Abstract:
A controller and a method for operating the controller is disclosed. The controller, in response to a detected Ethernet network error, performs the steps of determining whether a communication error has occurred, notifying the controller that an error has occurred, stopping normal controller operation, and executing fail safe routine.

Description:
TECHNICAL FIELD 
     The present invention relates to the use of controllers, such as programmable logic controllers on Ethernet networks with provisions for safety systems. 
     BACKGROUND OF THE INVENTION 
     In a factory automation system, such as those in a nuclear power plant, manufacturing or petrochemical plant, the assurance of delivery of a message is critical to safe operation. As Ethernet protocols, which were originally developed for office automation markets, are moved into critical factory applications, new techniques need to be developed to assure the safety of the communication and control systems. Since network communications can never be fully guaranteed, provisions must be implemented to detect network errors and notify the corresponding programmable logical controller working in a factory environment so that it may take appropriate action when a failure occurs. 
     SUMMARY OF THE INVENTION 
     It is an object of the invention to provide a controller with provisions for a safety system. 
     In accordance with this object, a system and method are disclosed whereby the system determines whether an Ethernet communication error has occurred, and if an error has occurred notifies the controller that an error has occurred, stops normal controller operation; and executes fail-safe software code to take appropriate action. 
     In a second aspect of the present invention, a system and method are disclosed whereby a first and second controller in response to a detected Ethernet network error determines whether a communication error has occurred, notifies the first controller that an error has occurred, sends a network message to the second controller to start the second controller, and operates the second programmable controller on the network in place of the first controller. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     FIG. 1 is a diagram of the system according to the present invention, and 
     FIG. 2 is a flow chart of the system according to a first embodiment of the present invention. 
     FIG. 3 is a flow chart of the system according to a second embodiment of the present invention. 
    
    
     DETAILED DESCRIPTION 
     While this invention is susceptible of embodiment in many different forms, there is shown in the drawings and will herein be described in detail preferred embodiments of the invention with the understanding that the present disclosure is to be considered as an exemplification of the principles of the invention and is not intended to limit the broad aspect of the invention to the embodiments illustrated. 
     Referring to FIG. 1, there is shown a controller (PLC)  2  having an Ethernet communication board  4 . The Ethernet communication board  4  is capable of sending and receiving network messages to and from any other device  6  on an Ethernet network  8 , such as a transceiver, a personal computer, a data relay, other another PLC etc. The basic Ethernet communication board  4  used in the PLC is described in U.S. patent application Ser. Nos. 08/927,005, 09/224,196, 09/303,458 and 09/477,113 the contents of such applications are hereby incorporated by reference. 
     Referring to FIG. 2, in step  10  the Ethernet communication board  4  of the PLC  2  receives a network message. Network messages are transmitted between the PLC  2  and the other network devices  6 . At step  12 , the Ethernet communication board  4  determines whether a network communication error has occurred. The PLC  2  determines if there is a network communication error primarily by performing a CRC-32 check on the network message to determine is the message has been corrupted in transit by checking the logical data included in the network message header. If no network communication error has occurred in step  12 , the PLC  2  returns to step  10  to process the next network message. If a network error has occurred, the PLC  2  advances to step  14 . At step  14 , the Ethernet communication board  4  notifies the PLC  2  that a network communication error has occurred. At step  16 , in response to the notification the PLC  2  stops normal operation and advances to step  18 . Normal operation is the operation of the PLC during which no network error has been detected. At step  18 , the PLC executes a fail-safe set of code and advances to step  19 . By way of example, the fail-safe set of code can be code which activates an alarm to notify personnel. 
     At step  19 , the PLC fail-safe code determines if operator intervention is required. If operator intervention is required, the PLC advances to step  20 . Otherwise, the PLC advances to step  10  to resume normal Ethernet network communication. 
     If operator intervention is required, at step  20 , the PLC determines whether an operator has intervened. Operator intervention can be, for example, an operation clearing or acknowledging the alarm. If an operator has not intervened, the PLC  2  does not advance beyond step  20 . If an operator has intervened, the PLC  2  advances to step  10  to continue normal Ethernet network communication. 
     Referring to FIG. 3, in an alternative embodiment, the Ethernet communication board  4  of the PLC  2  receives a network message at step  22 . At step  24 , the Ethernet communication board  4  determines whether a network communication error has occurred. If no network error has occurred in step  24 , the PLC  2  returns to step  22  to process the next network message. If a network error has occurred, the PLC  2  advances to step  26 . At step  26 , the Ethernet communication board  4  notifies the PLC. 2  that a network communication error has occurred and advances to step  28 . After step  28 , in response to the notification the PLC  2  sends a message to a second PLC  6  operating on the network, and then the PLC  2  ceases sending and receiving messages on the network in step  30 . In response to the message of step  28 , the second PLC  6  begins operating on the network in place of the first PLC in step  32 . The second PLC  6  mirrors the first PLC  2  and, therefore, can resume operation for the first PLC  2  without interruption to the process controlled by the first PLC  2 . The second PLC  6  then begins sending and receiving network messages in place of the first PLC  2 . 
     While the specific embodiments have been illustrated and described, numerous modifications come to mind without significantly departing from the spirit of the invention and the scope of protection is only limited by the scope of the accompanying claims.