SYSTEM AND METHOD FOR CONTROLLER REDUNDANCY AND CONTROLLER NETWORK REDUNDANCY WITH ETHERNET/IP I/O

• US 20160036626A1
• Filed: 08/01/2014
• Published: 02/04/2016
• Est. Priority Date: 08/01/2014
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Bale, Sunil, Atukuri, Srinivas, Felix, Joseph
• Granted Patent: US 9,699,022 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 12/40176 involving redundancy error detection or correction of the data by redundancy in hardware using active fault-masking in interconnections G06F11/2002; error detection or correction of the data by redundancy in hardware using active fault-masking in storage systems using spares or by reconfiguring G06F11/2053
• CPC Class Codes: H04L 41/0663 Performing the actions predefined by failover planning, e.g. switching to standby network elements
• CPC Class Codes: H04L 41/0677 Localisation of faults
• CPC Class Codes: H04L 49/30 Peripheral units, e.g. input or output ports
• CPC Class Codes: H04L 49/555 Error detection

Abstract

An apparatus includes a first controller having at least one interface and at least one processing device. The at least one interface is configured to communicate with a second controller and with a controlled network having multiple EtherNet/IP-compatible input/output (I/O) modules and multiple EtherNet/IP-compatible controlled devices. The at least one processing device is configured to detect a fault associated with the second controller while the second controller is in communication with at least one of the I/O modules and at least one of the controlled devices. The at least one processing device is also configured, upon detection of the fault associated with the second controller, to resume the communication with the at least one I/O module and the at least one controlled device without the at least one I/O module updating the at least one controlled device to a failsafe condition.

Claims

1. An apparatus comprising:

a first controller comprising;

at least one interface configured to communicate with a second controller and with a controlled network comprising multiple EtherNet/IP-compatible input/output (I/O) modules and multiple EtherNet/IP-compatible controlled devices; and

at least one processing device configured to;

detect a fault associated with the second controller while the second controller is in communication with at least one of the I/O modules and at least one of the controlled devices; and

upon detection of the fault associated with the second controller, resume the communication with the at least one I/O module and the at least one controlled device without the at least one I/O module updating the at least one controlled device to a failsafe condition.

2. The apparatus of claim 1, wherein:

the at least one interface comprises first and second interfaces configured to communicate over a first controller network and a second controller network; and

the at least one processing device is further configured to;

detect a fault associated with the first controller network while the first controller is in communication with the at least one I/O module and the at least one controlled device over the first controller network; and

upon detection of the fault associated with the first controller network, switch the communication with the at least one I/O module and the at least one controlled device to the second controller network without the at least one I/O module updating the at least one controlled device to the failsafe condition.

3. The apparatus of claim 2, wherein the at least one interface further comprises a third interface configured to communicate with the second controller.

4. The apparatus of claim 3, wherein the third interface is configured to connect to a wired Ethernet connection that directly couples the first controller to the second controller and that transports controller status information between the first controller and the second controller.

5. The apparatus of claim 2, wherein each of the first and second interfaces is configured to communicably connect to at least one switch that routes communications between the first controller and the controlled network.

6. The apparatus of claim 1, wherein the at least one processing device is configured to resume the communication with the at least one I/O module and the at least one controlled device without the at least one I/O module setting an operating parameter of the at least one controlled device to a failsafe value.

7. The apparatus of claim 1, wherein the apparatus is configured for use in an EtherNet/IP process control system associated with an industrial plant.

8. A method comprising:

detecting, at a first controller configured to communicate with a second controller, a fault associated with the second controller while the second controller is in communication with at least one of multiple EtherNet/IP-compatible input/output (I/O) modules and at least one of multiple EtherNet/IP-compatible controlled devices in a controlled network; and

upon detection of the fault associated with the second controller, resuming the communication with the at least one I/O module and the at least one controlled device at the first controller without the at least one I/O module updating the at least one controlled device to a failsafe condition.

9. The method of claim 8, wherein:

the first controller is configured to communicate over a first controller network and a second controller network; and

the method further comprises;

detecting a fault associated with the first controller network while the first controller is in communication with the at least one I/O module and the at least one controlled device over the first controller network; and

upon detection of the fault associated with the first controller network, switching the communication with the at least one I/O module and the at least one controlled device to the second controller network without the at least one I/O module updating the at least one controlled device to the failsafe condition.

10. The method of claim 9, further comprising:

communicating directly with the second controller over a direct connection.

11. The method of claim 10, wherein communicating directly with the second controller comprises receiving controller status information from the second controller over a wired Ethernet connection that directly couples the first controller to the second controller.

12. The, method of claim 10, wherein communicating directly with the second controller comprises receiving information identifying the at least one I/O module and the at least one controlled device and what data was exchanged with the at least one I/O module and the at least one controlled device.

13. The method of claim 9, wherein the first controller is communicably connected to at least one switch that routes communications between the first controller and the controlled network.

14. The method of claim 8, wherein an operating parameter of the at least one controlled device is set to a failsafe value in the failsafe condition.

15. The method of claim 8, wherein the first controller is configured for use in an EtherNet/IP process control system associated with an industrial plant.

16. A non-transitory computer readable medium encoded with computer-executable instructions that when executed cause at least one processing device to:

detect, at a first controller configured to communicate with a second controller, a fault associated with the second controller while the second controller is in communication with at least one of multiple EtherNet/IP-compatible input/output (I/O) modules and at least one of multiple EtherNet/IP-compatible controlled devices in a controlled network; and

upon detection of the fault associated with the second controller, resume the communication with the at least one I/O module and the at least one controlled device at the first controller without the at least one I/O module updating the at least one controlled device to a failsafe condition.

17. The non-transitory computer readable medium of claim 16, wherein:

the first controller is configured to communicate over a first controller network and a second controller network; and

the non-transitory computer readable medium is encoded with computer-executable instructions that when executed cause the at least one processing device to;

detect a fault associated with the first controller network while the first controller is in communication with the at least one I/O module and the at least one controlled device over the first controller network; and

upon detection of the fault associated with the first controller network, switch the communication with the at least one I/O module and the at least one controlled device to the second controller network without the at least one I/O module updating the at least one controlled device to the failsafe condition.

18. The non-transitory computer readable medium of claim 17, wherein the non-transitory computer readable medium is encoded with computer-executable instructions that when executed cause the at least one processing device to:

communicate directly with the second controller.

19. The non-transitory computer readable medium of claim 18, wherein the computer-executable instructions that when executed cause the at least one processing device to communicate directly with the second controller comprises:

computer-executable instructions that when executed cause the at least one processing device to transmit controller status information to the second controller over a wired Ethernet connection that directly couples the first controller to the second controller.

20. The non-transitory computer readable medium of claim 18, wherein the computer-executable instructions that when executed cause the at least one processing device to communicate directly with the second controller comprises:

computer-executable instructions that when executed cause the at least one processing device to receive information identifying the at least one I/O module and the at least one controlled device and what data was exchanged with the at least one I/O module and the at least one controlled device.