Partitioning and redundant control in process control systems

Abstract

A process control system is configured to confirm the presence of a primary control application by a backup control application via a common I / O subsystem in an automation control platform in order to prevent a "double master" condition. The I / O subsystem receives request messages generated by the backup control application and broadcasts them onto the network. In addition, the primary control application receives the request messages and provides responses back to the backup control application via the I / O subsystem. The rebroadcasting of these messages by the I / O subsystem can be used to prevent control systems including controllers and / or workloads located in different controller platforms from being partitioned from each other due to a failure in a communication network link that provides data and state communication between the different controller platforms.

Description

Technical Field

[0001] This disclosure generally relates to the operation of process control systems. More specifically, it relates to the control segmentation and redundancy characteristics of networked process control systems. Background Technology

[0002] Industrial process control and automation systems are frequently used to automate large and complex industrial processes. In the deployment of conventional networked control systems, the entity that hosts the control functions and is responsible for related control calculations (such as proportional-integral-derivative (PID) control calculations) is typically an embedded computer device / platform, often described as a process “controller.” Each controller includes computing hardware, which typically includes at least one processor or other computing devices with associated memory, such as for an embedded controller. The term “controller platform” as used herein includes a single controller or, in the case of redundant controllers, a pair of controllers, where the controller platform hosts the control solver application in its memory.

[0003] Each "controller platform" communicates at a higher level with at least one server via a factory-level network, and at a lower level, typically via an I / O network, then with I / O devices, and then with sensors and actuators that control a portion of the processing equipment in the factory. To ensure high-level control system availability, controllers in networked control systems are typically deployed in schemes that provide hardware redundancy. Specifically, two controller platforms are deployed to perform the work of one controller platform, or more specifically, a "primary" controller actively performing control tasks and a "standby" controller in standby mode, ready to take over control tasks in the event of a failure of the primary controller. Thus, traditional high-availability control system redundancy uses a primary controller and a standby controller for each controller platform, which in the simplest non-redundant control system case consists of a single controller. When the redundant controller fails in the case of the primary controller in the controller platform, the standby controller continues to perform non-redundant operation until the primary controller is repaired or replaced to restore controller redundancy in the controller platform. Typically, control solver applications are deployed at a ratio of 1.1 to controller platforms. This means that each controller platform (whether redundant or not) always hosts only one control solver application.

[0004] In the deployments explained above, the backup controller can take over in the event of a primary controller failure only if it is fully synchronized with the primary controller. If the primary controller fails while unsynchronized or only partially synchronized, the backup controller typically does not take over. In some controller deployments, a memory retention system utilizing non-volatile memory or random access memory (RAM) is used, which is retained by the primary controller when the control solver application is restored. However, if hardware failure occurs and modules are replaced, user intervention is required to restore the configuration.

[0005] In some controller deployments, controller platforms are coupled to each other via a private path redundancy network providing a controller pool. Each controller platform has at least one controller, including computing hardware and memory. The control solver application pool comprises multiple control solver applications, where controller platforms are coupled to input / output devices coupled to field devices, such as the EXPERION series sold by Honeywell International. ® Highly integrated virtual environment (HIVE) control system technology. Within an HIVE controller deployment, the loss of an out-of-sync or non-redundant master control application requires user intervention to restore the control solver application configuration and state. Summary of the Invention

[0006] As used herein, industrial process facilities include field equipment and handling apparatus that operate industrial processes involving tangible materials to which the disclosed embodiments are applicable. Examples include oil and gas, chemicals, beverages, pharmaceuticals, pulp and paper, petroleum processes, electrical, and water. Industrial process facilities differ from data processing systems that merely perform data manipulation. Embodiments as described in this disclosure include systems, apparatus, methods, and techniques for providing redundant and segmented control in process control systems.

[0007] A non-limiting example embodiment includes a method for performing process control operations in a process control system, the method comprising: receiving data at input / output component nodes of the process control system indicating a set of operating states of a first group of control component nodes; rebroadcasting the data indicating the set of operating states of the first group of control component nodes from the input / output control component nodes and through a communication link coupled to the input / output control component nodes to a second group of control component nodes; receiving the data indicating the set of operating states of the first group of control component nodes at the second group of control component nodes; and determining the operating state of each control component node in the first group of control component nodes at the second group of control component nodes based on the received data indicating the operating state of each control component node in the first group of control component nodes.

[0008] Alternatively or additionally, an example implementation of the method includes: wherein the second group of control component nodes is separated from the first group of control component nodes such that any broadcasts made by the first group of control component nodes are not directly transmitted to the second group of control component nodes.

[0009] Alternatively or additionally, an example embodiment of the method includes: wherein at least one control component node in the second set of control component nodes operates as a backup processing node for at least one workload to be processed by one or more controllers included in the first set of control component nodes.

[0010] Alternatively or additionally, an example implementation of the method includes: wherein rebroadcasting of data indicating the operational status set of the first set of control nodes includes providing rebroadcasting within a time period less than a timeout threshold period allowed before a non-responsive control component node is considered inactive.

[0011] Alternatively or additionally, an example embodiment of the method includes: wherein a first set of control component nodes is coupled to a first set of one or more network switches, and a second set of control component nodes is coupled to a second set of one or more network switches that are different from and separate from the one or more network switches in the first set of switches.

[0012] Alternatively or additionally, an example embodiment of the method includes: a first set of one or more switches communicatively coupled to an input / output component node via a first communication link, and a second set of one or more network switches communicatively coupled to the input / output component node via a second communication link that is different from and separate from the first communication link.

[0013] Alternatively or additionally, example embodiments of the method further include: using input / output control component nodes to interface with the multiple sensors and control the operation of the multiple actuators when the operation of one or more processing units included in the multiple sensors and multiple actuators control the process control system.

[0014] A non-limiting example embodiment includes a method for performing process control operations in a process control system, the method comprising: receiving at an input / output component node of the process control system a first address request message issued by a first control component node of the process control system, wherein the first address request message is directed to a second control component node of the process control system and includes a request for information regarding the operational status of the second control component node; in response to receiving the first address request message, rebroadcasting the first address request message from the input / output component node to the second control component node as a first indirect address request message; receiving at the input / output component node a response returned from the second control component node in response to the first indirect address request message; and in response to receiving the response returned from the second control component node, outputting from the input / output component node an indirect address response directed to the first control component node, the indirect address response including an indication of the operational status of the second control component node.

[0015] Alternatively or additionally, an example implementation of the method includes: wherein the second control component node operates as an auxiliary and backup control processor for the first control component node.

[0016] Alternatively or additionally, an example embodiment of the method includes: wherein the response returned from the second control component node includes an indication of the operational status of the second control component node, indicating that the second control component node is online and operating normally.

[0017] Alternatively or additionally, an example embodiment of the method includes: wherein a response returned from the second control component node includes an indication of whether the second control component node is offline or faulty, and wherein an indirect address response directed to the first control component node includes an indication of whether the second control component node is offline or faulty.

[0018] Alternatively or additionally, example embodiments of the method further include: in response to receiving an indication at the first control component node that the second control component node is offline or has failed, performing a switch, the switch including the first control component node assuming the role of the master controller, and initiating the execution of workloads previously handled by the second control component node when the second control component node operates as the original master controller.

[0019] Alternatively or additionally, an example implementation of the method further includes: while rebroadcasting the first indirect address request message to the second control component node, starting a response timer with a response timer threshold, wherein the response timer threshold represents a time limit set by the input / output component node for receiving a response returned from the second control component node.

[0020] Alternatively or additionally, example embodiments of the method further include: using an input / output control component node to interface with multiple sensors and control the operation of multiple actuators when multiple sensors and multiple actuators control the operation of one or more processing units included in the process control system.

[0021] Non-limiting example embodiments include a process control system comprising: a plurality of process controllers communicatively coupled together via an input / output control element, the input / output control element including one or more input / output controllers configured to control operation associated with input sensors and output actuators included as part of the process control system; and an input / output control element configured to: receive messages broadcast from the plurality of process controllers, each message including data indicating the operating state of a particular process controller that issued the message; and rebroadcast the received messages via one or more communication links configured to communicatively couple the input / output control element to the plurality of process controllers.

[0022] Alternatively or additionally, an example embodiment of the process control system includes: wherein at least one of the messages configured to be broadcast from a plurality of process controllers and received at an input / output control element includes an address request message, the address request message being configured to be issued by a first process controller of the plurality of process controllers and directed to a second process controller of the plurality of process controllers, wherein the second process controller of the plurality of process controllers is configured as an auxiliary and backup process controller to the first process controller of the plurality of process controllers.

[0023] Alternatively or additionally, an example embodiment of the process control system includes: wherein, in response to receiving at least one message including an address request message, the input / output control element is further configured to: use an indirect address request to directly communicate the address request message to a second process controller among a plurality of process controllers; receive an address response returned from the second process controller among the plurality of process controllers as a response to the indirect address request; and, upon receiving the address response returned from the second process controller among the plurality of process controllers, communicate the indirect address response to a first process controller among the plurality of process controllers, the indirect address response indicating the information provided in the address response received from the second process controller among the plurality of process controllers.

[0024] Alternatively or additionally, an example embodiment of the process control system includes: wherein an address response sent back from a second process controller among a plurality of process controllers includes information indicating the operating status of the second process controller among the plurality of process controllers.

[0025] Alternatively or additionally, an example embodiment of the process control system includes: a first set of control element nodes of a plurality of controllers coupled to a first set of one or more network switches, and a second set of control element nodes of a plurality of controllers coupled to a second set of one or more network switches that are different from and separate from the one or more network switches in the first set of switches, and wherein the first set of one or more switches is communicatively coupled to an input / output control element via a first communication link, and the second set of one or more network switches is communicatively coupled to the input / output control element via a second communication link that is different from and separate from the first communication link.

[0026] Alternatively or additionally, example embodiments of the process control system include input / output components that are also configured to: use input / output control component nodes to interface with multiple sensors and control the operation of multiple actuators when multiple sensors and multiple actuators control the operation of one or more processing equipment included in the process control system. Attached Figure Description

[0027] To gain a more complete understanding of this disclosure, reference is now made to the following description in conjunction with the accompanying drawings. The figures discussed below, and the various embodiments used to illustrate the principles of the invention in this patent document, are merely illustrative and should not be construed as limiting the scope of the invention in any way. Those skilled in the art will understand that the principles of the invention can be implemented in any suitably arranged device or system.

[0028] Figure 1 It is a schematic block diagram of at least a portion of a process control system for an industrial process facility, according to various implementation schemes.

[0029] Figure 2A A schematic block diagram illustrating a portion of a process control system according to various implementation schemes is shown.

[0030] Figure 2B Examples are given based on various implementation schemes. Figure 2A A schematic block diagram illustrating a modified version of a part of a process control system.

[0031] Figure 2C Examples are given based on various implementation schemes. Figure 2B A schematic block diagram of another modified version of a part of the process control system illustrated in the figure.

[0032] Figure 3AA diagram illustrating the communication between control solver workloads according to various implementation schemes is provided.

[0033] Figure 3B Examples of various implementation schemes are shown above relative to... Figure 3A A diagram illustrating the modified configuration for the described workload processing.

[0034] Figure 4A Flowcharts illustrating methods for operating a process control system according to various implementation schemes are provided.

[0035] Figure 4B Flowcharts illustrating methods for operating a process control system according to various implementation schemes are provided.

[0036] Figure 5 Block diagrams illustrating example computer systems according to various implementation schemes are shown. Detailed Implementation

[0037] Modern process control systems (such as those used in industrial plants) comprise hundreds or even thousands of individual embedded controllers networked together to form a control network or platform for providing control over the equipment included in the process control system. These process control systems, with their large number of embedded controllers, run thousands of tasks and algorithms to provide normal control and operation of the equipment included in the system. Tasks performed by the system include, but are not limited to, interfacing with input / output (I / O) sensors, data acquisition and computation, and providing control over actuators included as part of the system's field devices. Control units (also known as "control solver workloads" or simply "workloads") are provided within the system to execute tasks and algorithms for the operating system and to collect data related to the system's operation, such as quality control and production information. Each workload is configured with a set of parameters for operation within the embedded system, including parameters related to which controller(s) will execute the workload, and, for example, the workload's execution frequency, such as when the task requiring the workload needs to be executed continuously or, for example, when it needs to be executed iteratively but intermittently. Furthermore, the configuration and operation of redundant backups for controllers and workloads are also an important part of the configuration and operation of the process control system.

[0038] Figure 1 This is a schematic block diagram of a process control system (system) 100 for an industrial process facility (IPF) according to various implementation schemes. Embodiments of system 100 may represent at least a portion of a larger process control system, as shown for... Figure 1Compared to the number of devices illustratively shown in System 100, a larger process control system may include more controllers, switches, and network layers. However, it will be understood that embodiments of the apparatus, systems, methods, and techniques further described below with respect to System 100 can be implemented and applied to larger and more complex process control systems; therefore, the description of the devices and operation of System 100 below is to be viewed in a non-limiting manner. Although System 100 is described below as a network communicatively coupled via multiple switches, embodiments as disclosed herein can be implemented in networks employing one or more virtual switches or other network topologies without physical switches.

[0039] like Figure 1 As shown, system 100 includes a supervisory controller 102 and multiple operation controllers 120, 121, 122, 123, 124, and 125, which are networked with the supervisory controller 102 via multiple switches 110, 112, 114, and 116 (typically indicated by brackets "L1") at level 1 and switches 104 and 106 (typically indicated by brackets "L2") at level 2. A pair of input / output (I / O) controllers 130 and 132 are also networked with the supervisory controller 102 via I / O HIVE 118, which is coupled to the supervisory controller 102 via switches 104 and 106.

[0040] More specifically, each of the operation controllers 120, 121, and 122 is coupled separately and individually to each of the level 1 switches 110 and 112. Each of the level 1 switches 110 and 112 is coupled separately and individually to each of the switches 104 and 106, wherein each of the level 2 switches 104 and 106 is coupled separately and individually to the supervisory controller 102. Therefore, each of the operation controllers 120, 121, and 122 has two completely separate routes to connect these controllers to the supervisory controller 102. Using controller 120 as an example, the first route of controller 120 extends from the controller through switch 110 to switch 104, and then to supervisory controller 102. The second route of controller 120 extends from the controller through switch 112 to switch 106, and then to supervisory controller 102. Corresponding parallel routes are provided for operation controllers 121 and 122 in system 100.

[0041] In a similar configuration, each of the operation controllers 123, 124, and 125 is coupled separately and individually to each of the level 1 switches 114 and 116. Each of these level 1 switches 114 and 116 is coupled separately and individually to each of the level 2 switches 104 and 106, wherein, as described above, each of the level 2 switches 104 and 106 is coupled separately and individually to the supervisory controller 102. Therefore, each of the operation controllers 123, 124, and 125 has two completely separate routes to connect these controllers to the supervisory controller 102. Using controller 125 as an example, the first route for controller 125 extends from the controller through switch 114 to switch 104, and then to supervisory controller 102. The second route for controller 125 extends from the controller through switch 116 to switch 106, and then to supervisory controller 102. Corresponding parallel routes are provided for operation controllers 123 and 125 in system 100.

[0042] In addition, system 100 includes I / O controllers 130 and 132, which are individually coupled to each of the level 2 switches 104 and 106, and also coupled to each other and to I / O HIVE 118. The coupling from controllers 130 and 132 to I / O HIVE 118 allows controllers 130 and 132 to provide computational processor resources for the operation of the input and output devices included in I / O HIVE. In various embodiments, controllers 130 and 132 act as redundant controllers to each other, wherein in the event of a failure of either controller 130 or 132, the unfailed controller in the pair can continue to provide the necessary computational processor resources for the operation of the I / O devices included in I / O HIVE 118.

[0043] The control HIVE 118 maintains its operational state through a distributed data store. Operational state includes data indicating which control HIVE hosts are active and which control solver workloads these hosts intend to deploy. Control HIVE components periodically broadcast a view of their operational state to all other components. If any component fails to broadcast its view of its operational state within a timeout threshold, that component will be considered offline by the other control HIVE components, and any workloads assigned to the non-responsive control HIVE component will be reassigned and deployed to another component (if any component is available).

[0044] Data indicating the operational status of the control HIVE is distributed across the same redundant physical (FTE) network (e.g., including controllers 130 (CN100-001) and 132 (EIM-001)) used for the control solver workloads that read and write values ​​to and from field I / O via I / O HIVE. Control HIVE components may become physically isolated from each other, but the control solver workloads may continue to have connectivity to their field I / O. This creates a situation where control HIVE 118 can be “split” into two separate, independent groups of control HIVE components, each believing it is responsible for deploying the same set of control solver workloads. The result includes a “dual-master” or “replica master” situation, where the two separate control solver workloads exhibit the same presence (IP address) on the redundant network. This “dual-master” situation disrupts communication between the original control solver workload and its field I / O (CN100 or EIM), leading to uncontrolled field I / O.

[0045] Implementations of the systems, apparatus, methods, and techniques described in this disclosure are arranged to transmit operation status messages from I / O HIVE nodes (e.g., Figure 1 The controllers 130-CN100 and 132-EIM-001 in the system "bounce" to reach control HIVE components that were originally unreachable, thus preventing control HIVE from becoming split up. This ensures that control HIVE components that cannot broadcast their operational database views to other control HIVE components are not considered offline, even if the control HIVE component is actually online and operating normally.

[0046] In some current arrangements of process controllers in process control systems, the control HIVE components must be connected to the same two network FTE switches. This means that the control HIVE components are practically unable to lose network connectivity with each other while still maintaining connectivity with field I / O. However, this arrangement of controllers is clearly a limiting constraint. As process control systems become larger and more complex, process control planners want the ability to geographically distribute their control HIVE components across facilities while still providing increased robustness and reliability to the control process.

[0047] As a non-restrictive example, such as Figure 1As shown, system 100 includes a first set of controllers 120, 121, and 122 configured as a first controller platform, as generally indicated by bracket 140; and a second set of controllers 123, 124, and 125 configured as a second controller platform, as generally indicated by bracket 141. Controllers 120, 121, and 122 in the first controller platform are communicatively coupled to each other via switches 110 and 112 at level 1 of the network, while controllers 123, 124, and 125 in the second controller platform are communicatively coupled to each other via switches 114 and 116, also at level 1. The controllers in the first controller platform are communicatively coupled to the controllers in the second controller platform via switches 104 and 106 at level 2 and then via supervisory controller 102. The controllers in the first controller platform are coupled to the level 2 switches via network connection 115, while the controllers in the second controller platform are coupled to the level 2 switches via network connection 117, as illustratively represented by dashed ellipses 115 and 117, respectively.

[0048] Controller platforms 140 and 141 are each shown coupled to I / O HIVE 118 and controllers 130 and 132, which are configured to control the sensor and actuator portions of the processing equipment in the process control system 100. Sensors are not limited to any particular type and may include sensor types configured to provide an output, such as, but not limited to, an electrical output signal (indicating a sensed value of a physical parameter, such as, but not limited to, pressure, temperature, or a rate of motion such as revolutions per minute (RPM)). Sensors may include devices such as mechanical switches and / or photovoltaic cells configured to provide an output (such as an electrical signal) indicating the state of the device (such as an on or off state). Actuators may be any component or device that generates force, torque, or displacement when an electrical, pneumatic, or hydraulic input is supplied to the actuator. Actuators are not limited to any particular type and may include rotary actuators such as motors and pumps, or linear actuators such as solenoids and control valves. Actuators may include pneumatic or hydraulic actuators (such as control values) and / or electrical, magnetic, thermal, mechanical, and piezoelectric actuators. The communication network included in system 100 is not limited to any particular type of network or network connection and may include, but is not limited to, a local area network (LAN), a wireless LAN, and a wide area network (WAN), which may use one or more types of network connections, including but not limited to Ethernet networks, utilizing various types of transmission cables, including but not limited to Ethernet cables and fiber optic cables.

[0049] While this arrangement of controller platforms and multi-level network switches allows for the desired level of flexibility regarding the geographical distribution of controllers in various physical locations within a plant or facility, using system 100 as an illustrative example, if, for some reason, the communication coupling provided by network connection 115 or network connection 117 is lost, the first and second controller platforms may become isolated from each other. This could disrupt the system's ability to properly control processes such as I / O HIVE 118 and / or other processes related to, for example, maintaining the redundancy required between controllers.

[0050] For example, various controllers included in a particular controller platform can be configured as auxiliary or redundant backup controllers for one or more controllers in different controller platforms. If these controller platforms become isolated from each other, the normal exchange of backup data and the receipt and acknowledgment of the operational status of each of these controllers may cease, potentially leading to a loss of normal control over the processes performed by these controllers. Again, by a non-limiting example, such as... Figure 1 As shown in system 100, controller 123 is configured to operate master controller H3P 154, while controller 125 is configured to operate as auxiliary controller H3S 155 to controller 123. Therefore, controller 123, acting as master controller H3P 154, and controller 125, acting as auxiliary controller H3S 155, are communicatively coupled to the same controller platform 141. Thus, the loss of communication provided by network connection 117 will not prevent the continued required level of communication (at least relative to redundancy) between controllers 123 and 125 via switches 114 and 116 at level 1.

[0051] However, other controller pairs, including the main controller and associated auxiliary controllers that act as the standby controller, may not be configured on the same controller platform. Refer again to System 100 and... Figure 1As a non-limiting example, in system 100, controller 120 is coupled at level 1 to a first controller platform 140 to operate as a master controller H1P 150, wherein controller 123, coupled at level 1 to a second controller platform 141, provides redundancy for controller 120 as an auxiliary controller H1S 151. Similarly, in system 100, controller 121 is coupled at level 1 to the first controller platform 140 to operate as a master controller H2P 152, while controller 124, coupled at level 1 to the second controller platform 141, provides redundancy for controller 121 as an auxiliary controller H2S 153 as a backup. Because the auxiliary controllers 151 and 153 of both main controllers 120 and 121 are assigned to different controller platforms, the loss of either network connection 115 or 117 will fragment the control platform and potentially lead to the loss of control due to erroneous communication related to which controllers are still operating as main controllers, as well as the potential loss of normal standby and redundancy features.

[0052] To address these potential problems, embodiments of the systems, apparatuses, methods, and techniques described in this disclosure utilize a separate communication coupling between the controller platform and the I / O HIVE 1118 to maintain communication of operational states between controllers coupled to different and separate controller platforms. For example, as Figure 1 As shown, system 100 includes a communication link 143 configured to directly or via switches 110 and 112 communicatively couple controllers 120, 121, and 122 to I / OHIVE 118 and controllers 130 and 132. Communication link 143 does not include, or does not require, network connection 115. Figure 1 As further shown, system 100 includes a communication link 145 configured to directly or via switches 114 and 116 communicatively couple controllers 123, 124, and 125 to I / O HIVE 118 and controllers 130 and 132. Communication link 145 does not include or requires the use of network connection 117.

[0053] Although communication between controller platforms is not provided via network connections 115 and / or 117, communication between the controller and the I / O HIVE component, as well as communication between controllers in different controller platforms in controller platforms 140, 141, is maintained due to the direct connection between the controller and I / O HIVE 118. Communication may include communication of the status of the non-responsive I / O HIVE component, where the status indicates that the non-responsive I / O HIVE component is online and operating normally.

[0054] By utilizing I / O HIVE 118 to monitor messages communicated between control HIVE components and periodically “repeating” these messages in the form of their own broadcast messages, failures of network connection 115 and / or network connection 117 will not lead to improper implementation of the auxiliary controller in a “dual master” controller situation, and will prevent improper activation of workloads that are still being performed normally by the currently assigned master controller by the auxiliary or backup controller.

[0055] In these implementations, the time interval for these “repeated” messages issued by I / O HIVE 118 will be less than the allowed timeout threshold before a non-responsive control HIVE component is considered inactive. In the case of a split control system, for example due to the loss of communication coupling between two or more control platforms in the control platform, rebroadcasting messages by controllers 130 and / or 132 using I / O HIVE 118 will allow control HIVE components that were previously unreachable to see that the control HIVE component on the other side of the “split” or division is actually still active and therefore should not be considered inactive or offline. Thus, for example, the auxiliary controller on the other side of the division corresponding to the main controller will not take action to reassign the control solver workload currently being handled normally by the main controller, and therefore no runaway or “dual-master” situation will occur.

[0056] Implementations of the supervisory controller 102 may include or be coupled to the computer / user interface 101. In various implementations, the computer / user interface 101 may include some combination of processing circuitry and computer memory, and may be configured to process computer instructions as needed and execute application software to perform and provide any of the functions and features required to be performed and provided at the supervisory controller level for system 100. In some implementations, the computer / user interface 101 includes, as described below with respect to computer system 502 and... Figure 5 Any device described in the apparatus. Further described below. Figures 2A to 2C A simplified block diagram illustrating the principle of the operation description above relative to system 100 is shown.

[0057] Figure 2A A schematic block diagram 200 illustrating a portion of a process control system according to various embodiments is shown. In various embodiments, the portion of the process control system represented in diagram 200 may be system 100 (… Figure 1 The configuration of one or more parts of ). For example Figure 2A As shown, the first controller HOST-1 202 is coupled to switch A 206 via communication coupling 203, and the second controller HOST-2 204 is coupled to switch B 208 via communication coupling 205.

[0058] Controllers 202 and 204 can be configured in a separate controller platform, as indicated by dashed line 201, and can be communicatively coupled via network link 209, which may include a network, network switches, and controller at a higher level than the network level providing switches 206 and 208. Figure 2A (Not specifically shown in the text). Because controllers 202 and 204 are coupled to each other communicatively only through network link 209, if the communication link provided by network link 209 fails for any reason, the ability to broadcast, receive, and respond to operational status messages between controllers 202 and 204 will be lost. The result will be a partition between controllers 202 and 204, as described above, which may lead to a loss of normal control of the system in which controllers 202 and 204 operate. Furthermore, one or more of controllers 202 and 204 can be configured as auxiliary and backup controllers for the other, where a loss of communication via network link 209 may result in a loss of the required level of redundancy in the process control system in which controllers 202 and 204 operate, including a "dual-master" situation where both controllers attempt to operate as the master controller for the same workload using the same IP address.

[0059] Figure 2B Examples are given based on various implementation schemes. Figure 2A A schematic block diagram 220 illustrates a modified version of a part of a process control system. (See diagram 220.) Figure 2B As shown, block diagram 220 includes a controller 202 coupled to switch A 206 via communication coupling 203 and a controller 204 coupled to switch B 208 via communication coupling 205. Controller 202 can be configured on a different controller platform than the controller platform on which controller 204 is configured, as indicated by dashed line 201. Switch A 206 is communicatively coupled to switch B 208 via network link 209, which includes a network, network switches, and controller at a higher level than the network level providing the network for switches A 206 and B 208. Figure 2B (Not specifically shown in the text).

[0060] In addition to the configuration described above in block diagram 220, I / O-1 222 is also included in the configuration. I / O-1 222 may include I / O HIVE 118 ( Figure 1 (including one or more controllers), and can be configured to work with any input and any output device. Figure 2B(Not specifically shown in the diagram) It can be coupled to a control system including controllers 202 and 204, as well as switches A 206 and B 208. As shown in block diagram 220, the controller of I / O-1 222 is communicatively linked to switch A 206 via communication link 223, and thereby communicatively linked to controller 202 via a communication path that does not include or depend on network link 209. Furthermore, the controller of I / O-1 module 222 is communicatively linked to switch B 208 via communication link 225, and thereby communicatively linked to controller 204 via a communication path that also does not include or depend on network link 209. These separate communication links provided by communication links 223 and 225 allow I / O-1 222 to monitor messages broadcast by both controllers 202 and 204, including broadcast and acknowledgment messages regarding the operational status of the controllers issued and received by both controllers 202 and 204.

[0061] Furthermore, I / O-1 222 can be configured to rebroadcast these messages at a periodic time interval shorter than the timeout period set for each of controllers 202 and 204 for receiving normal operating status messages from the corresponding controller. Even though communication of these messages is lost between the controllers using network link 209, the rebroadcast of the messages can be sent to both controllers 202 and 204. Therefore, rebroadcasting these messages by I / O-1 222 will prevent the control systems including controllers 202 and 204 from being isolated from each other due to a failure in network link 209, and thus prevent improper takeover of the operation of one controller based on an erroneous determination that the master controller has failed, but solely due to the lack of operating status messages communicated across the now-failed network link 209.

[0062] Figure 2C Examples are given based on various implementation schemes. Figure 2B A schematic block diagram 240 illustrates another modified version of a part of the process control system exemplified in the diagram. (See diagram 240 for further details.) Figure 2C As shown, block diagram 240 includes a controller 202 coupled to switch A 206 via communication coupling 203 and a controller 204 coupled to switch B 208 via communication coupling 205. Controller 202 can be configured on a different controller platform than the controller platform on which controller 204 is configured, as indicated by dashed line 201. Switch A 206 is communicatively coupled to switch B 208 via network link 209, which includes a network, network switches, and controller at a higher level than the network level providing the network for switches A 206 and B 208. Figure 2B(Not specifically shown in the diagram). I / O-1 222 is also included in Figure 240 and is coupled to switch A 206 via communication link 223 and to switch B 208 via communication link 225, as described above relative to Figure 220 and... Figure 2B As described.

[0063] The difference between Figure 240 and Figure 200 is that the configuration in Figure 240 includes a communication link 245 that directly couples controller 204 to switch B 208, and a communication link 243 that directly couples controller 202 to switch A 206. The addition of communication links 243 and 245 provides additional robustness to the configuration because even if one of the communication links 223 or 225 between switch A 206 or switch B 208 and I / O-1 222 fails, the additional communication links 243 and 245 still allow both controllers 202 and 204 to communicate with I / O-1 222 through at least one of switches 206 and 208.

[0064] Implementations of the systems, apparatus, methods, and techniques described in this disclosure maintain the highest level of reliability for precise customer requirements of control HIVE components in a controller platform configured with distributed deployments on two or more FTE network switches. Using the same broadcast mechanism employed today by control HIVE component nodes to share a view of their operational state, the I / O HIVE node (CN100, EIM) passively listens for control HIVE component messages on the network and periodically “repeates” these messages in the form of its own broadcast messages. The period will be less than the timeout threshold for inactive control HIVE components. This allows control HIVE components that were originally unreachable to see that the control HIVE components on the other side of the “split” are actually still active, and they should not be considered inactive or offline—and will not take action to reassign the control solver workload, and no runaway will occur.

[0065] The embodiments disclosed herein include a method for confirming the presence of nodes (control applications) in a split automation control platform via a public I / O subsystem. The I / O subsystem receives the operational status of a first group of nodes and periodically broadcasts these operational statuses over the network, where the period is less than a timeout threshold at which a node is considered inactive. Furthermore, a second group of nodes receives the operational status to determine the presence or absence of nodes in the first group.

[0066] Return to reference Figure 1In system 100, the set of control solver workloads in the HIVE control system is responsible for reading and writing field I / O values ​​to and from I / O HIVE nodes (e.g., controller 120 (CN100-001) and controller 132 (EIM-001)). The control solver workloads are maintained redundantly because control state is replicated from the primary controller to a standby auxiliary controller. The standby control solver workload periodically issues Address Resolution Protocol (ARP) request messages to acknowledge the presence of the primary control solver workload.

[0067] After issuing an ARP request message, if the standby control solver workload does not receive any response from the primary control solver workload within a predetermined timeout threshold period, the standby control solver workload will assume that there is some kind of failure relative to the primary control solver workload and will therefore assume the role of the primary control solver workload. In various implementations, the primary control solver workload is bound to a specific IP address, while the auxiliary and standby control solver workloads are bound to specific IP addresses different from the primary control solver workload's IP address. This means there is an IP address associated with the primary role and another, different IP address associated with the standby role. When a control solver workload assumes a role, it also exhibits the IP address associated with that role.

[0068] When the control solver workload is used to read and write values ​​to and from field I / O via I / O HIVE (CN100, EIM), the control state of the control solver workload is replicated from the primary control solver workload to the backup control solver workload via the same redundant physical (FTE) network. Control solver workloads may become physically isolated from each other but continue to have connectivity with their field I / O. This creates a situation where the backup control solver workload assumes the primary role, even though its partner (still running and the corresponding primary control solver workload) actively controls the field I / O as the master controller. This results in a "dual-master" situation where two separate control solver workloads exhibit the same presence (IP address) on the redundant network. This will disrupt communication between the original control solver workload and its field I / O (CN100 or EIM), leading to a loss of control.

[0069] Implementations of the apparatus, systems, methods, and techniques disclosed herein are configured to prevent two control solver workload partners from assuming the same redundant role by “bounced” ARP requests from the I / OHIVE node (CN100, EIM) to the partner, thereby ensuring that a standby control solver workload that cannot see messages from the primary control solver workload does not automatically assume the primary role and thus cause a loss of control within the process control system.

[0070] In various implementations of existing systems, control HIVE components must be connected to the same two FTE switches. This means that control solver workload partners are virtually impossible to lose network connectivity with each other while still maintaining connectivity to common field I / O. However, this is clearly a limiting constraint, as control HIVE customers desire to geographically distribute their control solver workload partners across facilities to provide increased robustness and reliability for the control process. Implementations of the apparatus, systems, methods, and techniques disclosed herein offer maximum reliability for precisely meeting customer requirements of distributing control HIVE components across two or more FTE network switches. Using a mechanism similar to ARP (Address Resolution Protocol) requests currently employed by control solver workload partners to ensure their partners are active, the control solver workload will effectively proxy its ARP requests to its partners through the common I / O HIVE node (CN100, EIM).

[0071] Special user-space applications can be written to construct requests and broadcast them to the network on which the I / O HIVE node will be listening. If the I / O HIVE node sees such a request, it rebroadcasts it to the network. Therefore, the control solver workload partner will now see ARP requests from the I / O HIVE node (on behalf of its partner) and respond to the I / O HIVE node. The I / O HIVE node then forwards the response back to the control solver workload that initiated the proxy ARP request.

[0072] The control solver workload's control state is replicated from the primary control solver workload to the backup control solver workload via the same redundant physical (FTE) network. The control solver workload reads and writes values ​​to and from field I / O via I / O HIVE (CN100, EIM). Control solver workloads may become physically isolated from each other but continue to have connectivity with their field I / O. This creates a situation where the backup control solver workload assumes the master role, even if its partner actively controls the field I / O as the master controller. This results in a dual-master situation where two separate control solver workloads exhibit the same presence (IP address) on the redundant network. This will disrupt communication between the original control solver workload and its field I / O (CN100 or EIM), leading to a loss of control.

[0073] The implementation described herein includes a mechanism for acknowledging the presence of the primary control solver workload using ARP (Address Resolution Protocol) requests taken by the standby control solver workload. The control solver workload effectively proxies its ARP requests to its partners through a public I / O HIVE node (CN100, EIM). A special user-space application is written to construct the requests and broadcast them to the network on which the I / O HIVE node will be listening. If the I / O HIVE node sees such a request, it rebroadcasts it to the network. The control solver workload partner will now see the ARP requests from the I / O HIVE node (on behalf of its partner) and respond to the I / O HIVE node. The I / O HIVE node then forwards the response back to the control solver workload that initiated the proxy ARP request.

[0074] Figure 3A A timing diagram 300 illustrating communication between control solver workloads according to various embodiments is shown. In various embodiments, control solver workloads (main workload-1) 302 and control solver workloads (auxiliary workload-2) 304 represent controllers programmed to operate in conjunction with a main controller (e.g., controller 120 operating as a main controller H1P 150). Figure 1 ) is executed on and on the auxiliary controller (e.g., controller 123, which operates as an auxiliary controller H1S 151). Figure 1 The backup process control algorithm is located on the system 100. In various implementations, workload-1 302 and workload-2 304 may reside on two different controller platforms (such as controller platform 140 and controller platform 141), as for system 100. Figure 1 ) as an example.

[0075] In its role as a backup workload, workload-2 304 is configured to issue ARP request messages 310 at predetermined time intervals in various implementations. These ARP request messages are directed to the controller in which workload-1 302 operates. When issuing the ARP request message 310, workload-2 304 may also start a response timer with a response timer threshold, which represents the time span illustratively represented by arrow T-threshold at arrow 322. The ARP request message 310 can be communicated via a communication link illustratively represented by dashed line 319, which may include one or more networks, including one or more network switches and one or more upper-layer controllers.

[0076] Under normal conditions, and when workload-1 302 is operating normally, workload-1 302 is configured to respond to workload-2 304 with an ARP response 311 upon receiving an ARP request 310, indicating that workload-1 302 is actually online and performing the processing required for the operation of workload-1. When an ARP response 311 is received at workload-2 304 within the response time limit (illustrated in diagram 300 as T-response and arrow 320, which is less than the time period allowed by T-threshold (arrow 322), workload-2 304 is configured to understand that workload-1 302 is operating normally and does not require action regarding taking over the role of the primary participant in workload-1.

[0077] In an alternative scenario, after issuing an ARP request 310 and starting a response timer, if workload-2 304 does not receive an ARP response 311 within the time period T-threshold (arrow 322), workload-2 304 can be configured to assume that workload-1 302 is offline and / or has failed. In these cases, workload-2 304 can be configured to handle a communication timeout routine 330, which includes workload-2 304 disabling synchronization of the operational states between workload-1 302 and workload-2 304, as indicated by box 332 in Figure 300, and switching to act as the master processor, as indicated by box 334 in Figure 300, to perform the processing previously provided by workload-1 302. As part of the switch at box 334, workload-2 304 will secure the IP address of the master participant for the newly assumed workload processing.

[0078] In some instances, the switching at block 334 may actually be the result of a failure of workload-1 302 for some reason, or because workload-1 302 is offline for some reason, where the switching of workload-2 304 provides the expected backup and redundancy for the failed operation state of workload-1 302. However, in other instances, the failure to receive any ARP response at workload-2 304 may be the result of a failure in the communication network 319 that provides the communication coupling between workload-1 302 and workload-2 304, rather than due to any direct failure of workload-1 302, where workload-1 302 continues to be executed normally by the original controller, which acts as the master controller for executing workload-1 302 and utilizes the IP address of the master controller executing workload-1 302. A failure of communication between workload-1 302 and workload-2 304 can be illustratively represented by “X” 313, which shows that an ARP request 310 issued by workload-2 304 fails to be received at workload-1 302; or illustratively represented by “X” 315, which shows that an ARP response message 311 issued by workload-1 302 fails to be received at workload-2 304.

[0079] In instances where the communication failure between workload-1 302 and workload-2 304 is due to a fault in communication link 319 rather than a fault or offline state of workload-1 302, the auxiliary controller executing workload-2 304 may assume the role of the master controller and have the master controller's IP address, such that workload-1 302 and workload-2 304 now both operate using the same IP address. The result could be I / O HIVE and / or loss of control of at least a portion of a control system previously controlled by process control executed by workload-1 302 using workload-2 304 as a backup.

[0080] Figure 3B Examples of various implementation schemes are shown above relative to... Figure 3A Figure 350 illustrates the modified configuration for the described workload processing. (See Figure 350.) Figure 3B As shown, Figure 350 includes [a configuration] with [other components]. Figure 3AThe illustrated workload-1 302 is communicatively coupled to workload-2 304 via combined link 319 in the same or similar manner. However, Figure 350 includes the addition of a common I / O-1 306, which is communicatively coupled to workload-1 302 via communication link 321, and wherein I / O-1 306 is also separately coupled to workload-2 304 via communication link 323. Furthermore, communication links 321 and 322 are provided as communication links separate from and independent of communication link 319. Various scenarios of communication that can be configured to occur between workload-1 302, workload-2 304, and common I / O-1 306 are further described below to illustrate how the modified configuration shown in Figure 350 can be configured to avoid the undesirable occurrence of "dual master" control of the workload.

[0081] As shown in Figure 350, workload-2 304 issues an ARP request 310 directed to workload-1 302. This ARP request requests a status acknowledgment from workload-1 302 and can be sent via communication link 319. Workload-2 304 may issue this ARP request and other ARP requests (such as ARP request 311) at a predefined and iterative time interval because workload-2 304 is configured as a backup or auxiliary workload for workload-1 302 and therefore needs to acknowledge the operational status of workload-1 302. Simultaneously, or exactly after issuing ARP request 310, workload-2 304 also issues an indirect ARP request 352, which is directed to I / O-1 306 and can be communicated to I / O-1 306 via a separate communication link 323, independent of communication link 319.

[0082] At various times or for some reason, the communication intended to be provided via communication link 319 fails, and therefore an ARP request 310 issued by workload-2 304 and directed to workload-1 302 via communication link 319 fails to be received at workload-1 302, as illustratively represented by “X” 313. However, communication of an indirect ARP request 352 from workload-2 304 to I / O-1 306 is successfully received at I / O-1 306 using communication link 323, which is completely separate from communication link 319 and unaffected by its failure. In response to receiving an indirect ARP request 352 at I / O-1 306, and because I / O-1 306 is communicatively coupled to workload-1 302 via communication link 321, I / O-1 306 can use communication link 321 to forward the indirect ARP request 352 to workload-1 302, as illustratively represented by ARP request 353. In response to receiving ARP request 353 from I / O-1 306, and although ARP request 310 was not received at workload-1 302, workload-1 302 responds to the ARP request 353 received from I / O-1 306 with an ARP response 354, wherein workload-1 302 is configured to include a message indicating the operational status of workload-1 302 in the ARP response 354.

[0083] I / O-1 306 is configured to receive ARP response 354, and assuming that the information included in ARP response 354 includes an indication that workload-1 302 is online and operating normally, I / O-1 306 is configured to generate and output an indirect ARP response 355 directed to workload-2 304, which indicates to workload-2 304 that workload-1 302 is online and operating normally, and that no action is currently required regarding assuming the role of master controller for workload-1 302 on the portion of workload-2 304. In this scenario, the intervention of control provided by I / O-1 306 prevents workload-2 304 from inappropriately switching to act as the master controller for the process normally performed by workload-1 302 (if this were done, a "dual-master" problem would arise, as described above, which is avoided by using I / O-1 306 to interact with both workload-1 302 and workload-2 304).

[0084] In an alternative scenario, when an ARP response 354 is received back from workload-1 302 at I / O-1 306, the information included in the ARP response 354 indicates that workload-1 302 is offline and / or not operating correctly. In this scenario, I / O-1 306 can be configured to generate and output an indirect ARP response 355 directed to workload-2 304, indicating to workload-2 304 that workload-1 302 is offline and / or not operating correctly. Based on this information as issued by I / O-1 306 and as received at workload-2 304 in the indirect ARP response 355, workload-2 304 can be configured to perform a switchover and take over as the master controller to perform the control procedures previously provided by workload-1 302.

[0085] In another alternative scenario, simultaneously with, or immediately after, issuing an ARP request 353 directed to workload-1 302, I / O-1 306 may start a response timer with a response timer threshold, where the response timer threshold represents a time limit set by I / O-1 306 for receiving a response returned from workload-1 302 as a reply to ARP request 353. If I / O-1 306 does not receive an ARP response 354 returned from workload-1 302 before the timer reaches the response timer threshold (as illustrated in Figure 350, a communication timeout 360), I / O-1 306 may be configured to assume that workload-1 302 is offline and / or has failed. In these cases, I / O-1 306 can be configured to generate, for example, an indirect ARP response 355 (including instructions to disable synchronization for workload-2 304 to execute the operational state between workload-1 302 and workload-2 304) and output it to workload-2 304, as indicated by box 362 in Figure 350; and perform a switch to now act as the master processor, as indicated by box 364 in Figure 350, to perform the processing previously provided by workload-1 302. As part of the switch at box 363, workload-2 304 will exhibit the IP address of the master participant for the newly assumed workload processing.

[0086] However, in a scenario where I / O-1 306 does not receive an ARP response 354 before the response timer started with the issuance of ARP request 353 expires, I / O-1 306 may not start workload-2 304 to perform the switchover if workload-2 304 has already received a response from workload-1 302 indicating that workload-1 is online and operating normally.

[0087] Other communication scenarios related to Figure 350 and the messages and message timing sent and received between Workload-1 302, Workload-2 304, and I / O-1 306 are possible. For example, although messages and responses are described as being formatted using an address resolution protocol, messages and responses are not limited to a specific protocol and may include formats and protocols other than those provided by the address resolution protocol. In any case, in many instances, the addition of message monitoring, rebroadcasting, and indirect messaging provided by I / O-1 306 can prevent the occurrence of a "dual-master" situation or a situation where two different workload controllers operate on the same workload within a process control system.

[0088] Therefore, in summary, the implementation scheme of the control system using the I / O subsystem as an intermediary for communication between workloads is configured such that the standby control application acknowledges the presence of the primary control application via the common I / O subsystem in the automation control platform to prevent a dual-master situation. The I / O subsystem receives ARP requests generated by the standby control application and broadcasts them over the network. Furthermore, the primary control application receives requests and provides responses back to the standby control application via the I / O subsystem.

[0089] Figure 4A Flowcharts illustrating methods 400 for operating a process control system according to various embodiments are shown. In some embodiments, the operations described with respect to method 400 may be performed wholly or partially by computer circuitry, such as a processor or processor set, which may be included in a computer / user interface 101, a supervisory controller 102, and / or other devices, such as with respect to system 100 and Figure 1 Any controller in the illustrated and described controllers, including those as described above relative to system 100 and Figure 1 I / O controllers 130 and 132 are illustrated and described; or may be executed by another computer system, such as computer system 502. Figure 5 ).

[0090] An implementation of method 400 includes receiving data (block 402) at an input / output component node of the process control system that indicates a set of operating states of a first set of control component nodes.

[0091] Implementation of method 400 includes: rebroadcasting data indicating the set of operating states of the first set of control nodes from the input / output control component nodes and by means of a communication link coupled to the input / output control component nodes to the second set of control component nodes (block 404).

[0092] An embodiment of method 400 includes: receiving data at a second set of control component nodes indicating a set of operational states of a first set of control component nodes (box 406). An embodiment of method 400 includes: determining the operational state of each control component node in the first set of control component nodes based on the received data indicating the operational state of each control component node in the first set of control component nodes (box 408).

[0093] In various embodiments of method 400, a second set of one or more controllers is located on a second controller platform different from the first controller platform. In various embodiments, one or more controllers in the second set of controllers are configured as auxiliary and backup controllers to one or more controllers in the first set of controllers. In various embodiments, the second set of one or more controllers includes a second set of one or more workloads operable to be processed using one or more controllers included in the second set of controllers. In various embodiments, the second set of one or more workloads is configured as an auxiliary backup to one or more workloads on the first set of workloads.

[0094] Implementations of method 400 include determining one or more actions to be taken by an I / O controller in response to detecting a failure in one or more data communications between a first set of one or more controllers and a second set of one or more controllers. In various implementations, one or more actions include sending a message to an auxiliary controller acting as a backup controller to ensure that the primary controller takes over the role of the controller that is determined to be offline or in a faulty condition. In various implementations, one or more actions include sending a message to the auxiliary controller acting as a backup controller indicating that the associated primary controller is online and operating normally, and not ensuring that the primary controller is used to handle the control applications or workloads currently being performed by the primary controller.

[0095] Implementations of method 400 include: wherein the second group of control component nodes is separated from the first group of control component nodes such that any broadcasts made by the first group of control component nodes are not directly transmitted to the second group of control component nodes. Implementations of method 400 include: wherein at least one control component node in the second group of control component nodes operates as a standby processing node for at least one workload to be processed by one or more controllers included in the first group of control component nodes. Implementations of method 400 include: wherein rebroadcasting of data indicating the operational status set of the first group of control nodes includes providing rebroadcasting for a time period less than a timeout threshold period allowed before a non-responsive control component node is considered inactive.

[0096] An embodiment of method 400 includes: a first set of control component nodes coupled to a first set of one or more network switches, and a second set of control component nodes coupled to a second set of one or more network switches that are different from and separate from the one or more network switches in the first set of switches. An embodiment of method 400 includes: the first set of one or more switches communicatively coupled to input / output component nodes via a first communication link, and the second set of one or more network switches communicatively coupled to input / output component nodes via a second communication link that is different from and separate from the first communication link. An embodiment of method 400 includes: using input / output control component nodes to interface with multiple sensors and control the operation of multiple actuators when operating one or more processing units included in a process control system for multiple sensors and multiple actuators.

[0097] Figure 4B Flowcharts illustrating methods 450 for operating a process control system according to various embodiments are shown. In some embodiments, the operations described with respect to method 450 may be performed wholly or partially by computer circuitry, such as a processor or processor set, which may be included in a computer / user interface 101, a supervisory controller 102, and / or other devices, such as with respect to system 100 and Figure 1 Any controller in the illustrated and described controllers, including those as described above relative to system 100 and Figure 1 I / O controllers 130 and 132 are illustrated and described; or may be executed by another computer system, such as computer system 502. Figure 5 ).

[0098] An embodiment of method 400 includes receiving, at an input / output component node of the process control system, a first Address Resolution Protocol (ARP) request message issued by a first control component node of the process control system, wherein the first ARP request message is directed to a second control component node of the process control system and includes a request for information about the operational status of the second control component node (box 452).

[0099] An implementation of method 450 includes: in response to receiving a first ARP request message, rebroadcasting the first ARP request message from the input / output component node to the second control component node as a first indirect ARP request message (block 454).

[0100] An embodiment of method 450 includes: receiving a reply returned from a second control component node in response to a first indirect ARP request message at an input / output component node (box 456). An embodiment of method 450 includes: in response to receiving the reply returned from the second control component node, outputting an indirect ARP response from the input / output component node directed to the first control component node, the indirect ARP response including an indication of the operational status of the second control component node (box 458).

[0101] Implementations of method 450 include: wherein the second control component node operates as an auxiliary and backup control processor for the first control component node. Implementations of method 450 include: wherein a response returned from the second control component node includes an indication of the second control component node's operational status, indicating that the second control component node is online and operating normally. Implementations of method 450 include: wherein a response returned from the second control component node includes an indication of the second control component node's operational status as offline or faulty, and wherein an indirect ARP response directed to the first control component node includes an indication of the second control component node being offline or faulty.

[0102] Implementations of method 450 include: the method further includes: in response to receiving an indication at a first control component node that a second control component node is offline or has failed, performing a switchover, the switchover including the first control component node assuming the role of the master controller, and initiating the execution of workloads previously handled by the second control component node when the second control component node operates as the original master controller. Implementations of method 450 include: simultaneously rebroadcasting a first indirect ARP request message to the second control component node, starting a response timer with a response timer threshold, wherein the response timer threshold represents a time limit set by the input / output component node for receiving a response returned from the second control component node. Implementations of method 450 include: using the input / output control component node to interface with multiple sensors and control the operation of multiple actuators when multiple sensors and multiple actuators control the operation of one or more processing units included in a process control system.

[0103] Although in an implementation of method 400 messages and responses are referred to as being formatted using an address resolution protocol, the messages and responses included in method 400 and any variations and / or equivalents thereof are not limited to using a particular protocol and may include formats and protocols other than those provided by using an address resolution protocol.

[0104] Figure 5A block diagram 500 illustrating an example computer system 502 according to various embodiments is shown. The computer system 502 may be configured to provide and perform any of the features and functions described in this disclosure related to communication within a process control system that utilizes an I / O controller to prevent improper implementation of a “dual-master” controller and to address other types of communication losses within the process control system as described above. In some embodiments, the computer system 502 is included in or incorporated into a computer / user interface 101 (… Figure 1 In various embodiments, computer system 502 may be included in or incorporated into any of the devices included in one or more devices in the process control system, such as controllers, including I / O controllers and supervisory controllers, and may be included in the process control system (such as system 100). Figure 1 Other network devices (such as network switches) in the network.

[0105] Return to reference Figure 5 Computer system 502 includes a processing device 510 communicatively coupled to one or more storage devices 515 via a bus system 505. This processing device may include multiple processors, multiple cores, multiple nodes, and / or implement multithreading. Example types of processing devices 510 include microprocessors, microcontrollers, digital signal processors, field-programmable gate arrays, application-specific integrated circuits (ASICs), and discrete circuits.

[0106] like Figure 5 As shown, storage device 515 includes memory 530 and persistent storage device 535. Memory 530 and persistent storage device 535 are examples of storage devices that represent any structure capable of temporarily or permanently storing information (such as data, program code, and / or other suitable information) and facilitating information retrieval. Memory 530 may represent random access memory or any other suitable volatile or non-volatile storage device. Persistent storage device 535 may include one or more components or devices supporting longer-term storage of data, such as read-only memory, hard disk drive, flash memory, or optical disk.

[0107] Storage device 515 includes additional data and software modules that can be executed by processing device 510 to provide and perform any of the features and functions attributable to control and messaging communication between the controller and workload, as described above. Figure 5 As shown, storage device 515 includes a controller primary / secondary mapping 532, which allows computer system 502 to control system (such as system 100) according to the processing procedure. Figure 1The various aspects of operation require understanding the relationship between the main and auxiliary controllers and the workload.

[0108] The processing device 510 may be configured to execute any instructions stored in and / or provided thereto in the memory 530, persistent storage device 535, and controller master / auxiliary map 532, in order to perform and provide any function and feature of the various implementations of the process control system described herein.

[0109] like Figure 5 As shown, the computer system also includes a communication unit 520 and an I / O unit 525, which are communicatively coupled to the bus system 505 and thus coupled to each other and to the processing device 510 and the storage device 515. The computer system 502 can communicate via network interface 520 through transmissions to and / or from remote devices, whether wired or wireless, depending on the carrying medium, according to a network protocol corresponding to the type of network interface. Furthermore, the communication or transmission may involve other layers of communication protocols and / or communication protocol suites (e.g., Transmission Control Protocol, Internet Protocol, User Datagram Protocol, Virtual Private Network Protocol, etc.). Additionally, the communication unit 520 can be configured to convey messages to other devices in the process control system (such as, but not limited to, controllers, including I / O controllers), and workload-related messages are executed by the process control system.

[0110] I / O unit 525 may be configured to operate as an interface for providing communication coupling between computer system 502 and one or more user input devices 526 and one or more output devices 528. User input devices 526 may include one or more devices such as a computer mouse, computer keyboard, voice recognition hardware and software, and / or other devices such as a touchscreen, which allow a user to provide input to computer system 502. Output devices 528 may include one or more devices such as computer monitors and / or speakers, which are configured to provide output information perceptible to a user such as a process control engineer or technician, such as visual graphic displays and / or sound. Output devices 528 may include other types of output devices, such as printers. In various embodiments, input device 526 may be used to input information such as controller configuration and communication with process control systems (such as system 100 (…). Figure 1 Other parameters related to the operation, such as those mentioned above, are related to the operation of the other parameters. Figures 2A to 2C , Figures 3A to 3BAs illustrated and described in Figure 4, these parameters relate to the communication and workload used to control the operation of the process control system to which the computer system 502 may be incorporated. In various embodiments, graphical information and depictions relating to the status and operation of the process control system to which the computer system 502 is incorporated may be generated and displayed on a monitor or display provided, for example, as part of output device 528, for use by users such as process control engineers or technicians.

[0111] Any of the previously described functionalities may be implemented partially (or entirely) in hardware and / or on the processing device 510. For example, a functionality may be implemented using an application-specific integrated circuit (ASIC), logic implemented in the processing device 510, a coprocessor on a peripheral device or card, etc. Furthermore, implementation may include... Figure 5 Fewer components or additional components not illustrated herein (e.g., video cards, audio cards, additional network interfaces, peripherals, etc.). Although illustrated as being coupled to bus 505, one or more of the memory and storage devices included in storage device 515 may be directly coupled to processing device 510.

[0112] although Figure 5 An example of a computer system 502 supporting industrial process control and automation systems is illustrated, but variations in the configuration of computer system 502 are possible. For example, various components in computer system 502 can be combined, further subdivided, or omitted, and additional components can be added as needed. Furthermore, processing device 510 can have many configurations, and such as... Figure 5 The configuration of the illustrated computer system 502 does not limit this disclosure to any particular configuration of a computing device.

[0113] The following numbered examples are illustrative.

[0114] Example 1 is a method for performing process control operations in a process control system, the method comprising: receiving data at input / output component nodes of the process control system indicating a set of operating states of a first group of control component nodes; rebroadcasting the data indicating the set of operating states of the first group of control components from the input / output control component nodes and through a communication link coupled to the input / output control component nodes to a second group of control component nodes; receiving the data indicating the set of operating states of the first group of control component nodes at the second group of control component nodes; and determining, at the second group of control component nodes, the operating state of each control component node in the first group of control component nodes based on the received data indicating the operating state of each control component node in the first group of control component nodes.

[0115] Example 2 is the method according to Example 1, wherein the second group of control component nodes is separated from the first group of control component nodes such that any broadcasts made by the first group of control component nodes are not directly transmitted to the second group of control component nodes.

[0116] Example 3 is a method according to any one of Examples 1 to 2, wherein at least one control component node in the second group of control component nodes operates as a backup processing node for at least one workload to be processed by one or more controllers included in the first group of control component nodes.

[0117] Example 4 is a method according to any one of Examples 1 to 3, wherein the rebroadcast instructs the data of the set of operational states of the first group of control nodes to be provided for a time period less than the timeout threshold period allowed before a non-responsive control component node is considered inactive.

[0118] Example 5 is a method according to any one of Examples 1 to 4, wherein the first group of control component nodes is coupled to a first set of one or more network switches, and the second group of control component nodes is coupled to a second set of one or more network switches that are different from and separate from the one or more network switches in the first group of switches.

[0119] Example 6 is a method according to any one of Examples 1 to 5, wherein the first set of one or more switches is communicatively coupled to the input / output component node via a first communication link, and the second set of one or more network switches is communicatively coupled to the input / output component node via a second communication link that is different from and separate from the first communication link.

[0120] Example 7 is a method according to any one of Examples 1 to 6, the method further comprising: using the input / output control component node to interface with the plurality of sensors and control the operation of the plurality of actuators when the plurality of sensors and the plurality of actuators control the operation of one or more processing equipment included in the process control system.

[0121] Example 8 is a method for performing process control operations in a process control system, the method comprising: receiving at an input / output component node of the process control system a first address request message issued by a first control component node of the process control system, wherein the first address request message is directed to a second control component node of the process control system and includes a request for information regarding the operational status of the second control component node; in response to receiving the first address request message, rebroadcasting the first address request message from the input / output component node to the second control component node as a first indirect address request message; receiving at the input / output component node a response returned from the second control component node in response to the first indirect address request message; and in response to receiving the response returned from the second control component node, outputting from the input / output component node an indirect address response directed to the first control component node, the indirect address response including an indication of the operational status of the second control component node.

[0122] Example 9 is the method according to Example 8, wherein the second control component node operates as an auxiliary and backup control processor for the first control component node.

[0123] Example 10 is a method according to any one of Examples 8 to 9, wherein the response returned from the second control component node includes an indication regarding the operational status of the second control component node that the second control component node is online and operating normally.

[0124] Example 11 is a method according to any one of Examples 8 to 10, wherein the response returned from the second control component node includes an indication that the operating state of the second control component node is offline or faulty, and wherein the indirect address response directed to the first control component node includes an indication that the second control component node is offline or faulty.

[0125] Example 12 is a method according to any one of Examples 8 to 11, the method further comprising: in response to receiving an indication at the first control component node that the second control component node is offline or has failed, performing a switch, the switch comprising the first control component node assuming the role of the master controller, and initiating the execution of a workload previously handled by the second control component node when the second control component node operates as the original master controller.

[0126] Example 13 is a method according to any one of Examples 8 to 12, the method further comprising: while rebroadcasting the first indirect address request message to the second control component node, starting a response timer having a response timer threshold, wherein the response timer threshold represents a time limit set by the input / output component node for receiving a response returned from the second control component node.

[0127] Example 14 is a method according to any one of Examples 8 to 13, the method further comprising: using the input / output control component node to interface with the plurality of sensors and control the operation of the plurality of actuators when the plurality of sensors and the plurality of actuators control the operation of one or more processing equipment included in the process control system.

[0128] Example 15 is a process control system comprising a plurality of process controllers communicatively coupled together via an input / output control element, the input / output control element comprising one or more input / output controllers configured to control operation associated with input sensors and output actuators included as part of the process control system; the input / output control element being configured to: receive messages broadcast from the plurality of process controllers, each message including data indicating the operating state of the specific process controller that issued the message; and rebroadcast the received messages via one or more communication links configured to communicatively couple the input / output control element to the plurality of process controllers.

[0129] Example 16 is a process control system according to Example 15, wherein at least one of the messages configured to be broadcast from the plurality of process controllers and received at the input / output control element includes an address request message, the address request message being configured to be issued by a first process controller among the plurality of process controllers and directed to a second process controller among the plurality of process controllers, wherein the second process controller among the plurality of process controllers is configured as an auxiliary and backup process controller for the first process controller among the plurality of process controllers.

[0130] Example 17 is a process control system according to any one of Examples 15 to 16, wherein, in response to receiving the at least one message including the address request message, the input / output control element is further configured to: use an indirect address request to directly communicate the address request message to a second process controller among the plurality of process controllers; receive an address response returned from the second process controller among the plurality of process controllers as a reply to the indirect address request; and upon receiving the address response returned from the second process controller among the plurality of process controllers, communicate the indirect address response to the first process controller among the plurality of process controllers, the indirect address response indicating information provided in the address response received from the second process controller among the plurality of process controllers.

[0131] Example 18 is a process control system according to any one of Examples 15 to 17, wherein the address response sent back from the second process controller among the plurality of process controllers includes information indicating the operating state of the second process controller among the plurality of process controllers.

[0132] Example 19 is a process control system according to any one of Examples 15 to 18, wherein a first set of control element nodes of the plurality of controllers is coupled to a first set of one or more network switches, and a second set of control element nodes of the plurality of controllers is coupled to a second set of one or more network switches that are different from and separate from the one or more network switches in the first set of switches, wherein the first set of one or more switches is communicatively coupled to the input / output control element via a first communication link, and the second set of one or more network switches is communicatively coupled to the input / output control element via a second communication link that is different from and separate from the first communication link.

[0133] Example 20 is a process control system according to any one of Examples 15 to 19, wherein the input / output component is further configured to: use the input / output control component node to interface with the plurality of sensors and control the operation of the plurality of actuators when the plurality of sensors and the plurality of actuators control the operation of one or more processing equipment included in the process control system.

[0134] While various aspects of this disclosure have been described with reference to specific embodiments and applications, it will be understood that these aspects are illustrative and the scope of the claims is not limited thereto. Generally, the techniques for controlling and regulating the operation of process control systems as described herein can be implemented using facilities consistent with any one or more hardware systems. Many variations, modifications, additions, and improvements are possible.

[0135] Multiple instances can be provided for the components, operations, or structures described herein as a single instance. Finally, the boundaries between various components, operations, and data storage areas are somewhat arbitrary, and specific operations are illustrated within the context of a particular exemplary configuration. Other allocations of functionality are contemplated, and these allocations may fall within the scope of this disclosure. Typically, structures and functionalities presented as separate components in the example configuration can be implemented as composite structures or components. Similarly, structures and functionalities presented as separate components can be implemented as separate components. These and other variations, modifications, additions, and improvements may fall within the scope of this disclosure.

[0136] In some embodiments, the various functions described in this patent document are implemented or supported by a computer program, which is formed by computer-readable program code and embodied in a computer-readable medium. The phrase "computer-readable program code" includes any type of computer code, including source code, object code, and executable code. The phrase "computer-readable medium" includes any type of medium that can be accessed by a computer, such as read-only memory (ROM), random access memory (RAM), hard disk drive, optical disc (CD), digital video disc (DVD), or any other type of storage. "Non-transitory" computer-readable medium excludes wired, wireless, optical, or other communication links that transmit transient electrical signals or other signals. Non-transitory computer-readable medium includes media that can permanently store data as well as media that can store and subsequently overwrite data, such as rewritable optical discs or erasable storage devices.

[0137] It may be advantageous to define certain words and phrases used throughout this patent document. The terms “application” and “program” mean one or more computer programs, software components, instruction sets, processes, functions, objects, classes, instances, associated data, or portions thereof that are suitable for implementation in appropriate computer code (including source code, object code, or executable code). The term “communication” and its derivatives encompass both direct and indirect communication. The terms “comprising” and “including” and their derivatives mean, but are not limited to, these. The term “or” is inclusive, meaning and / or. The phrase “associated with” and its derivatives may mean, include, be contained within, interconnected with, contain, be included in, be connected to or connected with, be linked to or connected with, be able to communicate with, cooperate with, interleave, juxtapose, be close to, be combined with or be combined with, have, have the attributes of, have a relationship with, or be related to, etc. When used with a list of items, the phrase “at least one of” means that different combinations of one or more of the listed items may be used, and that only one item in the list may be required. For example, "at least one of A, B and C" includes any of the following combinations: A, B, C, A and B, A and C, B and C, and A and B and C.

[0138] The descriptions in this application should not be construed as implying that any particular element, step, or function is a fundamental or essential element that must be included within the scope of the claims. The scope of the subject matter protected by the patent is defined only by the permitted claims. Furthermore, none of the claims invokes 35 USC with respect to any of the appended claims or claim elements. 112(f), unless the exact words of "means for..." or "steps for..." which are participle phrases that identify the function are used in the specific claims. The use of terms such as (but not limited to) "mechanism," "module," "device," "unit," "component," "element," "part," "device," "machine," "system," "processor," or "controller" within the claims is understood to refer to structures known to a person skilled in the art, further modified or enhanced by the features of the claims themselves, and is not intended to invoke 35 USC. 112(f).

[0139] While this disclosure has described certain embodiments and generally associated methods, variations and substitutions of these embodiments and methods will be apparent to those skilled in the art. Therefore, the foregoing description of exemplary embodiments does not limit or restrict this disclosure. Other changes, substitutions, and modifications are possible without departing from the spirit and scope of this disclosure as defined in the following claims.

Claims

1. A method for performing process control operations in a process control system, the method comprising: The system receives data at the input / output component nodes of the process control system, indicating the set of operating states of the first set of control component nodes. The data indicating the set of operating states of the first group of control nodes is rebroadcast from the input / output control component node and through the communication link coupled to the input / output control component node to the second group of control component nodes; At the second set of control component nodes, the data indicating the set of operating states of the first set of control component nodes is received; as well as At the second group of control component nodes, the operating state of each control component node in the first group of control component nodes is determined based on received data indicating the operating state of each control component node in the first group of control component nodes.

2. The method of claim 1, wherein the second group of control component nodes is separated from the first group of control component nodes such that any broadcasts made by the first group of control component nodes are not directly transmitted to the second group of control component nodes.

3. The method of claim 2, wherein at least one of the control component nodes in the second group of control component nodes operates as a backup processing node for at least one workload to be processed by one or more controllers included in the first group of control component nodes.

4. The method according to any one of claims 1 to 3, wherein the data indicating the rebroadcast of the set of operational states of the first group of control nodes includes providing the rebroadcast within a time period less than a timeout threshold period allowed before a non-responsive control component node is considered inactive.

5. The method according to any one of claims 1 to 3, wherein the first group of control component nodes is coupled to a first set of one or more network switches, and the second group of control component nodes is coupled to a second set of one or more network switches that are different from and separate from the one or more network switches in the first group of switches.

6. The method of claim 5, wherein the first set of one or more switches is communicatively coupled to the input / output component node via a first communication link, and the second set of one or more network switches is communicatively coupled to the input / output component node via a second communication link that is different from and separate from the first communication link.

7. The method according to any one of claims 1 to 3, further comprising: When multiple sensors and multiple actuators control the operation of one or more processing units included in the process control system, the input / output control component node is used to interface with the multiple sensors and control the operation of the multiple actuators.

8. A method for performing process control operations in a process control system, the method comprising: At the input / output component node of the process control system, a first address request message is received from a first control component node of the process control system, wherein the first address request message is directed to a second control component node of the process control system and includes a request for information about the operating status of the second control component node. In response to receiving the first address request message, the first address request message is rebroadcast from the input / output component node to the second control component node as a first indirect address request message; At the input / output component node, a response is received from the second control component node in response to the first indirect address request message; as well as In response to receiving the reply from the second control component node, an indirect address response directed to the first control component node is output from the input / output component node, the indirect address response including an indication of the operating state of the second control component node.

9. The method of claim 8, wherein the response returned from the second control component node includes an indication of the operational status of the second control component node, indicating that the second control component node is online and operating normally.

10. A process control system, the process control system comprising: Multiple process controllers are communicatively coupled together via input / output control elements, the input / output control elements including one or more input / output controllers configured to control the operation associated with input sensors and output actuators included as part of the process control system; An input / output control component is configured to: receive messages broadcast from the plurality of process controllers, each message including data indicating the operating state of a particular process controller that issued the message; and rebroadcast the received messages via one or more communication links configured to communicatively couple the input / output control component to the plurality of process controllers.

Images