Redundant Automation System

• US 20150095690A1
• Filed: 10/01/2014
• Published: 04/02/2015
• Est. Priority Date: 10/01/2013
• Status: Active Grant

• Current Assignee: Siemens AG
• Original Assignee: Siemens AG
• Inventors: Grosch, Thomas, Renschler, Albert, Laforsch, Jrgen
• Granted Patent: US 9,405,644 B2
• Time in Patent Office: Days
• US Class Current: 714/4.11
• CPC Class Codes: G05B 19/058 Safety, monitoring
• CPC Class Codes: G05B 2219/14129 Primary, worker and backup, coworker plc for testing I-O
• CPC Class Codes: G05B 2219/14131 Workby plc, all plc function in parallel, synchronous data exchange
• CPC Class Codes: G06F 11/2023 Failover techniques
• CPC Class Codes: G06F 11/2097 maintaining the standby controller/processing unit updated initialisation or re-synchronisation thereof G06F11/1658 and subgroups

Abstract

A redundant automation system having a plurality of automation devices which are connected to one another comprises a plurality of master devices and a slave device. Each of the plurality of automation devices processes a control program in order to control a technical process. At least one of the plurality of automation devices operates as a slave and at least two of the plurality of automation devices, each operates as a master. The plurality of master devices is each configured to run a respective master program and to process processing sections of the respective master program of the respective master program, and the slave device is configured to process a corresponding slave control program for each master control program run by the plurality of master devices and, if one of the plurality of master devices fails, to assume the function of the failed master.

Claims

1. A redundant automation system having a plurality of automation devices which are connected to one another, wherein each of the plurality of automation devices processes a control program in order to control a technical process and wherein at least one of the plurality of automation devices operates as a slave and at least two of these automation devices each operates as a master, the redundant automation system comprising:

a plurality of master devices, each configured to run a respective master program and to process processing sections of the respective master program of the respective master program; and

a slave device configured to process a corresponding slave control program for each master control program run by the plurality of master devices and, if one of the plurality of master devices fails, to assume the function of the failed master,

wherein each of the plurality of master devices is further configured to transmit a master release to the slave device after an event has occurred or after the expiry of a predefined interval of time,

wherein the master release indicates to the slave device the processing section up to which the slave device can process the slave control program corresponding to the master control program of the failed master device,

wherein the slave device is further configured to process processing sections of the slave control programs on the basis of the master releases,

wherein the processing sections correspond to those processing sections of the master control programs that have already been processed from previous master releases to the current master releases.

2. The redundant automation system of claim 1, wherein the slave device is further configured to acknowledge the respective master release to the respective master device after the respective processing sections have been processed.

3. The redundant automation system of claim 1,

wherein the automation system is configured to provide breakpoints in the master control program using the respective master device and in the slave control programs using the slave device at the beginning and end of the respective processing section, respectively,

wherein the respective master device is configured to provide as the beginning of an interval of time following the respective interval of time one of (1) the time at which a breakpoint following the respective interval of time occurs and (2) the time at which a breakpoint following the occurrence of the event occurs, and

wherein the respective master device is further configured to transmit the master release to the slave device at the time mentioned in (1) or (2) above.

4. The redundant automation system of claim 1, wherein the respective master device is further configured to transmit process input values to the slave device at the time when the master release is transmitted.

5. The redundant automation system of claim 1, wherein the master devices and the slave device are coupled to one another via one of bus topology, ring topology, star topology and a mixed foam of any of bus, star, and ring topologies.

6. The redundant automation system of claim 1, wherein the connection is redundant.

7. The redundant automation system of claim 1, wherein the slave device is a multi-core-based or PC-based unit.

8. A slave device for a redundant automation system of claim 1, wherein the redundant automation system is provided with a plurality of automation devices which are connected to one another, wherein each of the plurality of automation devices processes a control program in order to control a technical process, and wherein one of the plurality of automation devices operates as a slave device and at least two of the plurality of automation devices, each operates as a master device, wherein the slave device is configured to:

process a corresponding slave control program for each master control program run by respective master device and, if one of the master devices fails, to assume the function of the failed master device; and

to process processing sections of the slave control programs on the basis of the master releases, wherein the processing sections correspond to those processing sections of the master control programs that have already been processed from previous master releases to the current master releases.