Control unit and method for operating an industrial automation system communication network comprising a plurality of communication devices

Patent metadata

Field	Value
Publication number	US-10890901-B2
Application number	US-201816633096-A
Country	US
Kind code	B2
Filing date	Jul 20, 2018
Priority date	Jul 28, 2017
Publication date	Jan 12, 2021
Grant date	Jan 12, 2021

Abstract

A control unit and method for operating an industrial automation system communication network that includes a plurality of communication devices, wherein a plurality of control units redundant with respect to each other controls functions of a plurality of associated communication devices, where the communication devices transmit communication-specific input variables to all associated redundant control units, output variables (produced by the control units redundant with respect to each other are checked for deviations from each other, and where if there are deviations, then a switchover is made to reserve control units or control units having output variables that deviate with respect to a majority of control units redundant to each other are deactivated.

First claim

The invention claimed is:

1. A method for operating an industrial automation system communication network comprising a plurality of communication devices, the method comprising: controlling, by a plurality of control units redundant with respect to each other, functions of a plurality of associated communication devices, mutually redundant control units of the plurality of control units comprising identically configured state machines, which in an error-free state generate identical output variables from identical input variables, the plurality of associated communication devices being assigned to a Software Defined Network (DPN) comprising a communication control plane designated as a Control Plane (CP) and a data transmission plane designated as a Data Plane (DP), and the plurality of control units being assigned to the Control Plane and the plurality of associated communication devices being assigned to the Data Plan; determining, by each control unit of the plurality of control units, for user-side communication service requests, a path between a first communication device at a first end node and a second communication device at a second end node via third communication devices which comprise at least one of (i) routers and (ii) switches, the plurality of control units specifying flow tables, from which at least one of (i) routing tables and (ii) forwarding tables are derived for third communication devices respectively assigned to the plurality of control units; determining, by the plurality of control units, whether necessary system resources are available along the determined paths during a scheduled usage period; reserving, by the plurality of control units, system resources necessary for the communication service requests in an event of each positive verification result and controlling routing or switching functions of the third-party communication devices in accordance with determined paths; transferring, by the plurality of associated communication devices, communication-specific input variables to all mutually associated redundant control units of the plurality of control units; checking the output variables generated by the mutually redundant control units for deviations from each other; and performing a switchover to reserve control units in an event of deviations or deactivating control units of the plurality of control units having output variables which deviate with respect to a majority of mutually redundant control units of the plurality of control units in an event the deviations.

2. The method as claimed in claim 1 , wherein state machines of the mutually redundant control units of the plurality of control units are replicated state machines.

3. The method as claimed in claim 1 , wherein the output variables generated by the mutually redundant control units of the plurality of control units are checked for deviations by one of (i) the assigned communication devices and (ii) the control units themselves.

4. The method as claimed in claim 2 , wherein the output variables generated by the mutually redundant control units of the plurality of control units are checked for deviations by one of (i) the assigned communication devices and (ii) the control units themselves.

5. The method as claimed in claim 1 , wherein the deactivation of control units having output variables that deviate with respect to a majority of mutually redundant control units is performed by one of (i) assigned communication devices and (ii) the control units themselves.

6. The method as claimed in claim 5 , wherein the deactivation of control units having output variables which deviate with respect to a majority of mutually redundant control units is performed by ignoring deviating output variables in the assigned communication devices.

7. The method as claimed in claim 1 , wherein the mutually redundant control units compare input variables received from assigned communication devices against one another; and wherein control units having input variables which deviate with respect to a majority of mutually redundant control units are deactivated.

8. The method as claimed in claim 7 , wherein the control units having input variables that deviate with respect to the majority of mutually redundant control units deactivate themselves.

9. The method as claimed in claim 8 , wherein the control units having input variables that deviate with respect to the majority of mutually redundant control units deactivate themselves by a process of generating output variables being stopped or suspended.

10. The method as claimed in claim 1 , wherein are provided, in which one pair of mutually redundant main control units of pairs of mutually redundant control units of the plurality of control units is initially activated, and wherein a switchover is performed from the pair of mutually redundant main control units to a pair of mutually redundant reserve control units in an event of deviations of the output variables generated by the mutually redundant main control units.

11. The method as claimed in claim 10 , wherein pairs of the mutually redundant main control units monitor each other for at least one of differing input and output variables and deactivate themselves when deviations are found.

12. The method as claimed in claim 10 , wherein pairs of mutually redundant main control units which are assigned to the communication devices are entered in a list; and wherein former main control units entered in the list are excluded from use as reserve control units for the respective communication devices.

13. The method as claimed in claim 11 , wherein pairs of mutually redundant main control units which are assigned to the communication devices are entered in a list; and wherein former main control units entered in the list are excluded from use as reserve control units for the respective communication devices.

14. The method as claimed in claim 10 , wherein the assigned communication devices switch over from the main control units to the reserve control units in an event of at least one of (i) deviating output variables of the mutually redundant main control units of the plurality of control units and (ii) a self-deactivation indicated by the mutually redundant main control units.

15. The method as claimed in claim 10 , wherein the output variables of the mutually redundant main control units for a pairwise mutual monitoring are transmitted to a respective other main control unit via each at least two disjoint paths; and wherein the mutually redundant main control units remain activated as long as said mutually redundant main control units receive output variables of the other main control unit which match theft own output variables via at least one path.

16. The method as claimed in claim 10 , wherein the output variables of the mutually redundant main control units are transmitted to the assigned communication devices via at least two disjoint paths per main control unit; and wherein the mutually redundant main control units for the respective assigned communication device remain activated as long as the respective assigned communication device receives matching output variables from both main control units via at least two paths and output variables that differ from each other via remaining paths.

17. The method as claimed in claim 1 , wherein the communication network is divided into a plurality of partitions comprising specifiable shares of system resources of communication devices which are assigned to the respective partition;
wherein for user-side communication service requests within the partition assigned to the respective user t

Assignees

• Siemens Ag

Inventors

• Sakic Ermin
• Zirkler Andreas

Classifications

• H04L41/342

  between virtual entities, e.g. orchestrators, SDN or NFV entities · CPC title

• H04L41/40

  using virtualisation of network functions or resources, e.g. SDN or NFV entities · CPC title

• H04L41/0695

  the faulty arrangement being the maintenance, administration or management system · CPC title

• Y02P90/80

  Management or planning · CPC title

• G05B2219/14124

  Redundant network, client server nodes · CPC title