METHOD OF CONTROLLING AN AUTOMATION SYSTEM HAVING CONTROL REDUNDANCY, AND AUTOMATION SYSTEM

A method for controlling an automation system having control redundancy is provided. The automation system has at least a first controller, a second controller and a plurality of field devices connected to the first and second controller via a data bus, with the first and second controller configured to cyclically control an automation process of the automation system. The method comprises cyclically controlling the automation process via the first controller, determining a malfunction of the first controller during an (n+x)-th control cycle, where the (n+x)-th control cycle is carried out x control cycles later in time than the n-th control cycle, and sending out an n-th set of output data via a second input-output unit of the second controller to the plurality of field devices in the (n+x)-th control cycle, for controlling the automation process. An automation system is configured to carry out the method.

FIELD

The application provides a method for controlling an automation system having control redundancy. The application further provides an automation system which is set up to execute the method for controlling an automation system having control redundancy.

BACKGROUND

Serial network systems are frequently used in manufacturing and automation technology, in which the decentrally arranged devices of a machine periphery, such as I/O modules, transducers, drives, valves and operator terminals, communicate with automation, engineering or visualization systems. All subscribers are networked with each other via a serial data bus, preferably via a field bus, wherein the data exchange via the data bus is usually carried out on the basis of the active-passive principle in the form of data packets, also referred to as telegrams.

The active units on the data bus, usually the controllers, have bus access authorization and determine the data transfer on the data bus. The passive units on the data bus, usually machine peripherals, do not have bus access authorization, i.e. they may only acknowledge telegrams received or transmit telegrams to an active unit upon request.

The telegrams, also referred to as frames, are composed of control data and user data. The Ethernet standard is often used as the protocol for controlling the data exchange on the data bus, which allows for telegrams having a length of up to 1500 bytes at a simultaneously high transmission speed of up to 10 Gbit/sec.

The data bus of the active-passive automation system often has a ring structure in which the individual passive units on the transmission path are connected to form a ring, with each subscriber connected to two neighbors and the first and last subscriber in the ring connected to the active unit. The telegrams are transmitted in one direction starting from the active unit via its transmitting unit to the first connected passive unit and from there to the next until the last passive unit in the ring in the data transmission direction is reached, and then from the last passive unit back to the receiving unit of the active unit.

A demand to automation systems, especially when used in manufacturing and process automation, is a high fault tolerance, i.e. the capability of the automation system of guaranteeing the required function, i.e. for example the production of a workpiece, despite the occurrence of errors. Errors in the automation system that must be overcome without impairment not only comprise errors in the telegrams but also the failure of a subscriber in the transmission path or an interruption in the transmission path, e.g. in case of the transmission medium being physically cut off.

SUMMARY

A method for controlling an automation system having control redundancy is provided, which allows for safely controlling an automation process of an automation system and allows for compensating a malfunction within the automation system.

Examples

A method for controlling an automation system having control redundancy is provided, wherein the automation system comprises at least a first controller, a second controller and a plurality of field devices connected to the first controller and to the second controller via a data bus, wherein the first controller and the second controller are set up to cyclically control an automation process of the automation system, wherein the first controller comprises:a first input-output unit for receiving input data from the field devices and for sending output data to the field devices,a first processing unit for executing at least one control task and for analyzing the received input data and generating output data according to the control task, anda first output memory unit for storing the generated output data,

wherein the second controller comprises:a second input-output unit for receiving input data from the field devices and for sending output data to the field devices,a second processing unit for executing the at least one control task and for analyzing the received input data and generating output data according to the control task, anda second output memory unit for storing the generated output data,

and wherein the method comprises:cyclically controlling the automation process of the automation system via the first controller in a first controlling step, wherein the first controlling step is executed in an n-th control cycle, wherein the n-th control cycle is executed in time after an execution of n−1 control cycles, and wherein n is a natural number≥2, and wherein the first controlling step comprises:receiving an n-th set of input data via the first input-output unit of the first controller in a first input receiving step; andsending out an (n−x)-th set of output data via the first input-output unit of the first controller to the field devices in a first output transmitting step, wherein x is a natural number≥1, wherein the emitted (n−x)-th set of output data is generated based on an (n−x)-th set of input data received in an (n−x)-th control cycle according to the control task, and wherein the (n−x)-th control cycle is executed in time x control cycles ahead of the n-th control cycle;transmitting the n-th set of input data from the first controller to the second controller in a first data transmitting step;processing the n-th set of input data and generating an n-th set of output data via the second processing unit of the second controller in a first processing step;storing the n-th set of output data in the second output memory unit of the second controller in a first output storing step;determining a malfunction of the first controller during an (n+x)-th control cycle in a malfunction determining step, wherein the (n+x)-th control cycle is executed in time x control cycles later than the n-th control cycle; andsending out the n-th set of output data via the second input-output unit of the second controller to the plurality of field devices in the (n+x)-th control cycle, and controlling the automation process based on the n-th set of output data in a further output transmitting step.

This achieves the technical advantage that an efficient method for controlling an automation system having control redundancy may be provided. The automation system comprises a first controller and a second controller, each of which is set up to cyclically control an automation process of the automation system. The automation system further comprises a plurality of field devices connected to the first controller and the second controller via a data bus. The field devices may be sensors or actuators of the automation system, via which the automation process to be controlled is executed.

In a first controlling step, the first controller controls the automation process cyclically by evaluating input data of the field devices in successive control cycles by of a control task suitable for controlling the automation process and generating corresponding output data. On the basis of the output data, the field devices may be controlled to execute the automation process.

For the purposes of the application, a control cycle is an input/output cycle and describes a period of time from the receipt of input data by the first controller or by the second controller to the transmission of corresponding output data by the respective controller.

DETAILED DESCRIPTION

For the purposes of the application, input data are in particular sensor data from sensors of the automation system and may e.g. be summarized in a process image of the inputs, as is the rule in the operation of programmable logic controllers (PLCs) and, for the purposes of the application, is part of the control data on the basis of which control of an automation process may be carried out. Output data are, for the purposes of the application, corresponding control data for actuators of the automation system and may likewise be summarized in a process image of the outputs, as usual with PLCs.

For the purposes of the application, a control task is a control program for controlling the automation process. Alternatively, a control task may comprise only a partial program of the control program, so that the entire control program is executed by executing a plurality of control tasks. A control task may comprise a PLC task, where a PLC task is a control program or partial program of a programmable logic controller PLC. Alternatively or additionally, a control task may comprise an NC task, wherein an NC task is a control program or partial program of a numerical control NC.

For executing the control task, each controller comprises a processing unit by which the control tasks or a plurality of control tasks may be executed.

For cyclic control of the automation process, the first controller thus performs a plurality of successive control cycles, in each of which a set of input data e.g. corresponding to a process image of the inputs is received, and a set of output data e.g. corresponding to a process image of the outputs is sent out to the field devices of the automation system.

The method is embodied in such a way that during a control cycle current input data are recorded by the respective controller, which reflect a current state of the automation process to be controlled. In the same control cycle, after receipt of the current input data, output data are sent out to the field devices by the respective controller, which were generated for a control cycle carried out earlier in time according to the control task on the basis of input data recorded earlier in time. In any control cycle, output data are thus sent out to the field devices that were generated on the basis of input data by executing the control task that was received by the respective controller at a temporally earlier control cycle.

Output data are thus sent to the field devices with a time delay relative to the receipt of the respective input data from the corresponding controller. The time delay may comprise any number x of control cycles. For example, output data generated on the basis of input data received at any n-th control cycle may thus be sent out in an (n+x)-th control cycle, the (n+x)-th control cycle being executed x control cycles after the n-th control cycle.

The time delay of sending the output data relative to receiving the corresponding input data may create a dead time that may be used to respond to a malfunction of one of the controllers of the automation system.

For this purpose, input data received from the first controller in any n-th control cycle are transmitted to the second controller. The input data transmitted to the second controller are subsequently analyzed by executing the control task by the second controller and corresponding output data are generated by the second controller. The execution of the control task by the second controller, in particular by a processing unit of the second controller, and the generation of corresponding output data may be performed in the n-th control cycle or in a temporally later control cycle. The generated output data may subsequently be stored in an output memory unit of the second controller.

This achieves that the second controller comprises output data based on the input data received by the first controller in the n-th control cycle. Depending on the preset dead time, which describes the time difference between receiving input data and transmitting output data based on said input data, the output data generated by the second processing unit of the second controller on the basis of the input data received by the first controller at the n-th control cycle may be transmitted to the field devices of the automation system in an (n+x)-th control cycle which is executed later in time than the n-th control cycle by the preset dead time of x control cycles.

For this purpose, the first controller performs an analysis of the input data recorded in the n-th control cycle and generates corresponding output data in a control cycle that is performed in time between the n-th control cycle and an (n+x)-th control cycle.

After further cyclic control of the automation process via the first controller, in which further input data are recorded for each control cycle and output data are sent out which are based on input data recorded for control cycles executed earlier in time, a malfunction of the first controller is determined for an (n+x)-th control cycle.

After determining the malfunction of the first controller, in the (n+x)-th control cycle, the second controller sends the output data generated on the basis of the input data recorded by the first controller in the n-th control cycle out to the field devices of the automation process. This makes it possible to seamlessly continue controlling the automation process despite a malfunction of the first controller, which has controlled the automation process of the automation system cyclically up until the malfunction.

For the purposes of the application, a malfunction of a controller is an operation of the controller that does not meet the requirements for the operation of a controller. This may manifest itself in that the respective controller outputs faulty output data. Alternatively, a malfunction may comprise that the controller receives input data erroneously, respectively exhibits a technical error of a different nature, which is e.g. accompanied by a corresponding error message. A malfunction of a controller may also comprise the complete failure of a controller. A failure of a controller may in this case be caused by a technical error of the controller. Alternatively, a failure of a controller may also be caused deliberately, e.g. by the respective controller being switched off or removed from the automation system for maintenance purposes or in order to replace it with another controller.

By sending out the output data generated on the basis of the input data recorded in the n-th control cycle by the second controller in the (n+x)-th control cycle in which a malfunction of the first controller was detected, the corresponding output data for controlling the automation process are sent out at the scheduled time despite the malfunction of the first controller. This achieves that an interruption of the automation process due to the malfunction of the first controller may be avoided.

In addition, the preset dead time, which ensures that output data are transmitted with a predetermined time delay relative to the corresponding input data, means that if a malfunction is detected in a controller of the automation system, the other controller may immediately take over control of the automation process, since for any given control cycle the second controller already has a plurality of different sets of output data, each of which is to be transmitted either for the respective control cycle or for a control cycle to be executed later in order to control the automation process. Due to the sets of output data already stored, the second controller is thus set up at any time to take over control of the automation process on the relevant output data in each case.

The control redundancy may ensure safe control of the automation system. As the automation process may be continued without delay by the second controller if a malfunction of the first controller is detected, safety requirements for the respective automation system may be fulfilled, achieving an undisturbed sequence of the automation process to be controlled. In this way, an increased degree of safety of the automation system may be achieved.

Additional Examples

According to an embodiment, the method further comprises:cyclically controlling the automation process of the automation system via the second controller in a second controlling step; wherein the second controlling step is executed in an (n+m+x)-th control cycle, where m is a natural number≥1, wherein the (n+m+x)-th control cycle is executed m control cycles later in time than the (n+x)-th control cycle, and wherein the second controlling step comprises:receiving an (n+m+x)-th set of input data via the second input-output unit of the second controller in a second input receiving step; andsending out an (n+m)-th set of output data via the second input-output unit of the second controller to the field devices in a second output transmitting step, wherein the (n+m)-th set of output data sent out is generated based on an (n+m)-th set of input data received in an (n+m)-th control cycle according to the control task, and wherein the (n+m)-th control cycle is performed x control cycles ahead in time of the (n+m+x)-th control cycle.

This achieves the technical advantage that, in the event of a malfunction of a controller, the control of the automation process of the automation system may be taken over smoothly and without delay by the respective other controller. This ensures that the automation process runs without delay. For this purpose, after determining the malfunction of the first controller in the (n+x)-th control cycle and transmitting the respective n-th set of output data by the second controller in the (n+x)-th control cycle, the automation process is controlled cyclically by the second controller in the control cycles following the (n+x)-th control cycle.

For this purpose, the second controller receives a corresponding set of input data for each control cycle and sends out a set of output data to the field devices. For this purpose, the fixed dead time is also taken into account, so that the second controller sends out output data for any control cycle that was generated for a control cycle executed earlier based on input data received earlier.

According to an embodiment, the first controller further comprises a first output memory unit for storing output data, wherein in the n-th control cycle, the (n−x)-th set of output data is stored in the first output memory unit, and wherein the (n−x)-th set of output data is generated in the (n−x)-th control cycle or in any control cycle temporally interposed between the (n−x)-th control cycle and the n-th control cycle.

This achieves the technical advantage that an arbitrary predetermined dead time may be generated, which comprises a time span of a plurality of successive control cycles. By storing the output data in the first output memory unit of the first controller, it is achieved that the generated output data may be sent out at any later time, i.e.: at any later control cycle.

According to an embodiment, the method further comprises:processing the n-th set of input data and generating an n-th set of output data via the first processing unit of the first controller in a second processing step;storing the n-th set of output data in the first output memory unit of the first controller in a second output storing step, wherein generating the n-th set of output data via the first processing unit of the first controller, storing the n-th set of output data in the second output memory unit via the second controller, and transmitting the n-th set of input data from the first controller to the second controller is carried out in the n-th control cycle or in arbitrary control cycles arranged in time between the n-th control cycle and the (n+x)-th control cycle;processing the (n+m)-th set of input data and generating an (n+m)-th set of output data via the second processing unit of the second controller in a third processing step;storing the (n+m)-th set of output data in the second output memory unit of the second controller in a third output storing step, wherein generating the (n+m)-th set of output data via the second processing unit of the second controller and storing the (n+m)-th set of output data in the second output memory unit of the second controller are carried out in the (n+m)-th control cycle or in any control cycle temporally interposed between the (n+m)-th control cycle and the (n+m+x)-th control cycle;processing the (n+m+x)-th set of input data and generating an (n+m+x)-th set of output data via the second processing unit of the second controller in a fourth processing step; andstoring the (n+m+x)-th set of output data in the second output memory unit of the second controller in a fourth output storing step, wherein generating the (n+m+x)-th set of output data via the second processing unit of the second controller and storing the (n+m+x)-th set of output data in the second output memory unit of the second controller is carried out in the (n+m+x)-th control cycle or in any control cycle temporally interposed between the (n+m+x)-th control cycle and an (n+m+2x)-th control cycle.

As a result, the technical advantage may be achieved that a most efficient division of different processes carried out by the first controller or the second controller is made possible. This achieves the most efficient method possible for controlling an automation system.

For this purpose, in the n-th control cycle, an n-th set of input data received from the first controller during the n-th control cycle is analyzed by the first processing unit of the first controller, and a corresponding n-th set of output data are generated. This n-th set of output data is stored in the first output memory unit of the first controller. Generating the n-th set of output data or storing the n-th set of output data in the first output memory unit may take place in the n-th control cycle or in any control cycle carried out between the n-th control cycle and the (n+x)-th control cycle. This achieves that generating the n-th set of output data or storing the n-th set of output data may take place at a time when a corresponding computing time of the processor is available.

By postponing the generation or storage of the output data to a suitable point in time, it may be avoided that other processes have to be stopped or delayed due to the execution of the generation or storage of the output data. Furthermore, the required computing capacity may be reduced by the fact that processes do not necessarily have to be executed in a control cycle, but may be shifted to any other time at which a required computing capacity is available.

Analogously, processing an (n+m)-th set of input data received in an (n+m)-th control cycle from the second controller and generating an (n+m)-th set of output data or storing the (n+m)-th set of output data may take place either during the (n+m)-th control cycle or during any control cycle that is carried out in time between the (n+m)-th control cycle and the (n+m+x)-th control cycle. This in turn may save computing capacity by allowing said processes to be performed at times when the respective computing capacity is available.

Analogously, the generation of an (n+m+x)-th set of output data by the second processing unit or the storage of the generated (n+m+x)-th set of output data may be proceeded with, which may also be performed either during the (n+m+x)-th control cycle or else during any control cycle that lies temporally between the (n+m+x)-th and an (n+m+2x)-th control cycle.

According to an embodiment, the method further comprises:receiving a further n-th set of input data via the second input-output unit of the second controller in the n-th control cycle in a further input receiving step;comparing the n-th set of input data of the first controller with the further n-th set of input data of the second controller in a comparing step;determining a deviation between the n-th set of input data of the first controller and the further n-th set of input data of the second controller in a deviation determining step; anddetermining an error in a data transmission between the field devices and the first controller in a transmission error determining step.

This may have the technical advantage of ensuring that the first controller and the second controller operate based on identical input data. This achieves error-free control of the automation process. For this purpose, an n-th set of input data are recorded by the second input/output unit of the second controller in the n-th control cycle and the input data of the n-th set recorded by the second controller are compared to the input data of the n-th set recorded by the first controller. If a discrepancy is detected between the n-th set of input data of the first controller and the n-th set of input data of the second controller, an error in a data transmission between the field devices and the first controller is detected. This error may be interpreted as a malfunction of the first controller, so that when the error in the data transmission between the field devices and the first controller is detected, the second controller takes control of the automation process. This may be used to ensure that the first controller and the second controller operate on identical input data, or that a deviation of the input data received by one controller from the input data received by the other controller determines a malfunction.

According to an embodiment, a plurality of sets of output data are stored in the first output memory unit of the first controller and/or in the second output memory unit of the second controller during the n-th control cycle, wherein the stored sets of output data are in each case generated based on a set of input data received in a control cycle according to the control task, and wherein the respective control cycles are executed in time between the (n−x)-th control cycle and the n-th control cycle, and wherein the respective sets of output data are sent out to the field devices from the first input-output unit of the first controller in respective control cycles executed in time between the n-th control cycle and the (n+x)-th control cycle.

This may achieve the technical advantage that, in the event of a malfunction of a controller, the other controller of the automation system may take over control of the automation process without delay. An interruption of the automation process may thus be avoided. By storing a plurality of sets of output data in the first output memory unit of the first controller and/or in the second output memory unit of the second controller for any given control cycle, each of which is generated on the basis of input data that has been received in an earlier control cycle and is transmitted according to the fixed dead time for a control cycle later in time, the respective other controller may immediately transmit a corresponding set of output data for controlling the automation process to the field devices in the event of a detected malfunction of one of the controllers.

This avoids the situation in which, in order to continue the automation process when a malfunction of one of the controllers is detected, the respective other controller must first generate corresponding output data, which may delay or interrupt the automation process. Since the required sets of output data are already stored in the output memory units of the controllers at any time, the corresponding required output data may be accessed by each controller at any control cycle and sent out to control the automation process.

According to an embodiment, a plurality of sets of output data are stored in the second output memory unit of the second controller during the (n+m+x)-th control cycle, wherein the stored sets of output data were each generated based on a set of input data received in a control cycle according to the control task, and wherein the respective control cycles are executed in time between the (n+m)-th control cycle and the (n+m+x)-th control cycle, and wherein the respective sets of output data are sent out to the field devices from the second input-output unit of the second controller in respective control cycles executed in time between the (n+m+x)-th control cycle and an (n+m+2x)-th control cycle.

This may achieve the technical advantage that for any control cycle after a malfunction of the first controller has been determined, the dead time between receiving input data and sending corresponding output data via the second controller may be maintained. For this purpose, a plurality of sets of output data are stored in the second output memory unit of the second controller at any control cycle after the malfunction of the first controller has been determined, the respective output data being based on input data received at a temporally earlier control cycle. Due to the plurality of sets of output data stored in the output memory unit, a corresponding set of output data may be sent out to the respective field devices in each control cycle so that control of the automation process by the second controller may continue. This may ensure error-free operation of the automation system.

According to an embodiment, the first controller comprises a first input memory unit for storing input data, wherein the second controller comprises a second input memory unit for storing input data, and wherein the method further comprises:storing the n-th set of input data in the first input memory unit of the first controller in the n-th control cycle in a first input storing step; and/orstoring the n-th set of input data transmitted from the first controller to the second controller in the second input memory unit of the second controller in the n-th control cycle in a second input storing step.

This may achieve the technical advantage that the generation of output data may be carried out by executing the control task on corresponding input data at any time. For this purpose, the first controller comprises a first input memory unit and the second controller comprises a second input memory unit, in each of which input data may be stored. When the input data are received in any n-th control cycle, the received input data may thus be stored in the respective input memory unit, so that an analysis of the input data by executing the corresponding control task and a generation of corresponding output data may be postponed to any time, so that an analysis of the received input data does not necessarily have to be performed during the n-th control cycle.

This may save computing capacity by postponing the process to a convenient point in time when the appropriate computing capacity is available. Thus, if multiple processes need to be carried out during a control cycle, the generation of output data may be postponed to a later control cycle. Alternatively, the analysis of the received input data and the generation of corresponding output data may also be carried out between different control cycles or in a time period comprising several control cycles. This provides increased flexibility and efficiency of the method for controlling the automation system.

According to an embodiment, the first controller comprises a first memory area for storing first control data of the first controller, wherein the second controller has a second memory area for storing second control data of the second controller, wherein the first memory area comprises the first input memory unit and the first output memory unit, and wherein the second memory area comprises the second input memory unit and the second output memory unit, further comprising:

generating a memory copy in a memory copying step, wherein the memory copy is a copy of the first memory area of the first controller and comprising the sets of input data stored in the first input memory unit and the sets of output data stored in the first output memory unit, wherein the memory copy is generated in any control cycle performed temporally before the n-th control cycle and comprising at least one set of input data stored in the first input memory unit at the time of the respective control cycle and/or at least one set of output data stored in the first output memory unit at the time of the respective control cycle;transmitting the memory copy to the second controller in a copy transmitting step;storing the at least one set of input data of the memory copy in the second input memory unit of the second controller in a first copy storing step; and/orstoring the at least one set of output data of the memory copy in the second output memory unit of the second controller in a second copy storing step;processing the at least one set of input data of the memory copy and generating a corresponding set of output data via the second processing unit of the second controller in a fifth processing step; andstoring the generated set of output data in the second output memory unit of the second controller in a fifth output storing step.

This may achieve the technical advantage of ensuring that the first controller and the second controller act upon identical input and output data. In particular, when starting up or starting the automation process, it may be achieved by creating a memory copy comprising the control data of the first controller and by transmitting the memory copy to the second controller that the second controller may be operated based on the control data of the first controller. The control data stored in the memory copy may comprise input data and output data of the first controller that have been recorded or generated in control cycles executed earlier.

The first controller and the second controller in this context may be embodied as separate modules, each comprising separate independent memory areas. For example, the first controller and the second controller may each be embodied as individual controllers.

A first memory area of the first controller may in this context comprise the first input memory unit and the first output memory unit. The control data of the first controller may here comprise the sets of input data stored in the first input memory unit or the sets of output data stored in the first output memory unit. Thus, by creating the memory copy and transmitting the memory copy to the second controller, the input data or output data stored in the memory copy may be stored in the corresponding input memory unit or output memory unit of the second controller. On the basis of the output data stored in the output memory unit, the automation process may thus be controlled by the second controller in the event of a malfunction of the first controller. Alternatively, based on the sets of input data transmitted to the second controller with the memory copy, corresponding sets of output data may be generated by executing the control task. On the basis of the generated output data, the second controller may control the automation process if a malfunction of the first controller is detected. Thus, by creating the memory copy and transmitting the memory copy to the second controller, it may be achieved that at any time the first controller and the second controller are executed on identical input data, so that error-free control of the automation process may be achieved by either the first controller or the second controller.

The memory copy may further comprise a program state of the control program or the automation system, respectively, by which a current state of the controlled automation process is described. The program state may store any information required for the operation of the automation process. This information may comprise current values of individual components of the automation process to be controlled, such as measured values describing an operating state of a machine to be controlled. Transferring the memory copy to the second controller achieves that the automation process may be controlled by the second controller on the same state as before by the first controller. Thus, only an immediate transition of the control by the first controller to the control of the automation process by the second controller may be achieved, wherein the control of the automation process may be continued without interruption on the current state by the second controller.

According to an embodiment, the first controller comprises a first communication interface for receiving and transmitting communication data, wherein the second controller comprises a second communication interface for receiving and transmitting communication data, further comprising:receiving n-th communication data via the first communication unit of the first controller in the n-th control cycle in a first message receiving step;determining n-th response data to the received n-th communication data in a first response generating step;storing the n-th response data in the first output memory unit of the first controller in a first response storing step, wherein the n-th response data are stored in the first output memory unit with the n-th set of output data;sending out the n-th response data via the first communication interface of the first controller in the (n+x)-th control cycle in a first response transmitting step; and/orreceiving (n+m+x)-th communication data via the second communication unit of the second controller in the (n+m+x)-th control cycle in a second message receiving step;determining (n+m+x)-th response data to the received (n+m+x)-th communication data in a second response generating step;storing the (n+m+x)-th response data in the second output memory unit of the second controller in a second response storing step, the (n+m+x)-th communication data being stored in the second output memory unit with the (n+m+x)-th set of output data; andsending out the (n+m+x)-th response data via the second communication interface of the second controller in the (n+m+2x)-th control cycle in a second response transmitting step.

This achieves the technical advantage that communication data may be exchanged in addition to control data, enabling communication between the controllers or between modules of the automation system. This allows for efficiently controlling the automation system.

For the purposes of the application, communication data are data of a data communication between components of the automation system and a controller of the automation system. Components may e.g. comprise an HMI human-machine interface or another input unit by which a user is able to access the controller of the automation system.

An automation system comprising at least a first controller and a second controller and a plurality of field devices connected to the first controller and the second controller via a data bus is provided, wherein the first controller and the second controller are set up to cyclically control an automation process of the automation system, the first controller comprising:a first input-output unit for receiving input data from the field devices and for sending output data to the field devices,a first processing unit for executing at least one control task and for analyzing the received input data and for generating output data according to the control task,a first input memory unit for storing the received input data, anda first output memory unit for storing the generated output data,wherein the second controller comprises:a second input-output unit for receiving input data from the field devices and for sending output data to the field devices,a second processing unit for executing the at least one control task and for analyzing the received input data and for generating output data according to the control task,a second input memory unit for storing input data, anda second output memory unit for storing the generated output data, and wherein the automation system is embodied to execute the method according to the application.

This may achieve the technical advantage that an automation system may be provided which is set up to execute the method according to the application for controlling an automation system having control redundancy having the advantages mentioned above.

According to an embodiment, the first controller comprises a first memory area for storing first control data of the first controller, wherein the second controller has a second memory area for storing second control data of the second controller, wherein the first memory area comprises the first input memory unit and the first output memory unit, and wherein the second memory area comprises the second input memory unit and the second output memory unit.

This may achieve the technical advantage that the first memory area of the first controller and the second memory area of the second controller may store the control data of the controllers separately from one another, so that the first controller and the second controller may be operated as separate units. The first controller and the second controller may in particular be embodied as individual controllers. This makes it possible to operate the first controller and the second controller independently of one another, so that if one controller malfunctions, the other controller can take over control of the automation process without being affected. In this way, redundant control of the automation system may be achieved. A malfunction of one controller thus has no influence on the functionality of the other controller.

According to an embodiment, the first controller and the second controller are connected to each other via a data connection and are set up to carry out a data exchange via data communication.

This may achieve the technical advantage that a data communication between the first controller and the second controller is enabled. Via the data link, data exchange may be provided between the first controller and the second controller. As a result, a synchronization of the first controller and the second controller may be achieved, which is required for a control redundancy. The synchronization of the first controller and the second controller ensures that, in the event of a malfunction of one controller, the other controller is able to continue control of the automation process without interrupting the automation process. This ensures efficient control of the automation system.

According to an embodiment, the automation system further comprises a first connecting unit and a second connecting unit, wherein the first connecting unit and the second connecting unit are connected to the field devices and the first controller and the second controller via the data bus, and wherein the first connecting unit and the second connecting unit are set up to control a data flow of input data from field devices to the first controller and to the second controller and/or a data flow of output data from the first controller and/or from the second controller to the field devices.

This may achieve the technical advantage that the data signals exchanged between the controllers and the field devices of the automation system for controlling the automation process arrive at the respective addressed receiver. In particular, when a malfunction of one of the controllers is detected and the control of the automation process is taken over by the respective other controller, the data signals sent out by the field devices may be transmitted to the respective controller that has taken over the control of the automation process via the first connecting unit or the second connecting unit. In this way, smooth control of the automation process by the first controller and the second controller may be achieved by transmitting corresponding output data to the corresponding controller or the field devices via the first connecting unit or the second connecting unit.

According to an embodiment, the first controller comprises a further first processing unit for executing at least one further control task and for analyzing the received input data and for generating further output data according to the further control task, wherein the second controller comprises a further second processing unit for executing the at least one further control task and for analyzing the received input data and for generating output data according to the further control task, and wherein the control task may be executed simultaneously by the first processing unit and the further control task by the further first processing unit of the first controller and/or the control task may be executed simultaneously by the second processing unit and the further control task by the further second processing unit of the second controller.

This may achieve the technical advantage that a multitasking function of the automation system may be provided. Via the first controller comprising a further first processing unit and the second controller comprising a further second processing unit, which are each set up to execute a further control task, it may be achieved that a plurality of control tasks may be executed by the respective controller, if necessary simultaneously. This may ensure efficient control of the automation process, in which simultaneous execution of a plurality of control tasks allows for correspondingly accelerated processing of the recorded input data. This enables accelerated processing of the control program within a control cycle or a plurality of control cycles. This ensures processing of a larger volume of input data within a control cycle, allowing for accelerated and thus more efficient control of the automation process. Different control tasks may be executed on different processor cores so that the different control tasks may be processed simultaneously. This reduces the processing time of the control program, which means that a higher volume of data may be processed per control cycle.

According to an embodiment, the first input memory unit and the first output memory unit of the first controller and the second input memory unit and the second output memory unit of the second controller are first-in-first-out memories.

This may achieve the technical advantage that the simplest possible embodiment of the input memory units and the output memory units of the first and second controller may be provided. By embodying the input memory units and the output memory units as first-in-first-out memories, the simplest possible handling of the memory units is made possible, in which input data or output data may easily be stored at earlier times, which may be processed further in a later control cycle. By the respective sequence of the individual sets of input data or output data, in which these are stored in the respective memory unit, the processing of the individual sets of input data and output data may be regulated to the respectively correct control cycle, so that each set of input data or output data may be processed in the respectively intended control cycle. This may ensure seamless control of the automation process.

FIG.1shows a schematic depiction of an automation system200according to an embodiment.

In the embodiment shown inFIG.1, the automation system200comprises a first controller201, a second controller203and a plurality of field devices205. The field devices205may be embodied as sensors or actuators of the automation system200. The field devices205are connected to the first controller201and the second controller203via a data bus207. Furthermore, the automation system200comprises a first connecting unit229and a second connecting unit230, which are connected to the first controller201and the second controller203and to the field devices205via the data bus207. Furthermore, the first and second connecting units229,230are connected to each other via the data bus207.

The first controller201comprises a first input-output unit209for receiving input data and for sending output data from and to the field devices205. Furthermore, the first controller201comprises a first processing unit211for executing a control task and for analyzing received input data and for generating corresponding output data. Furthermore, the first controller201comprises a first input memory unit213for storing input data231.

In the embodiment shown inFIG.1, the first input memory unit213stores two sets of input data231and further stores two sets of communication data235. The number of input data231or communication data235stored in the first input memory unit213is merely exemplary and may differ arbitrarily from the number shown inFIG.1, so that a plurality of input data231or communication data235may be stored in the first input memory unit213.

In addition, the first controller201comprises a first output memory unit215for storing corresponding output data233generated by the first processing unit211. InFIG.1, the first output memory unit215further stores response data237.

Communication data235and response data237are, in the sense of the application, data of a data communication between modules of the automation system200, e.g. between the first controller201and the second controller203, respectively, and an HMI human-machine interface. Communication data235comprise requests to perform certain services or to provide corresponding information, while response data237comprise response messages relating to the respective communication data235received. Communication data235and response data237may be received and/or transmitted by the first controller201and the second controller203, respectively, via a corresponding communication interface.

The first input-output unit209, the first processing unit211, the first input memory unit213, and the first output memory unit215are interconnected within the first controller201via an internal data interface225. The internal data interface225allows for data transfer between the individual units within the first controller201.

Similarly, the second controller203comprises a second input-output unit217for receiving input data231from the field devices205and sending corresponding output data233to the field devices205. Furthermore, the second controller203comprises a second processing unit219for analyzing the received input data231and generating corresponding output data233by executing a corresponding control task. Furthermore, the second controller203comprises a second input memory unit221for storing input data231or communication data235. Furthermore, the second controller203comprises a second output memory unit223for storing output data233or response data237. Within the second controller203, the individual units are interconnected via an internal data interface225that enables data transmission within the second controller203.

In addition, the first controller201and the second controller203are interconnected via a data link227that allows for transmitting data between the first controller201and the second controller203.

The first controller201and the second controller203are each set up to cyclically control an automation process of the automation system200. Cyclic control of the automation process by one of the controllers comprises receiving corresponding input data231from the field devices205and sending output data233to the respective field devices205within a control cycle. For cyclic control of the automation process, a plurality of different control cycles are thus executed one after the other, so that input data231of the field devices205are received by the first controller201and the second controller203, respectively, and output data233are transmitted by the first controller201and the second controller203, respectively, to the field devices205for controlling the automation process in cyclic sequence.

To control the automation process, the first controller201is set up to receive input data231from the field devices205via the first input-output unit209. The received input data231may in this context be combined to form a process image of the inputs, as is usual for a programmable logic controller PLC. The received input data231may be forwarded to the first processing unit211via the internal data interface225. The first processing unit211may execute a control task to analyze the received input data231and generate corresponding output data233. In this regard, the control task may comprise a control program of the automation process.

Alternatively, a control task may comprise a partial program of a control program, such that a plurality of control tasks must be executed in sequence to carry out the overall control program. The generated output data233may subsequently be transmitted to and stored in the first output memory unit215via the internal data interface225. The output data233may be combined into a process image of the outputs, as is customary for PLCs. At a later time, the output data233stored in the first output memory unit215may be transmitted to the first input-output unit209via the internal data interface225and transmitted from the first input-output unit209via the data bus207to the first interconnecting unit229and from there to the field devices205.

Alternatively, the input data231received by the first input-output unit209may be transmitted to and stored in the first input memory unit213via the internal data interface225. At a later time, the input data231stored in the first input memory unit213may be transmitted to the second controller203via the data link227.

The second controller203is further set up to store the input data231transmitted from the first controller201in the second input memory unit221. The second controller203is further configured to transmit the input data231stored in the second input memory unit221to the second processing unit219via the internal data interface225. The second processing unit219may analyze the transmitted input data231may be analyzed by executing the control task analogously to the first processing unit211and generating corresponding output data233. These may be transmitted to and stored in the second output memory unit223via the internal data interface225. Furthermore, the second controller203is embodied to receive input data231from the field devices205via the second input-output unit217. These received input data231may also be transmitted to and stored in the second input memory unit221via the internal data interface225. Alternatively, the received input data231may be transmitted to the second processing unit219, analyzed therein, and corresponding output data233may be generated, which may be stored in the second output memory unit223.

In this context, the first controller201and the second controller203are embodied in such a way that a plurality of output data233are stored in the first output memory unit215and the second output memory unit223, respectively, at any time during the execution of the automation process. For controlling the automation process according to the application, it is provided that the first controller201or the second controller203transmit output data233, which are stored in the first output memory unit215or the second output memory unit223, to the field devices205within a control cycle, wherein the output data233transmitted in a control cycle were generated at an earlier time on the basis of received input data231.

Thus, a dead time is generated, which may comprise a period of a plurality of successive control cycles and describes a delay that occurs between receiving input data231and sending out corresponding output data233generated by executing the control task based on the received input data231. Via the plurality of output data233stored in the output memory unit215or the second output memory unit223, it is achieved that in any given control cycle, the first controller201or the second controller203, respectively, has a plurality of output data233to be sent out to the field devices205in a control cycle to be executed at a later time for controlling the automation process.

Thus, if a malfunction of one of the controllers is detected, the respective other controller is able to immediately send out output data233in the respective designated control cycle at any time without having to first generate the respective output data233designated to be sent out in the respective control cycle.

For example, if a malfunction of the first controller201is detected, the second controller203is set up to transmit the output data233stored in the second output memory unit223to the second input-output unit217via the internal data interface225and to transmit this output data233to the field devices205via the data bus207and the second connecting unit230to control the automation process. As long as no malfunction of the first controller201occurs, the automation process is controlled by the first controller201. The second controller203is operated in parallel as a redundancy and is maintained in line with the method100at the status or in the state of the first controller201and is thus able to take over the control of the automation process in place of the first controller201at any time.

According to an embodiment, the first controller201and the second controller203are identical in construction and may be interchanged as desired, so that both the first controller201and the second controller203may perform control of the automation system200in an equivalent manner.

Similarly, the first controller201and the second controller203are set up to receive communication data235via a corresponding communication interface and to transmit it to and store it in the first input memory unit213and the second input memory unit221, respectively, via the internal data interface225. By executing the control task or, as the case may be, another control task via the first processing unit211or the second processing unit219, corresponding response data237may be generated, which may be stored in the first output memory unit215or the second output memory unit223. Via the data connection227or the data bus207, these may be sent out to further modules of the automation system200, e.g. to the respective other controller, for data communication.

According to an embodiment, the first input memory unit213, the second input memory unit221, the first output memory unit215, and the second output memory unit223are first-in-first-out memories. According to an embodiment, the first controller201and the second controller203each comprise a plurality of first processing units211and second processing units219, respectively, in which a plurality of control tasks may be executed. For example, the individual control tasks may be executed on different processor cores so that simultaneous execution of a plurality of control tasks is possible.

The first connecting unit229and the second connecting unit230may be configured to forward data signals between the first controller201, the second controller203, and the field devices205to the addressed receivers, respectively. In particular, the first connecting unit229and the second connecting unit230may be configured to transmit the data signals emitted by the field devices205to the respective other controller in the event of a malfunction of one of the controllers. The first connecting unit229and the second connecting unit230may thus be used to control data communication between the controllers and the field devices205of the automation system200. The first connecting unit229and the second connecting unit230may e.g. be embodied as correspondingly configured switches.

According to an embodiment, the automation system200may comprise any number of controllers. The controllers of the automation system200may each be embodied identically so that, according to the embodiment described above, all controllers may be set up to control the automation process cyclically and, in the event of a malfunction of one of the controllers, to take over control of the automation process seamlessly and without delaying the automation process.

According to an embodiment, the first controller201and the second controller203each comprise a first memory area and a second memory area, which are separated from each other and in which the input data231received from the first controller201and generated output data233, and the input data231received from the second controller203and generated output data233, respectively, may be stored. Via the separated memory areas, individualization of the controllers is ensured, which allows for independently operating the individual controllers.

FIG.2shows a flowchart of a method100for controlling an automation system200according to an embodiment.

The method100for controlling an automation system200with control redundancy is applicable to an automation system200according to the embodiment shown inFIG.1.

The description of the method100according to the embodiment inFIG.2is made with reference to the description forFIG.3.

For controlling the automation system200, in a first controlling step101the first controller201cyclically controls the automation process of the automation system200to be controlled. The cyclic control of the automation process by the first controller201here comprises the receiving of corresponding input data231and the sending of output data233in successive control cycles by the first controller201.

For any n-th control cycle, wherein n is a natural number≥2, and wherein by the n-th control cycle any control cycle of the cyclic control of the automation process is thus represented, the first controlling step101comprises a first input receiving step103and a first output transmitting step105. In the first input receiving step103, the first input output unit209of the first controller201receives an n-th set of input data In. The n-th set of input data In comprises input data231sent out by the field devices205to the first controller201. In particular, the input data231comprise sensor data from sensors of the automation system200.

In particular, the n-th set of input data In may be embodied as a process image of the inputs and describes the plurality of input data231received during the n-th control cycle by the first input-output unit209of the first controller201.

In the first output transmitting step105, an (n−x)-th set of output data233is further sent out to the field devices205by the first input-output unit209of the first controller201. Here, the (n−x)-th set of output data describes output data generated by executing the control task in the first processing unit211based on an (n−x)-th set of input data. The (n−x)-th set of input data here describes input data231received from the first input-output unit209of the first controller201in an (n−x)-th control cycle. Here, the variable x is a natural number≥1 and describes the dead time, i.e.: the time delay with which output data233are transmitted relative to the receipt of corresponding input data231, on the basis of which the output data233was generated. The dead time may in this case comprise a period of several control cycles. The (n−x)-th set of output data sent out in the first output transmitting step105is thus based on an (n−x)-th set of input data received in a temporally earlier executed (n−x)-th control cycle by the first input-output unit209of the first controller201.

The cyclic control of the automation process by the first controller201thus provides that in any n-th control cycle, current input data in the form of an n-th set of input data In is received and output data in the form of an (n−x)-th set of output data is transmitted to the field devices205, wherein the (n−x)-th set of output data sent out is based on an (n−x)-th set of input data received in a temporally earlier (n−x)-th control cycle performed by the first input-output unit209of the first controller201. In this case, the (n−x)-th control cycle is executed temporally earlier by x control cycles than the n-th control cycle.

In a first data transmitting step107, the n-th set of input data In is transmitted from the first controller201to the second controller203. The transmission of the n-th set of input data In may be performed during the n-th control cycle, or may be performed in any control cycle that is timed to occur between the n-th control cycle and an (n+x)-th control cycle. The (n+x)-th control cycle is executed later than the n-th control cycle by the dead time x.

In a first processing step109, the n-th set of input data In is processed by the second processing unit219of the second controller203, and an n-th set of output data On is generated. The first processing step109may again also be performed in the n-th control cycle, or it may be performed in any control cycle that is temporally executed between the n-th control cycle and the (n+x)-th control cycle.

In a first output storing step111, the n-th set of output data On is stored in the second output memory unit223of the second controller203. Again, the first output storing step111may be executed in the n-th control cycle or else in any control cycle executed in time between the n-th control cycle and the (n+x)-th control cycle.

During the first n+x control cycles, the automation process is cyclically controlled by the first controller201according to the method steps described above. During this time, the second controller203is operated as a redundancy and is brought to the state of the first controller201by generating corresponding sets of output data233, in which both controllers201,203during each control cycle have the sets of output data233to be sent out to the field devices205in a temporally following control cycle for controlling the automation process.

In an error determining step113, a malfunction of the first controller201is determined during the (n+x)-th control cycle. A malfunction of the first controller201may comprise any error of the first controller201that prevents reliable cyclic control of the automation process by the first controller201.

The malfunction of the first controller201may e.g. be determined by a control module of the automation system200that is configured to monitor a functionality of the first controller201or the second controller203.

After detecting the malfunction of the first controller201in the (n+x)-th control cycle, in a further output transmitting step115, the n-th set of output data On stored in the second output memory unit223of the second controller203is sent out to the field devices205of the automation system200by the second input-output unit217of the second controller203. This allows control of the automation process via the second controller203to continue in the event of a malfunction of the first controller201. Since the n-th set of output data On is already stored in the second output memory unit223of the second controller203at the time the malfunction of the first controller201is detected, in the present embodiment during the (n+x)-th control cycle, it may be transmitted to the field devices205immediately after the malfunction is detected within the (n+x)-th control cycle by the second controller203for controlling the automation process. The control of the automation process may thus be continued seamlessly and an interruption of the automation process, which would be required for generating corresponding output data after the detection of the malfunction may e.g. be avoided.

According to an embodiment of the method100, it is provided that at each point in time a plurality of sets of output data are stored in the second output memory unit223. In this way, it may be achieved that at each point in time the second controller203has the output data intended for the respective control cycle stored in stock in the second output memory unit223, so that the required output data may be sent out immediately in the respective control cycle and the automation process may thus be controlled continuously.

FIG.3shows a schematic depiction of a time sequence of the method100inFIG.2.

InFIG.3, a time sequence of the method100in the embodiment inFIG.2is shown. For this purpose,FIG.3shows an exemplary embodiment in which the dead time x is equated with the time span of three successive control cycles. Thus, inFIG.3, the (n+x)-th control cycle corresponds to the (n+3)-th control cycle shown inFIG.3.

FIG.3shows the first controller201and the second controller203, in particular the first input-output unit209, the first input memory unit213, the first output memory unit215, and the first processing unit211, such as the second input memory unit221, the second processing unit219, the second output memory unit223, and the second input-output unit217.

Furthermore, six successive control cycles are shown, arranged one after the other along a time axis t. The actions of the first controller201or the second controller203represented within a control cycle take place simultaneously, or within the respective control cycle, while the actions represented successively along the time axis t take place successively in time.

In any n-th control cycle, the first controller201receives an n-th set of input data In via the first input-output unit209and sends out an (n−3)-th set of output data On−3 to the field devices205of the automation system200. The (n−3)-th set of output data On−3 was generated at an earlier point in time based on an (n−3)-th set of input data received in an (n−3)-th control cycle. In the embodiment shown inFIG.3, the received n-th set of input data In is stored in the first input memory unit213and forwarded to the first processing unit211. The first processing unit211executes the control task P and generates an n-th set of output data On, which is stored in the first output memory unit215.

Alternatively, the generation of the n-th set of output data On may be performed in a later control cycle, e.g. the (n+1)-th control cycle or the (n+2)-th control cycle. In the n-th control cycle, in addition to the n-th set of output data On, the first output memory unit215comprises an (n−1)-th set of output data On−1 and an (n−2)-th set of output data On−2, each based on an (n−1)-th set of input data and an (n−2)-th set of input data, respectively, generated by executing the control task P on the respective sets of input data231, each generated at an (n−1)-th control cycle and an (n−2)-th control cycle, respectively, and each generated by executing the control task P on the respective sets of input data231at an (n−2)-th control cycle, respectively, by the first input-output unit209.

In the embodiment shown inFIG.3, an (n−1)-th set of input data In−1 is further stored in the second input memory unit221of the second controller203. This is transmitted in the n-th control cycle to the second processing unit219, which generates a corresponding (n−1)-th set of output data On−1 based on the control task P, which is stored in the second output memory unit223. In the n-th control cycle, the second output memory unit223further comprises an (n−2)-th set of output data On−2 based on an (n−2)-th set of input data respectively generated by executing the control task P by the second processing unit219on the (n−2)-th set of input data In−2 received in an (n−2)-th control cycle by the first input-output unit209and transmitted to the second controller203. Furthermore, the second controller203receives an n-th set of input data In via the second input-output unit217, but this set is not further processed in the following. Similarly, the second controller203receives an n-th set of communication data Kn via the communication interface of the second controller203, which, however, will not be further dealt with in the following, either.

Furthermore, in the n-th control cycle, the first controller201transmits the n-th set of input data In stored in the first input memory unit213to the second controller203. In the embodiment ofFIG.3, the second controller203receives the transmitted n-th set of input data In in the temporally following (n+1)-th control cycle. The delay between sending and receiving the n-th set of input data In is based on the transmission time of the data signals between the first controller201and the second controller203, which may vary and is only shown as an example inFIG.3.

In addition to the n-th set of input data In, the first controller201receives an n-th set of communication data Kn via a corresponding communication interface in the n-th control cycle, which is stored in the first input memory unit213with the n-th set of input data In. Processing in the first processing unit211generates a corresponding n-th set of response data An, which is stored in the first output memory unit215together with the n-th set of output data On. Similarly, the first output memory unit215further comprises an (n−1)-th set of response data An−1 and an (n−2)-th set of response data An−2. Similarly, in the n-th control cycle, the second input memory unit221comprises an (n−1)-th set of communication data Kn−1 stored together with the (n−1)-th set of input data In−1. By executing the second processing unit219, an (n−1)-th set of response data An−1 is generated as a result, which is stored in the second output memory unit223with the (n−1)-th set of output data On−1. Similarly, with the (n−2)-th set of output data On−2, an (n−2)-th set of response data An−2 is stored in the second output memory unit223. Also, in the n-th control cycle, an (n−3)-th set of response data may be sent out by the first controller201via the communication interface.

In the subsequent (n+1)-th control cycle, the first controller201receives a corresponding (n+1)-th set of input data In+1 via the first input-output unit209, which, in the embodiment shown inFIG.3, is stored in the first input memory unit213, processed in the first processing unit211by executing the control task P, and a corresponding (n+1)-th set of output data On+1 is generated, which is stored in the first output memory unit215. Similarly, an (n+1)-th set of communication data Kn+1 is received via the communication interface, stored in the first input memory unit213, processed by the first processing unit211, and a corresponding (n+1)-th set of response data An+1 is generated, stored in the first output memory unit215.

Furthermore, the (n−2)-th set of output data On−2 stored in the first output memory unit215is sent out by the first input-output unit209in the (n+1)-th control cycle. Similarly, the (n−2)-th set of response data An−2 is sent out via the communication interface. Furthermore, the second controller203receives the n-th set of input data In transmitted in the n-th control cycle via the first controller201and stores it in the second input memory unit221. Furthermore, via execution of the control task P on the n-th set of input data In by the second processing unit219, an n-th set of output data On is generated and stored in the second output memory unit223. Similarly, an n-th set of communication data Kn is received and an n-th set of response data An is generated and stored in the second output memory unit223. Furthermore, the second controller203receives an (n+1)-th set of input data In+1 via the second input-output unit217, but the set of input data In+1 is not further processed in the shown embodiment. Similarly, the second controller203receives an (n+1)-th set of communication data Kn+1 via the communication interface of the second controller203, but this is not dealt with in the following, either.

In the subsequent (n+2)-th control cycle, the first controller201receives an (n+2)-th set of input data In+2, stores it in the first input memory unit213, and generates a corresponding (n+2)-th set of output data On+2 by executing the control task P on the (n+2)-th set of input data In+2, which is stored in the first output memory unit215. Similarly, an (n+2)-th set of communication data Kn+2 is received and an (n+2)-th set of response data An+2 is generated and stored. In the (n+2)-th control cycle, the second controller203receives the (n+1)-th set of input data In+1 transmitted from the first controller201in the (n+1)-th control cycle and stores it in the second input memory unit221. Analogously to the above, an (n+1)-th set of output data On+1 is generated and stored from the (n+1)-th set of input data In+1 by execution of the control task P. Similarly, an (n+1)-th set of communication data Kn+1 is received, and a corresponding (n+1)-th set of response data An+1 is generated and stored in the second output memory unit223. Furthermore, the second controller203receives an (n+2)-th set of input data In+2 via the second input-output unit217, but this set is not further processed in the embodiment shown. Similarly, the second controller203receives an (n+2)-th set of communication data Kn+2 via the communication interface of the second controller203, but this is also not discussed further below.

In the (n+2)-th control cycle, the (n−1)-th set of output data On−1 stored by the first controller201in the first output memory unit215is further sent out via the first input-output unit209. Similarly, the (n−1)-th set of response data An−1 is sent out via the communication interface.

In the subsequent (n+3)-th control cycle, a malfunction of the first controller201is detected, which has the effected that cyclic control of the automation process via the first controller201is no longer possible. Thereupon, the n-th set of output data On stored in the second output memory unit223at the time of the (n+3)-th control cycle is sent out by the second controller203to the field devices205of the automation system200for controlling the automation process via the second input-output unit217. As a result, the second controller203ensures that in the (n+3)-th control cycle in which control by the first controller201is no longer possible, the n-th set of output data On provided for this control cycle is sent out to the field devices205of the automation system200. Thus, in case of a malfunction of the first controller201, an undelayed control of the automation process by the second controller203may be ensured.

Furthermore, in the (n+3)-th control cycle, the second controller203receives the (n+2)-th set of input data In+2 and the (n+2)-th set of communication data Kn+2 transmitted from the first controller201in the (n+2)-th control cycle, stores them in the second input memory unit221, and generates a corresponding (n+2)-th set of output data On+2 and an (n+2)-th set of response data An+2 by executing the control task P. However, in the embodiment shown inFIG.3, storing the (n+2)-th set of output data On+2 and the (n+2)-th set of response data An+2 in the second output memory unit223is not performed until the subsequent (n+4)-th control cycle. According to an embodiment, processing of the sets of input data stored in the second input memory unit221may be performed at any time.

Moreover, in the (n+3)-th control cycle, the second controller203receives an (n+3)-th set of input data In+3 via the second input-output unit217and an (n+3)-th set of communication data Kn+3 via the communication interface, which the second controller203stores in the second input memory unit221in the (n+3)-th control cycle.

After malfunction of the first controller201in the (n+3)-th control cycle, the second controller203takes over cyclic control of the automation process for the subsequent control cycles, so that in the following (n+4)-th control cycle, the second controller203receives a corresponding (n+4)-th set of input data In+4 via the second input-output unit217and an (n+4)-th set of communication data Kn+4 via the communication interface and stores them in the second input memory unit221. Furthermore, to control the automation process in the (n+4)-th control cycle, the second controller203transmits the (n+1)-th set of output data On+1 stored in the second output memory unit223based on the set of input data In+1 received in the (n+1)-th control cycle. For communication, the (n+1)-th set of response data An+1 is sent out via the communication interface. In the embodiment shown inFIG.3, in the (n+4)-th control cycle, an (n+3)-th set of output data On+3 and an (n+3)-th set of response data An+3 are further generated based on the (n+3)-th set of input data In+3 and the (n+3)-th set of communication data Kn+3 stored in the second input memory unit221and stored in the second output memory unit223.

Similarly, in the subsequent (n+5)-th control cycle, an (n+5)-th set of input data In+5 is again received by the second controller203via the second input-output unit217and an (n+5)-th set of communication data Kn+5 is received via the communication interface and stored in the second input memory unit221. Furthermore, the (n+2)-th set of output data On+2 stored in the second output memory unit223at the time of the (n+5)-th control cycle is sent out to the field devices205for controlling the automation process. Furthermore, the (n+2)-th set of communication data Kn+2 is sent out via the communication interface. Analogously to the (n+4)-th control cycle, in the (n+5)-th control cycle, the (n+4)-th set of input data In+4 and the (n+4)-th set of communication data Kn+4 stored in the second input memory unit221are furthermore processed, and a corresponding (n+4)-th set of output data On+4 and an (n+4)-th set of response data An+4 are generated and stored in the second output memory unit223.

The embodiment shown inFIG.3, in particular the numerical examples shown there, are merely examples of a possible embodiment of the method100and are not intended to limit it. In particular, the dead time x, which in the embodiment shown inFIG.3corresponds to the period of three successive control cycles, may extend over any period of time. Furthermore, e.g. a plurality of different control tasks P may be executed in one control cycle, such that a plurality of different sets of output data233may be generated in a control cycle. Furthermore, processing of the received sets of input data by the processing units or storing of the generated sets of output data in the output memory units may be performed in each control cycle in which the respective sets of input data231were received. Alternatively, said operations may be performed at a later control cycle. Alternatively, the processing of received sets of input data via the processing unit and the storing of the generated sets of output data in the respective output memory units may be performed in a period comprising a plurality of successive control cycles.

The n-th to (n+2)-th sets of input data In, In+1, In+2 recorded by the first input-output unit209of the first controller201and by the second input-output unit217of the second controller203, respectively, may be compared to one another. This may be used to verify that both controllers are operating on identical input data. Similarly, the n-th to (n+2)-th sets of output data On, On+1, On+2 displayed in the n-th to (n+2)-th control cycles by the first processing unit211of the first controller201and by the second processing unit219of the second controller203, respectively, may be compared to one another. As a result, errors in the processing of the input data by the first controller201or the second controller203may be determined. The aforementioned comparisons of the input data and the output data, respectively, may be performed by an external controller.

FIG.4shows a further flowchart of the method100for controlling an automation system200according to another embodiment.

The embodiment inFIG.4is based on the embodiment inFIG.2and comprises all the method steps described there. Provided that as these remain unchanged in the embodiment inFIG.4, a renewed detailed description is dispensed with.

Deviating from the embodiment inFIG.2, the method100in the embodiment ofFIG.4comprises a second controlling step117, in which a cyclic control of the automation process is carried out by the second controller203, comparable to the (n+4)-th control cycle or (n+5)-th control cycle inFIG.3.

For any (n+m+x)-th control cycle, wherein m is a natural number≥1, and wherein the (n+m+x)-th control cycle is executed m control cycles later in time than the (n+x)-th control cycle, the second controlling step117comprises a second input receiving step119and a second output transmitting step121.

In the second input receiving step119, the second controller203receives an (n+m+x)-th set of input data via the second input-output unit217.

In the second output transmitting step121, the second controller203sends an (n+m)-th set of output data to the field devices205of the automation system200via the second input-output unit217. The (n+m)-th set of output data is in this context based on an (n+m)-th set of input data received in an (n+m)-th control cycle.

Following the numerical example shown inFIG.3, the arbitrary (n+m+x)-th control cycle e.g. corresponds to the (n+5)-th control cycle for m=2 and x=3. Here, the (n+m)-th set of output data corresponds to the (n+2)-th set of output data On+2, wherein the (n+m+x)-th set of input data corresponds to the (n+5)-th set of input data In+5.

The numerical examples given are again merely exemplary in nature and are not intended to limit the invention.

The second controlling step117thus allows for cyclically controlling the automation process by the second controller203in the event of a malfunction of the first controller201.

FIG.5shows a further flowchart of the method100for controlling an automation system200according to a further embodiment.

The embodiment depicted inFIG.5is based on the embodiment shown inFIG.4and comprises all the method steps described there. If these remain unchanged in the embodiment inFIG.5, a detailed description will be dispensed with.

Differing from the embodiment inFIG.4, the method100in the embodiment ofFIG.5comprises a second processing step123and a second output storing step125. In the second processing step123, the first processing unit211of the first controller201processes the n-th set of input data In and generates a corresponding n-th set of output data On. In the second output storing step125, the generated n-th set of output data On is stored in the first output memory unit215of the first controller201. According to the embodiment shown inFIG.3, the second processing step123and the second output storing step125may be carried out in the n-th control cycle. Alternatively, the second processing step123and the second output storing step125may be executed in any control cycle that is temporally executed between the n-th control cycle and the (n+x)-th control cycle.

Furthermore, in the embodiment shown inFIG.5, the method100comprises a third processing step127and a third output storing step129. In the third processing step127, the (n+m)-th set of input data is processed and a corresponding (n+m)-th set of output data is generated by the second processing unit219of the second controller203. In the third output storing step129, the generated (n+m)-th set of output data is stored in the second output memory unit223of the second controller203. According to the embodiment shown inFIG.3, the third processing step127and the third output storing step129may be carried out in the (n+m)-th control cycle. Alternatively, the third processing step127and the third output storing step129may be carried out in any control cycle that is temporally performed between the (n+m)-th control cycle and the (n+m+x)-th control cycle.

The third processing step127and the third output storing step129may be carried out in the (n+m)-th control cycle. Alternatively, the third processing step127and the third output storing step129may be executed in analogy to the embodiment inFIG.3in any control cycle that is temporally arranged between the (n+m)-th control cycle and the (n+m+x)-th control cycle. For the numerical example of m=1 and x=3 in the embodiment inFIG.3, the third processing step127and the third output storing step129, i.e., processing the (n+2)-th set of input data In+2 and generating the corresponding (n+2)-th set of output data On+2, are executed in the (n+3)-th control cycle. In contrast, storing the (n+2)-th set of output data On+2 in the second output memory unit223is performed in the (n+4)-th control cycle.

Furthermore, in the embodiment shown inFIG.5, the method100comprises a fourth processing step131and a fourth output storing step133. In the fourth processing step131, the (n+m+x)-th set of input data is processed and a corresponding (n+m+x)-th set of output data is generated by the second processing unit219of the second controller203. In the fourth output storing step133, the generated (n+m+x)-th set of output data is stored in the second output memory unit223of the second controller203. For example, the fourth processing step131and the fourth output storing step133may be carried out in the (n+m+x)-th control cycle Similarly, the fourth processing step131and the fourth output storing step133may be carried out in any control cycle that is temporally executed between the (n+m+x)-th control cycle and an (n+m+2x)-th control cycle.

Furthermore, the embodiment inFIG.5comprises a third input receiving step135in which an n-th set of input data In is received via the second input-output unit217of the second controller203in the n-th control cycle.

In a comparing step137, the n-th set of input data In the first controller201is compared to the further n-th set of input data In the second controller203.

In a deviation determining step139, a deviation between the n-th set of input data In of the first controller201and the further n-th set of input data In of the second controller203is determined.

On the basis of the deviation between the two n-th sets of input data of the first controller201and of the second controller203, an error in a data transmission between the field devices205and the first controller201is determined in a transmission error determining step141. This corresponds to a malfunction of the first controller201, so that after the faulty data transmission is determined in the further output transmitting step115, control of the automation process is taken over by the second controller203.

In the embodiment shown inFIG.3, the comparing step137is not explicitly depicted. As shown inFIG.3, both controllers201,203record corresponding sets of input data for each control cycle. A comparison of the respective sets of input data recorded by the first controller201and by the second controller203may thus be carried out for each control cycle, so that a functionality of the data transmission between the field devices205and the first controller201and the second controller203may be performed in each control cycle.

FIG.6shows another flowchart of the method100for controlling an automation system200according to another embodiment.

The embodiment of method100inFIG.6is based on the embodiment of method100inFIG.5and comprises all the method steps described there. Provided that these remain unchanged in the embodiment inFIG.6, no further detailed description is provided.

Deviating from the embodiment ofFIG.5, the method100in the embodiment inFIG.6comprises a memory copying step147. In the memory copying step147, a memory copy of the first memory area of the first controller201is performed. In this context, the memory copy comprises the sets of input data or output data stored in the first memory area of the first controller201temporally before any n-th control cycle in the first input memory unit213or the first output memory unit215.

In a copy transmitting step149, the memory copy is transmitted to the second controller203.

In a first copy storing step151, the sets of input data of the memory copy are stored in the second input memory unit221of the second controller203.

In a second copy storing step153, the sets of output data of the memory copy are stored in the second output memory unit223of the second controller203.

In a fifth processing step155, the sets of input data of the memory copy are processed by the second processing unit219based on the control task P, and corresponding sets of output data are generated.

In a fifth output storing step157, the generated sets of output data are stored in the second output memory unit223of the second controller203.

This achieves that, in particular when the system is started up, the second controller203is brought to the process state of the first controller201, so that after the corresponding sets of input data and output data of the memory copy have been stored, the first controller201and the second controller203may be executed on identical sets of input data and identical sets of output data. This achieves that the first controller201and the second controller203are interchangeable at any time of the cyclic control of the automation process, and control tasks of one controller may be immediately taken over by the other controller.

In addition to the sets of input data and output data, the memory copy may further comprise all information of a program state of the control program of the automation system. In the program state, all information required for controlling the automation process may be stored. In particular, all variables and program objects of the control program may be stored with corresponding values in the program state. The program state thus describes the state of the automation system at a time when the program state is stored.

The transmission of the memory copy to the second controller203as well as the storage of the sets of input data contained in the memory copy in the second input memory unit221as well as the storage of the sets of output data contained in the memory copy in the second output memory unit223as well as the processing of the sets of input data and the generation of corresponding sets of output data by the second processing unit219of the second controller203may be performed in one control cycle. Alternatively, depending in particular on the data size of the memory copy, the transfer and storage of the sets of input data in the second input memory unit221and the storage of the sets of output data in the second output memory unit223, respectively, as well as the processing of the sets of input data and the generation of corresponding sets of output data by the second processing unit219and the corresponding storage of the generated sets of output data in the second output memory unit223may be performed over a period of time comprising a plurality of successive control cycles. In particular, when the memory copy comprises the program state of the control program and thus, depending on the complexity of the particular automation process or automation system to be controlled, the memory copy may have a substantial amount of data.

In this case, the transfer and storage of the data contained in the memory copy by the second controller203may take a period of time that comprises a plurality of consecutive control cycles. Upon completion of the transfer and storage of the memory copy in the memory area of the second controller203and the reading in of the data of the memory copy by the second controller203, the second memory unit203may generate sets of output data via the second processing unit219, as described above, and store these, in the second output memory unit223. The second controller203may continue to do so until the second controller203is at the same level as the first controller203, that is, the second controller203has generated and stored a set of output data to be sent out in a subsequent control cycle according to the predetermined dead time in the second output memory unit223.

In the embodiment shown, the method100further comprises an input storing step143and a second input storing step145. In the first input storing step143, the first controller201stores the n-th set of input data In received in the n-th control cycle in the first input memory unit213n-th control cycle. In the second input storing step145, the second controller203stores the n-th set of input data In transmitted from the first controller201to the second controller203in the second input memory unit221of the second controller203.

By storing the n-th set of input data In in the first input memory unit213, it may be achieved that the received input data231in the form of the n-th set of input data In does not need to be processed directly in the control cycle by the processing unit by executing the control task P in which the input data231is received. Instead, any later processing may e.g. be carried out at a time when computing capacity is advantageous and no other applications are delayed by the processing of the input data231. The same applies to the storage of the input data in the second input memory unit221by the second controller203. As a result, the second controller203for processing the input data is not bound to the respective control cycle in which the input data231sent out from the first controller201to the second controller203is received by the second controller203, either.

FIG.7shows a schematic depiction of a time sequence of the method100inFIG.6.

The depiction inFIG.7of the time sequence of the method100is analogous to the depiction inFIG.3. The focus of the illustration inFIG.7is on the storage of the memory copy SK and the implementation of the information of the memory copy SK by the second controller203.

FIG.7shows the case in which the automation process is cyclically controlled exclusively by the first controller201. For this purpose, the first controller receives a corresponding set of input data and sends a set of output data to the field devices in each control cycle. The processes of the first controller201for controlling the automation process are analogous to the mechanism illustrated inFIG.3and will not be described again below.

In any n-th control cycle, the second controller203receives the memory copy SK of the program state of the automation system200in which the comprehensive information needed to control the automation process, including the states of the individual components, i.e., devices, of the automation system200involved in the automation process, and stores the memory copy SK in the memory area of the second controller203.

Deviating from that shown inFIG.7, the receiving and storing of the memory copy SK by the second controller203may comprise a plurality of successive control cycles.

In the embodiment shown inFIG.7, the second controller203stores, from the memory copy SK, an n−3th set of input data In−3 and communication data Kn−3, an n−2th set of input data In−2 and communication data Kn−2, and an n−1th set of input data In−1 and communication data Kn−1 in the second input memory unit221in the n-th control cycle. Moreover, the second controller203stores an n−3-th set of output data On−3 and response data An−3 from the memory copy SK, and an n−2-th set of output data On−2 and response data An−2 in the second output memory unit223. The depicted number of sets of input data and output data stored in the respective memory units from the memory copy SK are merely exemplary in nature and may vary as desired.

In a subsequent n+1th control cycle, the second controller203receives from the first controller201, the n-th set of input data In including the communication data Kn received from the first controller201in the n-th control cycle and stores it in the second input memory unit221. However, the processing of the n-th sets of input data In and communication data Kn by executing the control task P is not executed in the n+1th control cycle but in a later control cycle, in the embodiment shown, in the subsequent n+2th control cycle. This delay in processing is exemplary and is merely intended to illustrate that receiving and processing input data231and communication data may be performed at different times and in different control cycles. Furthermore, in the n-th control cycle, the (n−1)-th set of input data In−1 is processed by the second processing unit219and a corresponding (n−1)-th set of output data On−1 is generated and stored in the second output memory unit223. Similarly, the (n−1)-th set of communication data Kn−1 is processed by carrying out the control task P and a corresponding (n−1)-th set of response data An−1 is generated and this is stored in the output memory unit223.

In an n+2-th control cycle, an n+1-th set of input data In+1 sent out from the first controller201including the communication data Kn+1 is received and stored in the second input memory unit221. Furthermore, the n-th set of input data In and the (n+1)-th set of input data In+1 are processed by the second processing unit219including the respective communication data, and accordingly, an n-th set of output data On, an n-th set of response data An, an (n+1)-th set of output data On+1, and an (n+1)-th set of response data An+1 are generated and stored in the second output memory unit223. As mentioned above, execution of the control task P on corresponding input data by the first processing unit213or the second processing unit219may be performed at arbitrary times, so that multiple sets of input data may also be processed within one control cycle, if necessary.

In the embodiment shown inFIG.7, in the n+2nd control cycle, in particular after completion of the n+1th control cycle, the recording of the information of the memory copy SK by the second controller203is completed. From the n+2-th control cycle, the second controller203exclusively processes input data, received from the first controller201in a control cycle carried out immediately previously. Furthermore, in the second output memory unit223the current sets of output data are provided, i.e. the sets of output data On, to be sent out in an immediately subsequent control cycle according to the predetermined dead time x. Thus, the second controller203, after completion of the storage of the memory copy SK at the beginning of the n+2th control cycle, is at the same level as the first controller201, comprises the sets of output data and response data that would be to be sent out in the immediately following control cycle or cycles, and is thus able to seamlessly take over and continue control of the automation process from the first controller201.

During the n-th to (n+2)-th control cycles, the second controller203further receives n-th to (n+2)-th sets of communication data Kn, Kn+1, Kn+2, but these are not considered further in the course of the control cycles as long as the control of the automation process and the data communication is controlled by the first controller201.

InFIG.3andFIG.7, the input data sent out by the first controller201in one control cycle is received by the second controller203in the immediately following control cycle. Due to the time required for data transmission, this may in reality take a longer period of time, so that receipt by the second controller203may occur at a later control cycle.

The control tasks P carried out inFIG.3andFIG.7in the various control cycles for generating output data may be an identical control task P that is executed repeatedly in successive control cycles in the cyclic control of the automation process. For example, the control task P may represent a complete control program of the automation process. Alternatively, the control task P may represent different parts of the control program that are executed in different control cycles. This is not explicitly shown inFIG.3andFIG.7.

The output data generated by the second controller203inFIG.3andFIG.7, which is not sent out by the second controller203but by the first controller201in the control cycles provided for this purpose because there is no malfunction of the first controller201, is removed from the second input-output unit217of the second controller203in subsequent control cycles. Output data and also communication data are sent out by the second controller203, in particular by the second input-output unit217, only if there is a malfunction of the first controller and the control of the automation process is taken over by the second controller203.

FIG.8shows another flowchart of the method100for controlling an automation system200according to a further embodiment.

The embodiment of method100inFIG.8is based on the embodiment of method100inFIG.6and comprises all the method steps described there. If these remain unchanged in the embodiment ofFIG.8, no further detailed description is provided.

Differing from the embodiment ofFIG.6, the method100inFIG.8comprises a first message receiving step159in which an n-th set of communication data Kn is received by the first communication unit of the first controller201in the n-th control cycle.

In a first response generating step161, an n-th set of response data An is subsequently determined based on the received n-th set of communication data Kn.

In a first response storing step163, the n-th set of response data An is stored in the first output memory unit215of the controller201.

In a first response transmitting step165, the n-th set of response data An stored in the first output memory unit215is sent out via the first communication interface of the first controller201in the (n+x)-th control cycle.

According to the embodiment shown inFIG.3, the received n-th set of communication data Kn is stored with the n-th set of input data In in the first input memory unit213of the first controller201. Similarly, the n-th set of response data An is stored with the n-th set of output data On in the first output memory unit215. In analogy to the embodiment ofFIG.3, the sets of response data may be transmitted from the first controller201to the second controller203together with the sets of output data for data communication.

Furthermore, a second message receiving step167receives (n+m+x)-th communication data via the second communication unit of the second controller203in the (n+m+x)-th control cycle.

In a second response generating step169, (n+m+x)-th response data are generated in response to the received (n+m+x)-th communication data.

In a second response storing step171, the (n+m+x)-th response data are stored in the second output memory unit223of the second controller203.

In a second response transmitting step173, the (n+m+x)-th response data are transmitted via the second communication interface of the second controller203in an (n+m+2x)-th control cycle. Data communication between modules of the automation system200, in particular between the first controller201and the second controller203, is enabled by the data transmission of the communication data or the response data.

This invention has been described with respect to exemplary examples. It is understood that changes can be made and equivalents can be substituted to adapt these disclosures to different materials and situations, while remaining with the scope of the invention. The invention is thus not limited to the particular examples that are disclosed, but encompasses all the examples that fall within the scope of the claims.

TABLE 1List of reference numerals100 method101 first controlling step103 first input receiving step105 first output transmitting step107 first data transmitting step109 first processing step111 first output storing step113 error detecting step115 further output transmitting step117 second controlling step119 second input receiving step121 second output transmitting step123 second processing step125 second output storing step127 third processing step129 third output storing step131 fourth processing step133 fourth output storing step135 third input receiving step137 comparing step139 deviation determining step141 transmission-error detecting step143 first input storing step145 second input storing step147 memory copying step149 copy transmitting step151 first copy storing step153 second copy storing step155 fifth processing step157 fifth output storing step159 first message receiving step161 first response generating step163 first response storing step165 first response transmitting step167 second message receiving step169 second response generating step171 second response storing step173 second response transmitting step200 automation system201 first controller203 second controller205 field device207 data bus209 first input/output unit211 first processing unit213 first input memory unit215 first output memory unit217 second input/output unit219 second processing unit221 second input memory unit223 second output memory unit225 internal data interface227 data link229 first connecting unit230 second connecting unit231 set of input data233 set of output data235 communication data237 response data