System and method for controller redundancy and controller network redundancy with ethernet/IP I/O

• US 9,699,022 B2
• Filed: 08/01/2014
• Issued: 07/04/2017
• Est. Priority Date: 08/01/2014
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Bale, Sunil, Atukuri, Srinivas, Felix, Joseph
• Primary Examiner(s): ANWAR, MOHAMMAD S
• Application Number:
  US14/449,968
• Publication Number:
  US 20160036626A1
• Time in Patent Office: 1,068 Days
• CPC Class Codes: H04L 12/40176 involving redundancy error detection or correction of the data by redundancy in hardware using active fault-masking in interconnections G06F11/2002; error detection or correction of the data by redundancy in hardware using active fault-masking in storage systems using spares or by reconfiguring G06F11/2053
• CPC Class Codes: H04L 41/0663 Performing the actions predefined by failover planning, e.g. switching to standby network elements
• CPC Class Codes: H04L 41/0677 Localisation of faults
• CPC Class Codes: H04L 49/30 Peripheral units, e.g. input or output ports
• CPC Class Codes: H04L 49/555 Error detection

Abstract

An apparatus includes a first controller having at least one interface and at least one processing device. The at least one interface is configured to communicate with a second controller and with a controlled network having multiple EtherNet/IP-compatible input/output (I/O) modules and multiple EtherNet/IP-compatible controlled devices. The at least one processing device is configured to detect a fault associated with the second controller while the second controller is in communication with at least one of the I/O modules and at least one of the controlled devices. The at least one processing device is also configured, upon detection of the fault associated with the second controller, to resume the communication with the at least one I/O module and the at least one controlled device without the at least one I/O module updating the at least one controlled device to a failsafe condition.

Claims

1. An apparatus comprising:

a first controller configured to generate control signals for control of multiple Ethernet/Industrial Protocol (EtherNet/IP)-compatible controlled field devices, the first controller comprising;

first and second interfaces configured to communicate with a controlled network comprising multiple EtherNet/IP-compatible input/output (I/O) modules and the multiple EtherNet/IP-compatible controlled field devices, the first interface configured to communicate over a first controller network and the second interface configured to communicate over a second controller network, each of the first and second interfaces configured to communicably connect to at least one switch that routes communications between the first controller and the controlled network;

a third interface configured to communicate with a second controller; and

at least one processing device configured to;

detect a fault associated with the second controller while the second controller is in communication with at least one of the I/O modules and at least one of the controlled field devices;

upon detection of the fault associated with the second controller, resume the communication with the at least one I/O module and the at least one controlled field device without the at least one I/O module updating the at least one controlled field device to a failsafe condition;

detect a fault associated with the first controller network while the first controller is in communication with the at least one I/O module and the at least one controlled field device over the first controller network; and

upon detection of the fault associated with the first controller network, switch the communication with the at least one I/O module and the at least one controlled field device to the second controller network without the at least one I/O module updating the at least one controlled field device to the failsafe condition.

2. The apparatus of claim 1, wherein the third interface is configured to connect to a wired Ethernet connection that directly couples the first controller to the second controller and that transports controller status information between the first controller and the second controller.

3. The apparatus of claim 1, wherein the at least one processing device is configured to resume the communication with the at least one I/O module and the at least one controlled field device without the at least one I/O module setting an operating parameter of the at least one controlled field device to a failsafe value.

4. The apparatus of claim 1, wherein the apparatus is configured for use in an EtherNet/IP process control system associated with an industrial plant.

5. The apparatus of claim 1, wherein:

the first interface is configured to connect to at least one first wired connection that forms a portion of the first controller network; and

the second interface is configured to connect to at least one second wired connection that forms a portion of the second controller network.

6. The apparatus of claim 5, wherein:

the first interface is configured to communicably connect to a first firewall connected to the at least one first wired connection; and

the second interface is configured to communicably connect to a second firewall connected to the at least one second wired connection.

7. The apparatus of claim 5, wherein the detected fault associated with the first controller network comprises a cable break in the at least one first wired connection.

8. A method comprising:

detecting, at a first controller configured to communicate with a second controller, a fault associated with the second controller while the second controller is in communication with at least one of multiple Ethernet/Industrial Protocol (EtherNet/IP)-compatible input/output (I/O) modules and at least one of multiple EtherNet/IP-compatible controlled field devices in a controlled network, the first controller configured to generate control signals for control of the multiple EtherNet/IP-compatible controlled field devices, the first controller also configured to communicate over a first controller network via a first interface and to communicate over a second controller network via a second interface, each of the first and second interfaces communicably connected to at least one switch that routes communications between the first controller and the controlled network;

upon detection of the fault associated with the second controller, resuming the communication with the at least one I/O module and the at least one controlled field device at the first controller without the at least one I/O module updating the at least one controlled field device to a failsafe condition;

detecting, at the first controller, a fault associated with the first controller network while the first controller is in communication with the at least one I/O module and the at least one controlled field device over the first controller network; and

upon detection of the fault associated with the first controller network, switching the communication with the at least one I/O module and the at least one controlled field device to the second controller network without the at least one I/O module updating the at least one controlled field device to the failsafe condition.

9. The method of claim 8, further comprising:

communicating directly with the second controller over a direct connection.

10. The method of claim 9, wherein communicating directly with the second controller comprises receiving controller status information from the second controller over a wired Ethernet connection that directly couples the first controller to the second controller.

11. The method of claim 9, wherein communicating directly with the second controller comprises receiving information identifying the at least one I/O module and the at least one controlled field device and what data was exchanged with the at least one I/O module and the at least one controlled field device.

12. The method of claim 8, wherein an operating parameter of the at least one controlled field device is set to a failsafe value in the failsafe condition.

13. The method of claim 8, wherein the first controller is configured for use in an EtherNet/IP process control system associated with an industrial plant.

14. The method of claim 8, wherein:

the first interface is connected to at least one first wired connection that forms a portion of the first controller network; and

the second interface is connected to at least one second wired connection that forms a portion of the second controller network.

15. The method of claim 14, wherein:

the first interface is communicably connected to a first firewall connected to the at least one first wired connection; and

the second interface is communicably connected to a second firewall connected to the at least one second wired connection.

16. The method of claim 14, wherein detecting the fault associated with the first controller network comprises detecting a cable break in the at least one first wired connection.

17. A non-transitory computer readable medium encoded with computer-executable instructions that when executed cause at least one processing device to:

detect, at a first controller configured to communicate with a second controller, a fault associated with the second controller while the second controller is in communication with at least one of multiple Ethernet/Industrial Protocol (EtherNet/IP)-compatible input/output (I/O) modules and at least one of multiple EtherNet/IP-compatible controlled field devices in a controlled network, the first controller configured to generate control signals for control of the multiple EtherNet/IP-compatible controlled field devices, the first controller also configured to communicate over a first controller network via a first interface and to communicate over a second controller network via a second interface, each of the first and second interfaces communicably connected to at least one switch that routes communications between the first controller and the controlled network;

upon detection of the fault associated with the second controller, resume the communication with the at least one I/O module and the at least one controlled field device at the first controller without the at least one I/O module updating the at least one controlled field device to a failsafe condition;

detect, at the first controller, a fault associated with the first controller network while the first controller is in communication with the at least one I/O module and the at least one controlled field device over the first controller network; and

upon detection of the fault associated with the first controller network, switch the communication with the at least one I/O module and the at least one controlled field device to the second controller network without the at least one I/O module updating the at least one controlled field device to the failsafe condition.

18. The non-transitory computer readable medium of claim 17, wherein the non-transitory computer readable medium is encoded with computer-executable instructions that when executed cause the at least one processing device to:

communicate directly with the second controller.

19. The non-transitory computer readable medium of claim 18, wherein the computer-executable instructions that when executed cause the at least one processing device to communicate directly with the second controller comprise:

computer-executable instructions that when executed cause the at least one processing device to transmit controller status information to the second controller over a wired Ethernet connection that directly couples the first controller to the second controller.

20. The non-transitory computer readable medium of claim 18, wherein the computer-executable instructions that when executed cause the at least one processing device to communicate directly with the second controller comprise:

computer-executable instructions that when executed cause the at least one processing device to receive information identifying the at least one I/O module and the at least one controlled field device and what data was exchanged with the at least one I/O module and the at least one controlled field device.