Virtualized Control Software Failover Using Prioritized State Transfer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In containerized and clustered environments, maintaining the reliability and availability of industrial process control systems is challenging due to difficulties in synchronizing internal states across multiple control application instances, especially in scenarios requiring high communication overhead and flexible integration with failover mechanisms.
Innovation Solution
The method involves prioritizing subsets of internal variables from an active instance of control software and transferring them to further instances for seamless failover, using a failover manager to configure and orchestrate communication channels, and employing virtualized execution environments to facilitate flexible deployment and resource management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If complete synchronization among multiple control application instances is implemented, then reliability is improved, but communication overhead increases and system complexity increases
Solution Approach 1:
The patent segments the internal state of the control application into multiple components (process variables, control variables, configuration data). Instead of synchronizing the complete state, only critical segments are transferred between instances, reducing communication overhead while maintaining reliability through selective state replication.
Solution Approach 2:
The patent extracts and transfers only the essential internal state variables needed for failover from the active instance to standby instances. This extraction approach avoids transferring unnecessary data, reducing communication overhead while ensuring that the critical state information is available for seamless failover.
2Reliability
If redundant controllers are synchronized via dedicated high-bandwidth communication channel, then reliability is improved, but device complexity and cost increase
Solution Approach 1:
The patent enables standard communication infrastructure to serve multiple purposes: normal control data exchange and state synchronization for failover. By making the communication system multi-functional, dedicated high-bandwidth channels are replaced with existing infrastructure that can handle both control traffic and state replication traffic.
Solution Approach 2:
The patent creates simplified copies of the critical internal state variables and transfers them between controller instances. Instead of requiring complex dedicated synchronization mechanisms, the system uses straightforward copying and transmission of state data over standard communication channels, reducing infrastructure complexity.
3Reliability
If state is persisted to non-volatile storage in every execution cycle, then reliability is improved, but use of energy and writing operations increase
Solution Approach 1:
The patent implements periodic state persistence only when necessary for failover, rather than continuous persistence in every execution cycle. The system selectively persists critical state variables at appropriate intervals or trigger events, reducing the frequency of write operations and associated energy consumption while maintaining reliability.
Solution Approach 2:
The patent extracts only the essential state variables that need to be persisted for failover purposes, rather than persisting the complete internal state. This selective persistence approach reduces the amount of data written to non-volatile storage, thereby reducing energy consumption and write operations.
4Measurement precision
If tight coupling of individual control application instances is implemented, then synchronization accuracy is improved, but adaptability and flexibility decrease
Solution Approach 1:
The patent implements dynamic failover mechanisms where standby instances can be activated based on the failure mode and system state. The coupling between instances is dynamic rather than fixed, allowing the system to adapt to different failure scenarios and operational requirements while maintaining synchronization accuracy for critical variables.
Solution Approach 2:
The patent applies different synchronization strategies to different variables based on their criticality. Critical process variables maintain tight coupling for high synchronization accuracy, while less critical variables use more flexible synchronization approaches. This local differentiation of coupling strength maintains accuracy where needed while preserving system flexibility.
5Reliability
If multiple redundant control application instances are deployed, then reliability is improved, but communication overhead and setup difficulty increase
Solution Approach 1:
The patent segments the failover configuration into manageable components: active instance definition, standby instance configuration, and state variable selection. This segmentation allows systematic deployment of multiple redundant instances without overwhelming complexity, as each instance can be configured independently using the same template approach.
Solution Approach 2:
The patent uses template-based configuration where a single active instance configuration can be copied and adapted to create multiple standby instances. This copying approach with parameterization simplifies the deployment of multiple redundant instances, as the same configuration pattern can be replicated across different instances with minimal manual setup.
Data Source
AI summary
A method for controlling an industrial process includes providing process data of the industrial process to an active instance of a control software as input, based on this input, updating an internal state of the active instance of the control software that is characterized by a set of internal variables of this active instance; based on this updated internal state, determining an output signal and outputting this output signal to at least one piece of equipment that is configured to alter a state, and/or a behavior, of the industrial process. The method further includes providing a prioritized subset of the internal variables that characterize the state of the active instance to at least one further instance of a control software that is configured to take over control of the industrial process in case of a failure and/or malfunction of the active instance.