Fault tolerant industrial automation control system

Patent metadata

Field	Value
Publication number	US-10073749-B2
Application number	US-201514959392-A
Country	US
Kind code	B2
Filing date	Dec 4, 2015
Priority date	Jun 14, 2013
Publication date	Sep 11, 2018
Grant date	Sep 11, 2018

Abstract

A combination of a component-based automation framework, software-based redundancy patterns, and a distributed, reliable runtime manager, is able to detect host failures and to trigger a reconfiguration of the system at runtime. This combined solution maintains system operation in case a fault occurs and, in addition, automatically restores fault tolerance by using backup contingency plans, and without the need for operator intervention or immediate hardware replacement. A fault-tolerant fault tolerance mechanism is thus provided, which restores the original level of fault tolerance after a failure has occurred—automatically and immediately, i.e., without having to wait for a repair or replacement of the faulty entity. In short, the invention delivers increased availability or uptime of a system at reduced costs and complexity for an operator or engineer by adapting automatically to a new environment.

First claim

The invention claimed is:

1. A method of providing fault tolerance in an Industrial Automation and Control System IACS including a plurality of hosts connected to a communication bus, wherein each host executes cyclically a number of components according to a configuration, comprising the steps of:
executing an active instance of a critical component on a first host and synchronizing a first standby instance of the critical component instantiated on a second host with the active instance;
detecting a failure of the first host;
activating a first backup configuration including executing the first standby instance as the now active instance of the critical component on the second host, and including synchronizing therewith a second standby instance of the critical component instantiated on a third host;
providing first backup configurations to each host;
detecting a failure of the first host by all further hosts; and
activating, at all further hosts, a first backup configuration corresponding to the failure of the first host.

2. The method of claim 1 , comprising
providing a second backup configuration including assigning a third standby instance of the critical component to a fourth host.

3. A computer program product including computer program code for controlling one or more processors of an Industrial Automation Control System IACS including a plurality of execution hosts connected to a communication bus, wherein each host executes cyclically a number of components according to a configuration, the program comprising the steps of:
executing an active instance of a critical component on a first host and synchronizing a first standby instance of the critical component instantiated on a second host with the active instance;
detecting a failure of the first host;
activating a first backup configuration including executing the first standby instance as the now active instance of the critical component on the second host, and including synchronizing therewith a second standby instance of the critical component instantiated on a third host;
providing first backup configurations to each host;
detecting a failure of the first host by all further hosts; and
activating, at all further hosts, a first backup configuration corresponding to the failure of the first host.

4. An Industrial Automation System having one or more processors and a computer program product including computer program code for controlling the one or more processors to perform the following process steps: executing an active instance of a critical component on a first host and synchronizing a first standby instance of the critical component instantiated on a second host with the active instance; detecting a failure of the first host; activating a first backup configuration including executing the first standby instance as the now active instance of the critical component on the second host, and including synchronizing therewith a second standby instance of the critical component instantiated on a third host; providing first backup configurations to each host; detecting a failure of the first host by all further hosts; and activating, at all further hosts, a first backup configuration corresponding to the failure of the first host.

Assignees

• Abb Schweiz Ag

Inventors

• Ferranti Ettore
• Oriol Manuel
• Wahler Michael
• Gooijer Thijmen De
• Gamer Thomas

Classifications

• G05B23/0208 Primary

  characterized by the configuration of the monitoring system · CPC title

• G06F2201/805

  Real-time · CPC title

• G06F11/1658

  Data re-synchronization of a redundant component, or initial sync of replacement, additional or spare unit · CPC title

• G06F11/203 Primary

  using migration · CPC title