Redundant automation controller permitting replacement of components during operation
First Claim
1. A primary controller communicating with a secondary controller to, at a switch-over time, cease execution of a user program and cause the secondary controller to begin execution of the user program, the primary controller comprising:
- an electrical backplane having a series of electrical connectors halves;
functional modules having corresponding connector halves removably connected to the connector halves of the electrical backplane allowing the functional modules and allowing the functional modules to communicate with each other on the backplane and to communicate a fault status on the backplane when the functional modules detect a fault internal to the functional modules;
disconnection detection circuitry communicating with the backplane to;
(a) detect a fault status from a functional modules and in response to cause a switch-over of control to the secondary controller,(b) detect a removal of a functional module where such removal prevents communication of a fault status by the functional module and in response to cause a switchover of control to the secondary controller,(c) detect a reconnection of a functional module and absence of a fault status and in response to cause a return of control to the primary controller.
1 Assignment
0 Petitions
Accused Products
Abstract
On-line upgrading of a primary industrial controller is provided through the use of a secondary industrial controller that may assume control of the process controlled by the primary industrial controller. A switch-over of control is orchestrated by a system back-up module that may detect removal of the functional components of the primary industrial controller to initiate the switch-over. Determination of removal of functional modules may be provided by a periodic polling of the functional components on the interconnecting communication link. The system back-up module designates one of the functional modules to poll the system back-up module so that complete coverage of removable components may be had.
-
Citations
8 Claims
-
1. A primary controller communicating with a secondary controller to, at a switch-over time, cease execution of a user program and cause the secondary controller to begin execution of the user program, the primary controller comprising:
-
an electrical backplane having a series of electrical connectors halves; functional modules having corresponding connector halves removably connected to the connector halves of the electrical backplane allowing the functional modules and allowing the functional modules to communicate with each other on the backplane and to communicate a fault status on the backplane when the functional modules detect a fault internal to the functional modules; disconnection detection circuitry communicating with the backplane to; (a) detect a fault status from a functional modules and in response to cause a switch-over of control to the secondary controller, (b) detect a removal of a functional module where such removal prevents communication of a fault status by the functional module and in response to cause a switchover of control to the secondary controller, (c) detect a reconnection of a functional module and absence of a fault status and in response to cause a return of control to the primary controller. - View Dependent Claims (2, 3, 4, 5, 6)
-
-
7. A method of upgrading a primary controller executing a user program and including an electrical backplane having a series of electrical connector halves, and including functional modules having corresponding connector halves to be connected to the connector halves of the electrical backplane allowing the functional modules to communicate with each other thereon, and including disconnection detection circuitry communicating with the backplane to detect a removal of a functional module, the method comprising the steps of:
-
i) removing a functional module to be upgraded, from the backplane; ii) detecting the removal of the functional module with the disconnection detection circuitry; iii) in response to the detected removal, ceasing operation of the primary controller and initiating operation of a secondary controller also containing the user program; iv) upgrading the removed functional module; v) installing the upgraded functional module back into the backplane; vi) qualifying the primary controller; vii) in response to a switch-over signal, ceasing operation of the secondary controller and initiation operation of the primary controller executing the user program. - View Dependent Claims (8)
-
Specification