Redundant Controller Synchronization for Bumpless Failover
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In process control systems, redundant controllers face challenges in synchronizing state information efficiently across primary and backup controllers, especially during mismatch conditions, leading to potential disruptions and increased network traffic, and the risk of stale data during failover.
Innovation Solution
Implementing a control synchronization program that separates control routines into distinct areas, allowing for timely transfer of state variables and calculating necessary values using recent process outputs during mismatches, enabling the backup controller to advertise readiness for failover without receiving all state variables.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the backup controller waits to receive all state variables from the primary controller before advertising readiness, then data consistency is improved, but system availability and failover speed deteriorate during mismatch conditions
Solution Approach 1:
The backup controller advertises readiness to take over control when it has received a subset of state variables, not necessarily all of them. This partial action allows the system to achieve failover capability without waiting for complete state synchronization, thus improving system availability while maintaining sufficient data consistency for safe operation transition.
2Measurement precision
If the backup controller receives all state variables during mismatch conditions, then data consistency is improved, but network traffic and synchronization time increase
Solution Approach 1:
The system performs preliminary actions by having the backup controller advertise readiness before complete state variable reception. This allows the failover process to begin in advance, reducing synchronization time and preventing deadlock situations where the system would wait indefinitely for complete state transfer during controller mismatches.
3Reliability
If the backup controller advertises readiness without receiving all state variables, then system availability is improved, but risk of stale data during failover increases
Solution Approach 1:
The system uses an intermediary mechanism where the backup controller can advertise readiness to take over based on partial state information. This intermediary state allows the system to transition control while managing the risk of stale data through controlled failover procedures, balancing availability improvement against information completeness.
Data Source
AI summary
The present invention relates generally to process control systems and devices and, more particularly, to an apparatus for and a method of implementing redundant controller synchronization for bump-less failover during normal and mismatch conditions at the redundant controllers. The redundant controllers are configured to transmit state information of the process control areas of the primary controller to the backup controller that is necessary for synchronizing the redundant controllers but is not typically transmitted to other devices during the performance of process control functions. Synchronization messages are transmitted from the primary controller to the backup controller each time one of the control areas executes to perform process control functions. In other aspects, the redundant controllers are configured to determine state information at the backup controller from other process control network information during a failover of the primary controller where a mismatch condition exists between the control areas of the two controllers during the downloading of reconfigurations, and to initialize the backup controller at startup when the mismatch condition exists.