only a certain maximum voltage and / or a certain maximum electrical power is present on the end device that is insufficient for ignition. This limitation should be set in the hardware so that it is never exceeded under any circumstances. Depending on the required explosion-proof rating for different plant areas, the Ethernet API defines different port classes with different power levels. Different power levels can be implemented in different variants of the connecting device. Therefore, different connecting devices with different hardwired power limits are used on a single redundant network switch to connect different end devices in different areas of an industrial plant. Conventional APL switches have a fixed number of ports assigned to one or more port classes corresponding to different power consumption requirements and different explosion-proof ratings. For example, a switch with only 8 Class A ports cannot support Class B port devices. The same switch can have a fixed split between different port classes to allow some flexibility, such as a 4:4 ratio between port classes A and B. However, in practical applications, there are often far fewer ports in one particular port class than in a given port class. Using the redundant network switches and connectivity devices described in this article, connectivity devices can be easily swapped to new ports corresponding to different port categories, or upgraded to different port categories.

[0033] Alternatively, in another particularly advantageous embodiment, at least one downlink port is a single pair of Ethernet SPE ports. This port operates similarly to an APL port, the key difference being that the voltage and / or power supplied to the terminal device is negotiable between the terminal device and the connecting device. This is somewhat similar to USB-C power delivery, where a single power source can utilize 5 volts and 1 amp to power a smartphone, but also 20 volts and 6 amps to power a laptop. If the terminal device is in a potentially explosive environment, an SPE must not be used, as the limitation on lower power is not apparent in the hardware. However, for terminal devices not constrained by this requirement, having an SPE is very convenient. The modular combination of redundant network switches on one hand and connecting devices on the other allows for an arbitrary mix of terminal devices connected by APL at different fixed power levels and those connected by SPE at auto-negotiated power levels. This makes the overall network configuration more flexible and reduces manual configuration work.

[0034] If the terminal devices rely on the network through which they are powered, rather than having their own power supplies, the power supplies in the redundant network switch used to provide power to the terminal devices are another potential single point of failure. Even if, in principle, all terminal devices still have network connectivity, they could all fail simultaneously if their power is cut off. Therefore, the redundant network switch can contain at least two independent power supplies for powering the terminal devices. In another particularly advantageous embodiment, the connection device is configured to draw power evenly from at least two independent power supplies of the redundant network switch when all independent power supplies are operating normally. In the event of a failure of one or more independent power supplies, the connection device is configured to switch power draw to one or more independent power supplies that are still operating. In this way, the failure of one independent power supply will no longer cause all connected terminal devices to stop working. The power limits within the connection device and the power connections from the connection device to the terminal devices are still not redundant. However, if any of these components fails, this will only affect one terminal device at a time. In most DCS usage scenarios, the temporary unavailability of one terminal device is tolerable, while it is necessary to avoid too many terminal devices becoming unavailable.

[0035] In another particularly advantageous embodiment, the connecting device further includes a code indicating the type of the connecting device and / or the voltage and / or power that the connecting device can provide. In an advantageous embodiment, this code is designed to be set when a particular type of connecting device is first placed. After this setting, the connecting device can only be replaced with connecting devices of the same type, for example, to avoid replacing the connecting device with a variant that is incompatible with the power level of the connected terminal device.

[0036] In another particularly advantageous embodiment, the code can be read by the network switch machine. In this way, redundant network switches and any upstream network management can know the specific configuration of the connected devices attached to the network switch. This configuration is typically assembled manually according to explosion-proof requirements. This automatic reading of the configuration eliminates sources of error when maintaining a complete inventory of the Ethernet network. For example, the configuration can be uploaded to a systems engineering tool. The connection to such a systems engineering tool can be based on conventional Ethernet management protocols (e.g., SNMP), but can also be based on industrial communication protocols such as PROFINET, Ethernet IP, or OPC UA. In the case of using industrial communication protocols, redundancy schemes of such protocols can also be used, for example, through PROFINET R2 redundancy, to increase the availability of access to the management and diagnostic functions of the redundant network switches.

[0037] In another particularly advantageous embodiment, the circuitry configured to deliver power from a redundant network switch to the terminal device via at least one downlink port of the connection device is arranged in a module separable from at least one downlink port of the connection device. By further modularizing the connection device in this way, the power output of the connection device can be switched to another power level without having to separate the cabling (e.g., single-pair cabling) from the terminal device. Moreover, it is easier to replace the circuitry if it fails.

[0038] As mentioned above, the primary use case for redundant network switches and connectivity devices is in industrial plant DCS (Distributed Control Systems), where it is essential to avoid situations where too many terminal devices become unavailable simultaneously. Therefore, this invention also provides a distributed control system (DCS) for industrial plants. The industrial plant includes multiple sensors configured to capture measurement data and multiple actuators configured to perform physical actions on industrial processes executed within the plant. The DCS includes:

[0039] At least one controller is configured to receive measurement data from at least one sensor as input, generate a control command, and send the control command to at least one actuator to cause the brake to perform a physical action;

[0040] An Ethernet network configured to provide communication with the at least one controller to the at least one sensor and / or the at least one actuator; and

[0041] The aforementioned at least one redundant network switch connected to an Ethernet network, and the aforementioned at least one connection device connecting at least one sensor and / or at least one actuator to the redundant network switch.

[0042] As mentioned above, this configuration of the DCS ensures that any failure in the components will not cause too many sensors or actuators to disconnect simultaneously. Therefore, the DCS as a whole will remain functional. Attached Figure Description

[0043] The invention will be illustrated below with the help of accompanying drawings, but is not intended to limit the scope of the invention. The drawings show:

[0044] Figure 1 Exemplary embodiment of redundant network switch 2;

[0045] Figure 2 An exemplary embodiment of a connection device 9 assembled from multiple modules 9e;

[0046] Figure 3 Exemplary embodiment of a distributed control system 21 with redundant network switches 2. Detailed Implementation

[0047] Figure 1 An exemplary embodiment of a redundant network switch 2 is shown. The redundant network switch 2 has two uplink ports 3a and 3b that can be connected to an Ethernet network 1. A first switching component (switching chip) 6a is connected to the first uplink port 3a, and a second switching component (switching chip) 6b is connected to the second uplink port 3b. The first switching component 6a and the second switching component 6b are interconnected via a redundant link 7. Switching components 6a and 6b provide downlink ports 4a-4j. Downlink ports 4a-4j are connected to switching components 6a and 6b alternately: downlink ports 4a, 4c, 4e, 4g, and 4i are connected to the first switching component 6a, while downlink ports 4b, 4d, 4f, 4h, and 4j are connected to the second switching component 6b. Whenever one of the switching components 6a and 6b receives an Ethernet frame on any of its ports, it forwards the Ethernet frame to the port corresponding to the destination of the Ethernet frame according to, for example, a MAC address table.

[0048] Terminal devices 5a-5f are connected to downlink ports 4a-4j via connection devices 9 and 9'. Each connection device 9 is connected to two adjacent downlink ports 4a-4j (here: 4a, 4b; 4f, 4g; and 4i, 4j) of the redundant network switch 2, one of which is connected to the first switching component 6a, and the other is connected to the second switching component 6b. In this way, if the first switching component 6a or the second switching component 6b fails, the terminal devices connected to connection devices 9 (here: 5a, 5e, and 5f) will still have connectivity to the Ethernet network 1 via the corresponding other switching components 6a, 6b, and connection devices 9 are again connected to two downlink ports 4a-4j of the redundant network switch 2. Connection device 9' is connected to only a single downlink port 4a-4j (here: 4c; 4d; 4e) of the redundant network switch 2, and therefore only to one of the switching components 6a, 6b. The terminal devices (here: 5b, 5c, 5d) connected to these connection devices 9' lose connectivity to the Ethernet network 1 when the corresponding switching components 6a, 6b to which they are connected fail.

[0049] Switching components 6a and 6b are arranged in the corresponding hot-swappable module 6a. 6b In other words, if one of these switching components 6a and 6b fails, the redundant network switch 2 can quickly recover to a fully operational state.

[0050] Connection devices 9 and 9' have redundant functions. First, they can redundantly connect terminal devices 5a-5f to the two downlink ports 4a-4j of redundant network switch 2. Second, they can draw power from the two independent power supplies 10a and 10b of redundant network switch 2 and transfer that power to the correspondingly connected terminal devices 5a-5f. As previously mentioned, connection devices 9 and 9' can also coordinate power to meet explosion protection requirements in the case of Ethernet-APL, PoDL power level in the case of SPE, or any other given requirements.

[0051] exist Figure 1 The diagram illustrates how to construct the connection device 9 in a modular manner. The connection device 9 includes two uplink ports 9a and 9b and a downlink port 9c. Each uplink port 9a and 9b of the connection device 9 is connected to a downlink port 4a-4j of a redundant network switch 2. Figure 1 In the example shown, decoupling element 9d ensures that Ethernet frames can propagate between downlink ports 9c of connecting device 9 on the one hand, and between uplink ports 9a and 9b of connecting device 9 on the other hand, but there is no direct electrical connection between the data lines of uplink ports 9a and 9b. The uplink ports 9a and 9b of connecting device 9, which draw power from the power supplies 10a and 10b of redundant network switch 2, and the downlink ports 9c of connecting device 9, which forward power to the connected terminal devices 5a-5g, are implemented in a separate module 9e. This allows for easy replacement. For example, if it is desired to switch terminal devices from APL to SPE under less power constraints, or vice versa, module 9e with downlink port 9c can be replaced with a new module. Alternatively, decoupling element 9d can also be simply a passive terminal block, and decoupling can occur at another layer, for example, within module 9e itself. Furthermore, a connecting device combining two uplink ports 9a and 9b into downlink port 9c can be implemented monolithically without the modularity shown. The motivation for this could be driven, for example, by manufacturing costs.

[0052] Figure 2An example of the modular components of the connection device 9 is shown in more detail. Rack R can accept a module 9e having a downlink port 9c of the connection device 9, and a module 9e having uplink ports 9a and 9b of the connection device 9. When all modules 9e are inserted into a slot in rack R, the uplink port 9a of the connection device 9 is connected to a downlink port (e.g., 4a) of the redundant network switch 2, and the uplink port 9b of the connection device 9 is connected to an adjacent downlink port (e.g., 4b) of the redundant network switch 2. In this example, traffic between each uplink port 9a, 9b and downlink port 9c of the connection device 9 is forwarded by a decoupling element 9d (here, in module 9e, which also houses the downlink port 9c of the connection device 9). A terminal device (here, 5a) is connected to the downlink port 9c of the connection device 9.

[0053] Figure 3 An exemplary embodiment of a distributed control system 21 for an industrial plant is shown. The distributed control system 21 includes a control layer C, a backbone network 1, and extensions 1' of the backbone network 1 to sensors 22 and actuators 23 in the industrial plant as end devices 5a-5g. Figure 3 In the example shown, the control layer C includes a control room 25, a human-machine interface 26, and at least one controller 24, which receives measurement data 22a from the sensor 22 and sends setpoints and other control commands 23a to the actuator 23.

[0054] To enable this communication, terminal devices 5a-5g, 22, and 23 use two redundant network switches 2 and 2' of the type described above to connect to Ethernet network 1. Both uplink ports 3a and 3b of each redundant network switch 2 and 2' are connected to Ethernet network 1, such that these redundant network switches 2 and 2' form a ring with other devices according to the Media Redundancy Protocol (MRP). As described above, a decision can be made on a port-by-port basis whether any of the terminal devices 5a-5g connected to one of the redundant network switches 2 and 2' is:

[0055] It has a redundant connection to Ethernet network 1, and this redundant connection will remain intact even if the switching components 6a and 6b in the corresponding switches 2 and 2' fail, or

[0056] The operation of DCS21 is not critical; a non-redundant but more economical connection to Ethernet network 1 is sufficient.

[0057] As described above, the connection between terminal devices 5a-5g and ports 4a-4j of redundant network switches 2 and 2' is established via redundant connection device 9 or non-redundant connection device 9'.

[0058] List of reference numerals in the attached diagram:

[0059] 1: Ethernet network

[0060] 1': Ethernet network extension to terminal devices 5a-5g

[0061] 2, 2': Redundant network switch

[0062] 3a, 3b: Uplink ports of redundant network switch 2

[0063] 4a-4j: Downlink ports of redundant network switch 2

[0064] 5a-5g: Terminal devices connected to an Ethernet network 1

[0065] 6a, 6b: Switching elements (switching chips) of network switch 2

[0066] 6a 6b Modules that accommodate switching components 6a and 6b

[0067] 7: Redundant link between switching components 6a and 6b

[0068] 8: Management entity of redundant network switch 2

[0069] 9: Redundant connection devices

[0070] 9': Non-redundant connection device

[0071] 9a, 9b: Uplink ports connecting devices 9 and 9'

[0072] 9c: Downlink port connecting devices 9 and 9'

[0073] 9d: Decoupling element for connecting devices 9 and 9'

[0074] 9e: Module connecting devices 9 and 9'

[0075] 10a-10b: Redundant power supplies for redundant network switch 2

[0076] 21: Distributed Control System (DCS)

[0077] 22: Sensors in DCS 21

[0078] 22a: Measurement value from sensor 22

[0079] 23: Actuators in DCS 21

[0080] 23a: Control command to actuator 23

[0081] 24: Controller equipment

[0082] 25: Control Room

[0083] 26: Human-computer interface

[0084] C: Control layer of distributed control system 21

[0085] R: For racks connecting devices 9 and 9'

Claims

1. A redundant network switch (2) for an Ethernet network (1), comprising: At least a first uplink port (3a) and a second uplink port (3b) are available, and the first uplink port and the second uplink port are available to be connected to an Ethernet network (1). Multiple downlink ports (4a-4j), which can be connected to terminal devices (5a-5g) to provide connectivity to the Ethernet network (1) to the terminal devices (5a-5g); and At least a first switching component (6a) and a second switching component (6b), wherein the first switching component is at least connected to the first uplink port (3a), and the second switching component is at least connected to the second uplink port (3b), wherein each downlink port (4a-4j) is connected to at least one of the first switching component (6a) and the second switching component (6b). Each of the first switching component (6a) and the second switching component (6b) is configured to: upon receiving an Ethernet frame from an uplink port (3a, 3b) or a downlink port (4a-4j) or a destination port of the Ethernet frame, forward the Ethernet frame to the uplink port (3a, 3b) or the downlink port (4a-4j) or the destination port of the Ethernet frame.

2. The redundant network switch (2) of claim 1, further comprising: A redundant link (7) interconnects the first switching component (6a) and the second switching component (6b).

3. The redundant network switch (2) according to any of claims 1 to 2, further comprising: Management entity (8), which is connected to both the first switching component (6a) and the second switching component (6b).

4. The redundant network switch (2) according to claim 3, wherein the management entity (8) is configured to suppress repeated forwarding of the same Ethernet frame by both the first switching component (6a) and the second switching component (6b).

5. The redundant network switch (2) according to any one of claims 1 to 4, wherein at least a first downlink port (4a) connected to the first switching component (6a) and at least a second downlink port (4b) connected to the second switching component (6b) are arranged side by side.

6. The redundant network switch (2) according to any of claims 1 to 5, wherein the first switching component (6a) and the second switching component (6b) are mounted in modules (6a, 6b) detachable from the redundant network switch (2), and the redundant network switch (2) is configured to allow replacement of the modules (6a, 6b) during operation of the redundant network switch (2). ​​​​ 7. A connection device (9) for coordinating a connection between a redundant network switch (2) according to any one of claims 1 to 6 and at least one terminal device (5a-5g), the connection device comprising: At least one uplink port (9a, 9b), said at least one uplink port being connectable to a downlink port (4a-4j) of the redundant network switch (2); and At least one downlink port (9c), which can be connected to the at least one terminal device (5a-5g).

8. The connection device (9) according to claim 7 is further configured to: transmit power from the redundant network switch (2) to the terminal device (5a-5g) via the at least one downlink port (9c).

9. The connection device (9) according to any one of claims 7 to 8, comprising at least two uplink ports (9a, 9b) connectable to downlink ports (4a-4j) of the redundant network switch (2), and the connection device further comprising a decoupling element (9d) that allows Ethernet frames to be passed from the uplink ports (9a, 9b) and / or forwarded to the downlink ports (9c) and vice versa without creating a direct electrical connection between the data contacts of the two uplink ports (9a, 9b).

10. The connection device (9) according to claim 9, further comprising: An Ethernet switch serving as a decoupling element (9d) wherein at least two uplink ports (9a, 9b) and at least one downlink port (9c) of the connecting device (9) are connected to the ports of the Ethernet switch.

11. The connection device (9) according to any one of claims 7 to 10, wherein the at least one downlink port (9c) of the connection device (9) is an Ethernet Advanced Physical Layer (APL) port.

12. The connection device (9) according to claim 11 is further configured to output voltage and / or power that meet the given requirements for inherent explosion safety.

13. The connection device (9) according to any one of claims 7 to 10, wherein the at least one downlink port (9c) is a single pair of Ethernet SPE ports.

14. The connection device (9) according to claim 13 is further configured to: negotiate with the terminal device (5a-5g) the voltage and / or power to be provided to the terminal device (5a-5g).

15. The connection device (9) according to any one of claims 7 to 14 is further configured to: When all independent power supplies (10a, 10b) are operating normally, power is drawn evenly from at least two independent power supplies (10a, 10b) of the redundant network switch (2); and In the event of a failure of one or more independent power sources (10a, 10b), power draw will be switched to one or more independent power sources (10a, 10b) that are still in operation.

16. The connection device (9) according to any one of claims 7 to 15, further comprising encoding, said encoding: Indicates the type of the connecting device (9), and / or the voltage and / or power that the connecting device can provide, and / or The redundant network switch (2) is machine readable.

17. The connection device (9) according to any one of claims 7 to 16, wherein the circuitry configured to pass power from the redundant network switch (2) to the end device (5a-5g) via the at least one downlink port (9c) of the connection device (9) is arranged in a module (9c) detachable from the at least one downlink port (9c) of the connection device (9). ) 18. A distributed control system (DCS) (21) for an industrial plant (20), the industrial plant (20) including a plurality of sensors (22) configured to capture measurement data and a plurality of actuators (23) configured to apply physical actions to an industrial process performed on the industrial plant (20), the DCS (21) comprising: At least one controller (24) is configured to: receive the measurement data (22a) from at least one sensor (22) as input, generate a control command (23a), and send the control command (23a) to at least one actuator (23) to cause the actuator (23) to perform the physical action; An Ethernet network (1) configured to provide communication with the at least one controller (24) to the at least one sensor (22) and / or the at least one actuator (23); and At least one redundant network switch (2) according to any one of claims 1 to 6 and at least one connection device (9) according to any one of claims 7 to 17, the at least one redundant network switch is connected to the Ethernet network (1), and the at least one connection device connects the at least one sensor (22) and / or the at least one actuator (23) to the redundant network switch (2).

Images