Distributed Controller Failover for Online Upgrade Stability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for upgrading and maintaining distributed control systems in industrial settings, such as power generation units, often require interrupting operations, leading to costly downtime and reliability issues due to unpredictable state changes and unbalanced resource allocation, which can result in system instability and loss of customer trust.
Innovation Solution
A system and method for online installation and upgrade of distributed control systems that utilize a high-level controller and a low-level controller, where the low-level controller can assume control in case of connection loss, allowing for software updates without interrupting operations, and includes health monitoring and prioritization mechanisms to ensure stability and resource allocation based on application importance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If control system is upgraded by distributing control across multiple identical controllers, then system availability is improved, but system stability deteriorates due to unpredictable state changes during upgrade
Solution Approach 1:
The control system is segmented into a primary control system and a secondary control system, each capable of independent operation. The hardware asset is divided into portions controlled by each system, allowing one system to be upgraded while the other maintains stable control of its assigned portion. This segmentation prevents unpredictable state changes from affecting the entire system during upgrades.
Solution Approach 2:
Before initiating an upgrade to the primary control system, the system preliminarily transfers control of specific hardware asset portions to the secondary control system. This preliminary action ensures that control authority is already established and stable before the upgrade process begins, preventing instability during the transition.
2Adaptability or versatility
If control is distributed across multiple controllers, then flexibility is improved, but resource allocation balance deteriorates with unbalanced CPU and network bandwidth consumption
Solution Approach 1:
The system implements local quality by assigning different resource allocation characteristics to different control functions. Critical control functions receive prioritized CPU time and network bandwidth, while non-critical functions receive standard allocation. This ensures that resource allocation is optimized locally for each function's requirements rather than applying uniform allocation across all functions.
3Use of energy by moving object
If low-priority tasks are allowed to consume excessive CPU time, then computational resource utilization is improved, but control responsiveness deteriorates with preemption of higher-priority tasks
Solution Approach 1:
The system implements dynamic task scheduling where CPU time allocation is not fixed but adjusts based on system state and task priority. When critical control tasks require immediate attention, the system dynamically reduces allocation to lower-priority tasks, ensuring control responsiveness is maintained while still allowing efficient utilization of CPU resources during less critical periods.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems (100) and methods (400) for health monitoring and upgrade of a distributed controller are provided. According to one embodiment of the disclosure, a method (400) for health monitoring and upgrade of a distributed controller may commence with receiving, by a lower level controller from a high-level controller (105), high-level control references. The method (400) may further include generating low-level control references for a hardware asset (314) based at least in part on the high-level control references. The method (400) may include monitoring the network connection and detecting an error in the network connection. In response to the detection of the error in the network connection, a control of the hardware asset (314) may be transferred to the low-level controller (115). The method (400) may further include determining that the network connection has been restored. In response to the determination that the network connection has been restored, the control of the hardware asset (314) may be transferred to the high-level controller (105).