Operating method and system controller

Abstract

The invention relates to a method (100) for operating a system controller (10), to a system controller (10), and to a computer program product. Process input data packets (60) which are forwarded in a network (90) are received (S1) by means of a first control device (20) and at least one additional control device (30). At least some of the received process input data packets (60) are processed (S2) by the first control device (20) in order to form process output data (70), and a message (80) is transmitted (S3) from the first control device (20) to the at least one additional control device (30) via the network (90), wherein the message contains processing information which characterizes the processed input data packets (60) last processed by the first control device (20).

Description

[0001] Description

[0002] Operating procedures and plant control

[0003] The present invention relates to a method for operating a plant control system as well as a plant control system and a computer program product.

[0004] Systems, such as machines or vehicles, typically comprise a multitude of interacting components. Some of these components generate data, for example, when recording operating parameters or monitoring processes, while other components perform specific actions based on this data. To enable communication between the components, it has proven useful to equip the systems with a (communication) network.

[0005] A modular system design is often preferred, especially for complex systems. For communication in such a modular system, the implementation of what is known as publish-subscribe communication over the network has proven advantageous. A message sent by a network participant is, in principle, available to all other network participants; however, it is only received by those network participants who have subscribed to the sending network participant's messages—the so-called "subscribers."

[0006] This allows, for example, a system's control device to receive data from selected sensors and output control signals based on this sensor data. The control signals can, in turn, be received by selected actuators.

[0007] To ensure high availability of such a system, these control devices are often provided redundantly. A redundant control device can then take over the active control device's function if it fails. This is referred to as redundancy switching.

[0008] It is an object of the present invention to provide a method with which the redundancy switching can be improved, in particular without the multiple processing of received data.

[0009] This object is achieved by a method according to claim 1.

[0010] It is a further object of the present invention to provide a system control which enables improved redundancy switching, in particular while avoiding multiple processing of received data.

[0011] This object is achieved by a system control according to claim 14.

[0012] It is a further object of the present invention to provide a computer program product which enables improved redundancy switching, in particular while avoiding multiple processing of received data.

[0013] This object is achieved by a computer program product according to claim 15.

[0014] Preferred embodiments are the subject of the dependent claims and the following description.

[0015] A first aspect of the invention relates to a method, in particular a computer-implemented method, for operating a system control system, in particular for a rail vehicle, comprising: (i) receiving process input data packets sent in a network with the aid of a first control device and at least one further control device; (ii) processing at least some of the received process input data packets into process output data with the aid of the first control device; and (iii) sending a message via the network from the first control device to the at least one further control device, the message containing processing information which identifies the process input data packets last processed by the first control device.

[0016] One aspect of the invention is based on the approach of sending a message from a first data-processing control device to at least one further, redundant control device, wherein the message can be used to identify the data last processed by the first control device. In other words, the at least one further control device is informed of which data the first control device last processed. For this purpose, the message can, for example, contain processing information which identifies the data last processed by the first control device. If the data-processing, i.e. active, first control device fails, the at least one further control device can, on the basis of the message, essentially seamlessly take over the function of the failed control device.By informing the at least one further control device of the most recently processed data, it is possible to prevent the at least one further control device from detrimentally reprocessing the data. On the other hand, the processing information can also ensure that all received data is processed, i.e., that no data is skipped.

[0017] It is expedient if both the control device and the at least one further control device receive the same data, for example, in the form of process input data packets. This can be achieved with particularly low effort by integrating the control devices into a network configured for publish-subscribe communication. The control devices can thus subscribe to messages, i.e., process input data packets, from the same data-generating network participants.

[0018] Preferred embodiments of the invention and further developments thereof are described below, which, unless expressly excluded, can be combined with one another as desired and with the aspects of the invention described below.

[0019] In a preferred embodiment, the process input data packets contain identification information that identifies the respective process input data packet. The identification information can, for example, relate to the origin of the respective process input data packet, such as the respective sending data-generating network participant, and / or the time of generation, such as an iteration step of a work cycle of the network participant or the system. This allows the process input data packets to be uniquely assigned.

[0020] In order to facilitate the identification of the data packets last processed by the first control device, for example by the at least one further control device, the processing information is expediently based on the identification information of the process input data packets last processed by the first control device.

[0021] Assigning identification information to the data packets is particularly advantageous when cyclically sent process input data packets are received with the aid of the first control device and the at least one further control device in the network. The identification information then expediently contains cycle information which characterizes the iteration step of the cycle in which the respective process input data packet is sent. Using the cycle information, it is possible, for example, to quickly determine which of the process input data packets following the most recently processed process input data packets are intended for processing by the at least one further control device. The cycle information can thus be used in particular to prevent data loss from occurring during a redundancy switchover, i.e.After the failure of the first control device, process data input packets received from the at least one further control device are omitted from processing. On the other hand, the cycle information can also be used to prevent process input data packets from being processed unnecessarily multiple times—namely, first by the first control device and, after a redundancy switchover, again by the at least one further control device.

[0022] The cycle information can, for example, contain a counter. Preferably, the counter reading of the data packets last processed by the first control device is transmitted with the message to the at least one further control device. The counter is expediently incremented in each iteration step of the cycle. The cycle can be a working cycle of the corresponding network participant. Alternatively, the cycle can also be a working cycle of the control device(s) or of the entire system.

[0023] An effective and data-saving identification of the time of generation of a data packet can be achieved by implementing the counter as a field of a security protocol. For example, the so-called Safe Sequence Counter (SSC) in the SDTv2 security protocol, as defined in the IEC 61375-2-3 standard, can be used for this purpose.

[0024] In the event that the process input data packets are sent by several data-generating network participants, it is advantageous if the identification information contains participant information which identifies the respective data-generating network participant sending a process data packet. In other words, the participant information can relate to the origin of the respective data packet. The participant information enables a reliable assignment of the identification information, in particular the cycle information, to the data-generating network participants. Incoming data packets can thus be sorted according to the data-generating network participant. After a redundancy switchover, exactly one data packet to be processed next by the at least one further control device can be identified for each data-generating network participant.

[0025] In a further preferred embodiment, the message is transmitted after the process output data is sent over the network to at least one data-receiving network participant. This ensures that, in the event of a subsequent failure of the first control device, the already processed data packets are processed again.

[0026] In a further preferred embodiment, the process input data packets received by the first and the at least one further control device are each stored in at least one buffer memory. Thus, even during a dead time between the failure of the first control device and the takeover by the at least one further control device, incoming data packets can be retained for subsequent processing by the at least one further control device.

[0027] It is preferred that the buffer memory be designed as a ring buffer. This ensures that at least the most recent process input data packets are available for processing by the control devices. At the same time, an overflow of the buffer memory can be avoided. This is particularly advantageous with regard to a buffer memory that is assigned to the at least one further control device. This is because the at least one further control device expediently does not process any of the received process input data packets during data processing by the first control device.

[0028] It is also expedient for process input data packets to be deleted from the ring buffer after processing. This ensures that process input data packets already processed by a control device are not mistakenly processed again. In this respect, a buffer memory assigned to the first control device—or, after a redundancy switchover, a buffer memory assigned to at least one further control device—can be effectively prevented from overflowing.

[0029] To enable error-free operation of the system, the process input data packets stored in the buffer memory, in particular for each of the data-generating network participants, are pre-marked for processing by the control devices, preferably depending on the order in which they are received. In other words, the process input data packets can be pre-marked for processing according to the first-in, first-out principle. Alternatively or in addition to the first-in, first-out principle, the process input data packets can also be pre-marked for processing based on the cycle information, i.e., sorted accordingly, for example. This effectively allows "queues" to be generated in each buffer memory, which are expediently processed by the respectively active control device, i.e., initially by the first and, after a redundancy switchover, by the at least one further control device.During redundancy switching, the at least one additional control device—if several additional control devices are provided, one of the several control devices—can proceed directly with data processing at the appropriate point in the queue based on the processing information contained in the message. The selection of the control device to take over can be based on a predetermined sequence.

[0030] For the aforementioned case in which the process input data packets are sent by a plurality of data-generating network participants, it is preferred that the process input data packets received by the first and the at least one further control device are stored in such a way that the process input data packets can be assigned to the respective sending data-generating network participant. In particular, it is preferred that the received process input data packets are stored for each of the data-generating network participants depending on the order in which they are received by the control devices. In other words, a "queue" is preferably created for each data-generating network participant, for example in the aforementioned buffer or ring buffer.For example, using the participant information in each buffer or ring buffer, a database can be created from which the process input data packets can be extracted for processing according to the network participant generating the data and / or the time of their receipt or generation. Storing the process input data packets in this way ensures smooth and error-free data processing, particularly during redundancy switching.

[0031] In a further preferred embodiment, the message contains a system time of the first control device. This enables time synchronization of the control devices. In particular, it is also conceivable for a failure of the first control device to be detected by the at least one further control device on the basis of the transmitted system time. In particular, the at least one further control device can take over the function of the first control device when a predetermined dead time - during which no further message is received - has elapsed after receipt of the last message. Alternatively or additionally, the message can contain failure information relating to the first control device. For example, it is conceivable for the first control device to announce its own controlled failure by means of a corresponding identification in the message.The at least one further control device can then essentially directly assume the function of the first control device. This ensures particularly smooth operation of the system.

[0032] In this respect, it is preferred that the at least one further control device detects a failure of the first control device, for example on the basis of the system time contained in the message or by means of the failure information contained in the message. The at least one further control device then expediently processes process input data packets received from it on the basis of the processing information into process output data, which can be sent, for example, to data-receiving network participants. A redundancy switchover can thus be carried out automatically and, in particular, immediately after the failure of the first control device.

[0033] In order to be able to implement efficient data and memory management, input data packets stored in a buffer memory assigned to the at least one further control device, which have already been processed by the first control device, are preferably deleted on the basis of the processing information. In other words, it is advantageous to empty or "clean up" the buffer or ring memory, which is assigned in particular to the at least one further control device, as far as possible during the redundancy switchover. This makes it possible to create space for additional process input data packets, which arrive, for example, during the processing of process input data packets still held in the memory. In this respect, data loss can be avoided by deleting the already processed process input data packets during the redundancy switchover.

[0034] For data processing of the "correct" process input data packets, i.e. for error-free data processing, process input data packets stored in a buffer memory assigned to the at least one further control device are preferably identified on the basis of the processing information. In this case, process input data packets are expediently identified which were received immediately after those process input data packets which were last processed by the first control device. In other words, those process input data packets are expediently identified which are to be processed next according to the order in which they were received by the control devices. The identified process input data packets can then be processed by the at least one further control device.By identifying the process input data packets, the correct processing sequence can be ensured.

[0035] A second aspect of the invention relates to a system control, in particular for a rail vehicle, comprising a first control device and at least one further control device, each of which is configured to receive process input data sent in a network and to process at least a portion of the received process input data into process output data. The first control device is also configured to send a message to the at least one further control device via the network. The message contains processing information that identifies the process input data packets last processed by the first control device.

[0036] A control device within the meaning of the present invention can be a processing unit, preferably one that is data- or signal-connected to a memory and / or bus system, or at least comprise such a unit. A control device can in particular have a microprocessor unit (CPU) or a module thereof. The control device can be designed to process instructions that are implemented as a program stored in a memory system, to detect input signals from a data bus, in particular a network, and / or to output output signals to a data bus, in particular a network. A memory system can have one or more, in particular different, storage media, in particular optical, magnetic, solid-state and / or other non-volatile media. The program can be designed in such a way that it embodies the method according to the first aspect of the invention oris capable of carrying out, so that the control device can carry out the steps of this method and thus operate a system, in particular a rail vehicle.

[0037] Such a system control system can be implemented cost-effectively on the hardware side using standard components, such as appropriate processing units, storage systems, and / or the like. At the same time, such a system control system can at least reduce the risk of process input data packets being lost or processed multiple times during a redundancy switchover.

[0038] A third aspect of the invention relates to a computer program product containing instructions that cause a plant controller according to the second aspect of the invention to carry out the method according to the first aspect of the invention. Such a computer program product is expediently executed by the control devices of the plant controller.

[0039] A further aspect of the invention relates to a computer-readable storage medium on which the computer program product according to the third aspect of the invention is stored. The properties, features and advantages of the invention described above, as well as the manner in which these are achieved, are explained in more detail in conjunction with the figures in the following description of exemplary embodiments of the invention. Where appropriate, the same reference numerals are used in the figures for the same or corresponding elements of the invention. The exemplary embodiments serve to explain the invention and do not limit the invention to the combinations of features specified therein, including with regard to functional features.In addition, all features specified in the exemplary embodiments can be considered in isolation and combined in a suitable manner with the features of a method according to the first aspect of the invention, a system control according to the second aspect of the invention or a computer program product according to the third aspect of the invention.

[0040] It shows :

[0041] FIG 1 shows an example of a system control; and

[0042] FIG 2 shows an example of a method for operating a system control system.

[0043] FIG 1 shows an example of a system controller 10, in particular for a rail vehicle. The system controller 10 has a first control device 20 and at least one further control device 30. The control devices 20, 30 are expediently connected to a network 90, via which they can communicate with data-generating network participants 40 and data-receiving network participants 50. Preferably, each control device 20, 30 is assigned a buffer memory 21, 31. The first control device 20 is preferably configured to send a message 80, which concerns process input data packets 60 processed by the first control device 20, via the network 90 to the at least one further control device 30. This is useful for the function to be taken over by the at least one further control device 30 should the first control device 20 fail.

[0044] The control devices 20, 30 are basically all set up to receive process input data packets 60 sent in the network 90 and to process them - expediently deterministically, i.e. with the same result for the same process input data - to form process output data 70. Process input data packets 60 received and stored in the buffer memories 21, 31 are indicated in FIG. 1 by rectangles with solid lines - partially shown hatched. For reasons of clarity, only one of the process input data packets 60 is provided with a corresponding reference symbol. Free storage space in the buffer memories 21, 31 is indicated by dashed lines.

[0045] The network 90 is preferably configured for publish-subscribe communication. This means that the network 90 preferably supports multicast. This allows each data-generating network participant 40 to make process input data packets 60, generated in particular cyclically, available in the network 90 to all other network participants. Expediently, both the first and the at least one further control device 20, 30 are "subscribers," i.e., subscribers, of the data-generating network participants 40. Thus, the process input data packets 60 sent in this way can be received by each control device 20, 30.

[0046] Conveniently, the control devices 20, 30 can send the generated process output data 70 via the network 90, for example to the data-receiving network participants 50. For this purpose, the control devices 20, 30 can be configured to provide the process output data 70 via multicast in the network 90. ​​The data-receiving network participants 50 can then receive these as subscribers of the control devices 20, 30.

[0047] The data-generating network participants 40 can, for example, be sensors configured to monitor a process or to determine boundary conditions for the process. In this case, the process input data packets 60 correspond to sensor data.

[0048] The data-receiving network participants 50 can, for example, be actuators configured to execute the process. In this case, the process output data 70 are expediently control signals for controlling these actuators.

[0049] The process input data packets 60 expediently contain identification information with which the respective process input data packet 60 can be uniquely identified and / or assigned, for example to one of the data-generating network participants 40 or a point in time at which the respective process input data packet 60 was generated. For this purpose, the identification information can, for example, comprise participant information which specifies the network participant 40 generating the respective process input data packet 60. Alternatively or additionally, the identification information can comprise cycle information which specifies the iteration step of a cycle in which the respective process input data packet 60 was generated. The cycle information can, for example, be based on a counter whose value specifies the iteration step. The counter is expediently incremented with each iteration step.

[0050] Using the identification information, the process input data packets 60 can be stored in a structured manner in the buffer memories 21, 31. In particular, it is expedient if a queue 22a, 22b, 22c or 32a, 32b, 32c is created in the buffer memories 21, 31 for each of the data-generating network participants 40. In each of the queues 22a-22c, 32a-32c, the data packets 60 can be stored according to the order of their generation, i.e., for example, in ascending order according to the iteration step of the cycle, specifically for the corresponding data-generating network participant 40 to which the queue 22a-22c, 32a-32c is assigned.

[0051] The buffer memories 21, 31 are expediently designed as ring buffers. Each queue 22a-22c, 32a-32c preferably has a predetermined size. In other words, each buffer memory 21, 31 can store a predetermined number of process input data packets 60 for each data-generating network participant 40. The size of the queue 22a-22c, 32a-32c, and thus ultimately also the size or storage capacity of the buffer memories 21, 31, is preferably selected such that, in the event of a failure of the first storage device 20, all process input data packets 60 subsequently received from the at least one further control device 30 until its function is taken over can be stored in the corresponding buffer memory 31 without any data loss occurring.

[0052] In particular, the buffer memories 21, 31 can be configured such that the queues 22a-22c, 32a-32c each behave like a ring buffer in the event of an overflow. This means, for example, that in the event of an overflow of a queue 22a-22c, 32a-32c, the oldest received or stored process input data packet 60 in this queue 22a-22c, 32a-32c is preferably deleted or overwritten by a newly received process input data packet 60.

[0053] Preferably, the control devices 20, 30 are configured to process the process input data packets 60 for each of the data-generating network participants 40 in the order in which they are received. In other words, the control devices 20, 30 preferably process the data packets 60 from the buffer memories 21, 31 in accordance with the "first in, first out" principle. The first control device 20 is expediently configured to process the process input data packets 60 that are in first place in the queues 22a-22c, i.e., those that were received first. These data packets 60 are shown hatched.

[0054] The data packets 60 that are first in the queues 22a-22c expediently represent the state of the process. In other words, the process input data packets 60 that are first in the queue form a process image 61. The identification information of the process input data packets 60 that form the process image 61 expediently describes the composition of the process image 61. This composition can also be referred to as the input data configuration. Expediently, the process image 61 forms the basis for generating the process output data 70, for example, for controlling the data-receiving network participants 50.

[0055] Preferably, the first control device 20 is configured to communicate the input data configuration, i.e., those process input data packets 60 on which the output process output data 70 is based, to the at least one further control device 30 via the message 80. For this purpose, the message 80 expediently contains processing information which identifies the process input data packets 60 last processed by the first control device 20—i.e., specifically the input data configuration or the process image 61. For this purpose, the message 80 can, for example, refer to or contain the identification information, in particular the subscriber information and / or the cycle information, of the processed process input data packets 60.

[0056] The at least one further control device 30 is preferably configured to continue processing the process input data packets 60 based on the processing information contained in the message 80 should the first control device 20 fail. For this purpose, the at least one further control device 30 can identify those process input data packets 60 that form the process image 61 last considered by the first control device 20 in the buffer memory 31 assigned to it and / or the corresponding memory locations in the buffer memory 31.

[0057] These corresponding process input data packets 60 are also highlighted in the buffer memory 31 by hatching. As can be seen, these process input data packets 60 are not all at the top of the queues 32a-32c of the buffer memory 31. Such a situation can arise, for example, if the packet runtimes differ between the data-generating network participants 40 and the various control devices 20, 30. This problem is exacerbated if the data-generating network participants 40 send process input data packets 60 very quickly one after the other (i.e., the cycle times are very short, for example, a few milliseconds).

[0058] The at least one further control device 30 is preferably configured, based on the processing information received in the message 80, to process those process input data packets 60 that were received immediately after receiving those process input data packets 60 that form the process image 61 last considered by the first control device 20 (and are shown hatched). The at least one further control device 30 can expediently delete the process input data packets 60 last processed by the first control device 20 as well as all previously received process input data packets 60 from the buffer memory 31 assigned to it.

[0059] Even though only one additional control device 30 is shown and described in this example, it is fundamentally conceivable and advantageous to provide several additional control devices—and correspondingly additional buffer memories. Each of these additional control devices can then assume the function of a control device in accordance with a predetermined prioritization if its failure occurs. In this respect, a "redundancy chain" consisting of virtually any desired number of control devices can be formed with the system controller 10 shown in FIG. 1.

[0060] FIG 2 shows an example of a method 100 for operating a plant control system.

[0061] In a method step S 1, process input data packets sent in a network, preferably by multicast, are received with the aid of a first control device and at least one further control device. The received process input data packets are expediently stored for each of the control devices in a buffer memory, in particular a ring buffer. It is preferred if the received process input data packets are stored depending on their origin. For example, the received process input data packets can be stored in such a way that they can be assigned to the data-generating network participant who (generated and) sent them. Alternatively or additionally, the received process input data packets can be stored in such a way that they can be assigned to an iteration step in a cycle.For this purpose, for example, identification information of each received process input data packet can be read out.

[0062] In a further method step S2, the first control device processes at least a portion of the received process input data packets into process output data. It then expediently sends the process output data thus generated over the network, for example to data-receiving network participants, preferably via multicast.

[0063] It is preferred that the first control device processes at least some of the received process input data packets based on the order of their receipt and / or their origin. For example, the first control device can, in particular, process an input data configuration from a plurality of process input data packets, all of which were received and / or sent by the data-generating network participants at approximately the same time, in particular in the same iteration step of a cycle. This input data configuration expediently contains a process input data packet from each of the data-generating network participants.

[0064] In a further method step S3, a message is sent via the network from the first control device to the at least one further control device. This message is expediently sent as soon as the process output data has been generated and / or sent.

[0065] The message preferably contains processing information which identifies the process input data packets last processed by the first control device.

[0066] As a result, in a further method step S4, for example, the at least one further control device can check whether the first control device has failed. For this purpose, it can be checked, for example, whether a predetermined dead time has elapsed since receipt of the last message or whether the first control device has provided corresponding failure information about a controlled failure.

[0067] If the first control device has not failed, the method can be continued iteratively at method step S 1 .

[0068] Otherwise, the at least one further control device can take over the function of the failed first control device in a further method step S5. This is referred to as redundancy switching. In this case, the at least one further control device expediently processes process input data packets received from it, in particular stored in its assigned buffer memory, into process output data on the basis of the processing information. In this case, the at least one further control device preferably identifies and processes those process input data packets that have not yet been processed by the first control device.In particular, the at least one further control device can identify and process those process input data packets, in particular those of each network participant, which were received immediately after the process input data packets last processed by the first control device. Those process input data packets which are stored in the buffer memory assigned to the at least one further control device and which have already been processed by the first control device can also be identified and, if necessary, deleted on the basis of the processing information. All further process input data packets received following the failure of the first control device and buffered in the buffer memory can also be processed step by step in the following catch-up phase.

[0069] Although the invention has been illustrated and described in detail by means of the preferred embodiments, the invention is not limited by the disclosed examples and other variations can be derived therefrom by those skilled in the art without departing from the scope of the invention.

Claims

Patent claims 1. Method (100) for operating a plant control system (10) , comprising: - Receiving (Sl) process input data packets (60) sent in a network (90) using a first control device (20) and at least one further control device (30) ; - Processing (S2) at least a part of the received process input data packets (60) into process output data (70) using the first control device (20); and - Sending (S3) a message (80) over the network (90) from the first control device (20) to at least one further control device (30), wherein the message (80) contains processing information which identifies the last process input data packets (60) processed by the first control device (20).

2. Method (100) according to claim 1, wherein the process input data packets (60) contain identification information which identifies the respective process input data packet (60), and the processing information is based on the identification information of the process input data packets (60) last processed by the first control device (20).

3. Method (100) according to claim 2, wherein cyclically sent process input data packets (60) are received in the network (90) by means of the first control device (20) and the at least one further control device (30) and the identification information contains a cycle information which characterizes the iteration step of the cycle in which the respective process input data packet (60) is sent.

4. Method (100) according to claim 3, wherein the cycle information includes a counter which is incremented in each iteration step of the cycle.

5. Method (100) according to one of claims 2 to 4, wherein the process input data packets (60) are sent by several data-generating network participants (40) and the identification information contains participant information which identifies the respective data-generating network participant (40) sending a process input data packet (60).

6. Method (100) according to one of the preceding claims, wherein the process input data packets (60) received by the first and at least one further control device (20, 30) are each stored in at least one buffer memory (21, 31) designed as a ring buffer and are deleted from it after processing.

7. Method (100) according to claim 6, wherein the process input data packets (60) stored in the buffer memory (21, 31) are scheduled for processing by the control devices (20, 30) depending on the order of their receipt.

8. Method (100) according to one of claims 6 or 7, wherein the process input data packets (60) are sent by several data-generating network participants (40) and the process input data packets (60) received by the first and at least one further control device (20, 30) are stored in such a way that the process input data packets (60) can be assigned to the respective sending data-generating network participant (40).

9. Method (100) according to one of the preceding claims, wherein the message (80) contains a system time of the first control device (20).

10. Method (100) according to one of the preceding claims, wherein the message (80) contains failure information relating to the first control device (20).

11. Method (100) according to one of the preceding claims, wherein the at least one further control device (30) detects a failure of the first control device (20) (S4) and then processes process input data packets (60) received from it on the basis of the processing information into process output data (70) (S5) .

12. Method (100) according to the preceding claims, wherein, on the basis of the processing information, process input data packets (60) stored in one of the buffer storage devices (31) assigned to at least one further control device (30), which have already been processed by the first control device (20), are deleted.

13. Method (100) according to one of claims 11 or 12, wherein - based on the processing information in one of the buffer memories (31) assigned to at least one further control device (30), process input data packets (60) are identified which were received immediately after those process input data packets (60) that were last processed by the first control device (20), and - the identified process input data packets (60) are processed (S5) by at least one further control device (30).

14. Plant control (10) comprising a first control device (20) and at least one further control device (30), each configured to receive process input data packets (60) sent in a network (90) and to process at least a part of the received process input data packets (60) into process output data (70), wherein the first control device (20) is also configured to send a message (80) via the network (90) to the at least one further control device (30), wherein the message (80) is a processing- 15. A computer program product comprising instructions that cause a plant controller (10) according to claim 14 to execute the method (100) according to any one of claims 1 to 13.

Images