Abstract:
Multiple gateway devices communicating between a device level ring (DLR) network and a spanning tree (ST) network may be provided a gateway protocol that cooperatively ensures that only a single gateway is active at a given time. This cooperation may be effected by the transmission of advertise messages by gateways, the advertise messages holding precedence values so that only a single gateway having a highest precedence value is active at a given time. Loss of the advertise messages may trigger a gateway held in a backup state to assume an active gateway role.

Description:
BACKGROUND OF THE INVENTION 
       [0001]    The present invention relates to data networks suitable for industrial control and in particular to gateways communicating between a spanning tree (ST) network and device level ring (DLR) network. 
         [0002]    Networks used for communication among industrial controllers differ from standard networks in that they must operate to communicate data reliably and within predefined time limits among network devices that control equipment. A bounded response time may be provided by communication protocols that reserve network bandwidth and schedule messages. Network reliability may be provided by the introduction of redundant network components. 
         [0003]    Many computer networks provide for automatic “repair” of the network in the event of network device failure by switching between redundant components. These protocols can take a relatively long time to reconnect the network (as much as 30 seconds) and thus are unacceptable for industrial control networks where the controlled process often cannot be undirected during this period without serious consequences. 
         [0004]    High-speed correction for network failure in an industrial control environment can be obtained by connecting network devices in a device level ring (DLR) where the ring network topology presents redundant paths (along the ring in two opposite directions) between any two devices. Normally the ring is “open” at a supervisor device for all standard data and thus operates in a normal linear topology for most data messages. The supervisor may send out “beacon” frames in both directions on the ring on different ports which are received back at the opposite port to indicate the integrity of the ring. If the ring is broken by device or media failure outside of the supervisor, the supervisor rejoins the ends of the ring at the supervisor to restore a continuous linear topology with the ring now separated by the failed component rather than the supervisor. Changes in the state of operation of the supervisor from “separated” to “joined” may be transmitted to the other nodes using notification frames so that these nodes can rebuild their MAC address routing tables used to associate a port with a destination address. 
         [0005]    The error detection time of such ring systems can be quite fast, limited principally by the transmission rate of the beacons (every several microseconds). This rate defines the maximum time before which an error is detected and the ring may be reconfigured. 
         [0006]    It is often desired to connect a DLR network with other networks, for example, those associated with devices that do not require the benefits of the DLR network topology. Such networks may permit a more flexible device interconnection, facilitated by a “spanning tree protocol” (STP) that detects and eliminates possible “loops” in connections between devices, such loops which otherwise might permit messages to pass indefinitely in circles through the network. As is understood in the art, spanning tree protocols identify loops in a network built with infrastructure devices called bridges, and provide instructions to bridges to block certain ports to eliminate these network loops. These instructions are transmitted as “bridge protocol data units” (BPDUs) to the various bridges in the network. 
         [0007]    The loop structure of a DLR can be incompatible with a spanning tree (ST) type network, which attempts to eliminate loops. This incompatibility may be accommodated when providing a gateway between a DLR and ST type network by ensuring that each given DLR network has only a single gateway. This limitation to the number of gateways, however, increases the risk that a single gateway failure will prevent communication between the two networks. 
       SUMMARY OF THE INVENTION 
       [0008]    The present invention provides a system to permit redundant gateways between DLR and ST networks through a protocol ensuring that only one of multiple gateways in a DLR network may be active at one time. Generally, the gateways operate in either an active or a backup state, operating in the active state to permit connection of the DLR and ST networks through the gateway, and operating in the backup state to largely separate DLR traffic on one side of the gateway and ST traffic on the other side. Broadcast “advertise” messages, containing a precedence value, may be used to communicate among gateways to hold one gateway in an active state (having the highest precedence) and the other gateways in a backup state. Loss of the “advertise” message or explicit fault transmission causes a switchover between devices. 
         [0009]    Specifically, the present invention provides, in one embodiment, a gateway for connecting a device level ring (DLR) network to a spanning tree (ST) network. The gateway includes a first and second port connectable to devices in a DLR network to communicate DLR topology messages and general messages with other devices connected in the DLR network, the DLR topology messages controlling reconfiguration of the DLR in the event of a break in the DLR ring. The gateway also includes at least one third port connectable to devices in the ST network to communicate general messages with other devices connected in the ST network. A controller in the gateway communicates with the first, second, and third ports to operate in at least two states including an active state and a backup state where the gateway: (i) exchanges DLR topology messages only with other devices in the DLR network in the active and the backup states; (ii) exchanges general messages among devices in the ST network in the active and the backup states; and (iii) exchanges general messages between devices in the DLR network and devices the ST network only in the active state. 
         [0010]    It is thus a feature of at least one embodiment of the invention to provide redundancy in gateways between DLR and ST type networks without the conflicts that can occur in these two different network types, for example, spanning tree algorithms attempting to break the loop of the DLR network. 
         [0011]    The gateway may further monitor the DLR network to switch between the active and backup state based on messages from another gateway in the DLR network so that there is only one active gateway in the DLR network. 
         [0012]    It is thus a feature of at least one embodiment of the invention to provide an automatic configuration of redundant gateways between a DLR network and ST type network. By monitoring messages on the DLR network, the redundant gateways may self-organize so that only one gateway is active at a time and so that in the event of failure of a gateway, another gateway activates itself. 
         [0013]    The gateway may transmit advertise messages providing a precedence value unique to the gateway in the active state and listen for advertise messages in the backup state, and may switch from the backup state to the active state if advertise messages are not received during a predetermined time or are received with a lower precedence than the precedence value unique to the gateway. 
         [0014]    It is thus a feature of at least one embodiment of the invention to make use of the DLR network itself for organizing the multiple gateways. 
         [0015]    The precedence value may include a stored value set by a user and a MAC address of the gateway. 
         [0016]    It is a feature of at least one embodiment of the invention to eliminate the possibility of precedence “ties” when identifying a new gateway by using the unique MAC address as a tie-breaker. 
         [0017]    The gateway states may include a listen state and a backup state, and the gateway may switch from the listen state to the backup state if advertise messages are received with a higher precedence than the precedence value unique to the gateway and may switch from the backup state to the listen state if advertise messages are not received during a predetermined time or are received with a fault indication; and wherein the gateway transmits advertise messages in the listen state and not in the backup state. 
         [0018]    It is thus an object of at least one embodiment of the invention to permit the transmission of advertise messages from gateways performing a backup function without transmitting unnecessary advertise messages at all times during the backup function. 
         [0019]    The gateway may transmit a broadcast flush tables message to other devices on the DLR network causing them to relearn associations between addresses and ports when the gateway switches to the active state. The flush tables message may trigger transmission of a broadcast learning update message by the devices on the DLR network to the bridges on the ST network and to the other devices on the DLR network causing them to rapidly relearn associations between addresses and ports when the gateway switches to the active state. 
         [0020]    It is thus an object of a least one embodiment of the invention to provide a state change that may be used to trigger a learning update message to rapidly relearn the network topology on both sides of the gateway. 
         [0021]    These particular features and advantages may apply to only some embodiments falling within the claims and thus do not define the scope of the invention. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0022]      FIG. 1  is a diagram of an industrial control network configured as a device level ring (DLR) network and incorporating two gateway devices for communicating between the DLR network and a spanning tree (ST) network for exchange of data therebetween; 
           [0023]      FIG. 2  is a block diagram of the one of the gateway devices of  FIG. 1  in an active state; 
           [0024]      FIG. 3  is a block of another of the gateway devices of  FIG. 1  in a backup state; 
           [0025]      FIG. 4  is a simplified diagram of the DLR network of  FIG. 1  showing transmission of advertise messages from one gateway in an active or listen state used to enforce a single gateway operation; 
           [0026]      FIG. 5  is a state diagram of the operation of the gateways according to the present invention. 
       
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 
       [0027]    Referring now to  FIG. 1 , an industrial control network  10  may include, for example, multiple control devices  12   a - d  such as may exchange signals directly or indirectly with an industrial process  14  for real-time control of that process. Real-time control, in this context, means control that is subject to well-defined maximum delay periods between an output signal generated by the control device  12  and an electrical signal sent to an actuator in the industrial process  14 , and similarly well-defined maximum delay periods between the generation of a signal by a sensor in the industrial process  14  and its receipt and processing by a control device  12 . 
         [0028]    The control devices  12  may communicate with each other and with first and second gateway devices  16   a  and  16   b  by means of network media  18  supporting an industrial control network protocol to implement a full duplex IEEE 802.3 Ethernet network. 
         [0029]    The control devices  12  may provide the functionality of the programmable logic controller, a motor drive, an I/O module or the like and may include an electronic computer executing a stored program held in memory and providing logic for the necessary control. Often the stored program is generated uniquely for the particular industrial process  14 . The control devices  12  will also include standard network communication interfaces compatible with the protocol described above. 
         [0030]    Improved tolerance to network fault (being either the loss of a device  12  or network media  18 ) may be obtained by arranging the devices  12   a - 12   d  and gateways  16   a - 16   b  in a device level ring (DLR) network  19  wherein each device  12  and gateway  16  communicates with two other devices  12  or gateways  16  that flank it in the ring. Thus, for example, each given device  12  or gateway  16  may have a first and second DLR port  20   a  and  20   b  communicating via network media  18  with one device in a clockwise direction (e.g., port  20   a  of the given device communicating with port  20   b  of a clockwise flanking device) and with a one device in the counterclockwise direction (port  20   b  of the given device communicating with port  20   a  of the counterclockwise flanking device). A DLR network  19  suitable for use with the present invention is described, for example, in U.S. patent application Ser. No. 12/493,838 filed Jun. 29, 2009, assigned to the assignee of the present invention and hereby incorporated by reference. 
         [0031]    Each gateway  16   a  and  16   b  may also include multiple standard ports  22  that may connect to a standard, spanning tree (ST) network  24 . The ST network  24  may include multiple bridges  26  connected by network media  18  to permissibly create multiple physical loops and redundant interconnections between the gateways  16  and bridges  26 . The particular spanning tree protocol implemented by the spanning tree network  24  may follow IEEE 802.1D “rapid spanning tree protocol” (RSTP) or IEEE 802.1Q “multiple spanning tree protocol” (MSTP) or other similar standards. 
         [0032]    Referring now to  FIGS. 2 and 3 , each of the gateways  16   a  and  16   b  may operate in an active state  50  as shown in  FIG. 2  or a backup state  48  as shown in  FIG. 3 . In the active state  50 , general messages  28  may be transmitted between ports  20   a  and/or  20   b  and all other ports including ports  22 , for example, using common Ethernet protocols. Such general messages  28  exclude only DLR topology messages  30  which relate to reconfiguration of the topology of the DLR network  19  as may be transmitted from a supervisory node, as will be discussed below, and as is disclosed in the prior application cited above. In the active state  50 , DLR topology messages  30  may be transmitted only between ports  20   a  and  20   b.  General messages  28  may also include “bridge protocol data units” (BPDUs) from the spanning tree network  24  which may be communicated into the DLR network  19  which in normal operation will have no bridging loops because the logical loop of the DLR network  19  is broken either by a supervisory node or by a failure in the loop. 
         [0033]    Referring to  FIG. 3 , in the backup state  48 , general messages  28  from either of ports  20   a  or  20   b  may be transmitted only to the other of the ports  20   a  and  20   b  in the manner of the DLR topology messages  30 . Likewise general messages and other messages from the spanning tree ports  22  may only be transmitted to other spanning tree ports  22 . General messages are blocked from transmission between ports  20  and ports  22 . 
         [0034]    Referring now to  FIGS. 4 and 5 , each gateway  16  may have software or firmware providing a stored program  36  providing coordination between the gateways  16  on the DLR network  19 . When power is first applied to a given gateway  16   a,  for example, the given gateway  16   a  starts in a startup state  40  where traffic forwarding between ports  20  and  22  is blocked. If redundant gateway operation for the given gateway  16   a  is disabled, the program proceeds to single gateway node  44  per state transition arrow  45  and traffic is enabled between ports  20  and  22 . 
         [0035]    Alternatively, if redundant gateway operation is enabled for the given gateway  16   a,  for example by user command programmed into the gateway  16   a,  the program  36  proceeds to listen state  42  per state transition arrow  47  while continuing to block transmissions between ports  20  and  22 . 
         [0036]    At listen state  42 , the gateway  16   a  will transmit an advertise message  46  on the DLR network  19  (advertise messages shown for only gateway  16   a  in  FIG. 4  for clarity). The gateway  16   a  will also listen for advertise messages from other gateways (e.g. gateway  16   b ). The advertise messages  46  incorporate a precedence value that may be programmed into the gateway  16   a  by the user and also incorporate elements of the MAC address of the gateway  16   a  on the DLR network  19 . The advertise message  46  will also provide the state of the transmitting device, for example, as indicated by the listen state  42  or the active state  50  to be described below. 
         [0037]    If, at the listen state  42 , an advertise message  46  is received from another gateway  16   b  having a higher precedence value than that of the gateway  16   a  receiving the advertise message, the gateway  16   a  moves to a backup state  48  per state transition arrow  49 . As noted above, the precedence value includes a programmed portion and the MAC address of the gateway  16 . If the programmed portion of the precedence value of the received advertise message  46  is identical to the programmed portion of the precedence value of the receiving gateway  16   a  (for example by erroneous duplicate programming), the MAC address of the two gateways  16   a  and  16   b  are compared and the MAC address is used as a tiebreaker. That is, if the MAC address of the transmitting gateway  16   b  is numerically greater than the MAC address of the receiving gateway  16   a,  the receiving gateway  16   a  will transition to the backup state  48  per state transition arrow  49 . 
         [0038]    In the backup state  48  traffic forwarding from ports  20  to  22  is blocked and the gateway  16   a  will stop transmission of advertise messages  46  preventing unnecessary use of network bandwidth. 
         [0039]    If at the listen state  42  no advertise message  46  is received within a predetermined time out period or if an advertise message is received with a lower precedence value, the program  36  will proceed to the active state  50  per state transition arrow  51  and will become an active gateway device with traffic forwarding from ports  20  to  22  and vice versa. 
         [0040]    Upon transition to the active state  50 , the gateway  16   a  will transmit an advertise message  46  and will continue to transmit advertise messages  46  on a regular basis while in the active state  50 . In addition, immediately upon transition to the active state  50 , the gateway  16   a  will transmit a broadcast “flush tables” message to all DLR devices  12  and will flush its own unicast and multicast address learning filter tables (routing tables). The gateway  16   a  at this time will send a broadcast learning update frame to the non-DLR bridges  26  and to other DLR devices  12  to accelerate their learning. Upon receiving “flush tables” message, a DLR device  12  will flush its own unicast and multicast address learning filter tables (routing tables) and will send a broadcast learning update frame to the non-DLR bridges  26  and to other DLR devices  12  to accelerate their learning. 
         [0041]    While the gateway  16   a  is in the active state  50 , it continues to monitor the DLR network  19  for advertise messages  46 . If an advertise message  46  is received from another gateway  16   b  with a higher precedence (as described above) the given receiving gateway  16   a  will transition to the backup state  48  per state transition arrow  53 . 
         [0042]    While the program  36  is in the backup state  48 , if physical connection is lost on all the uplink ports  22  of the gateway  16   a  or higher level connection fault is detected on the ports  22 , the gateway  16   a  will transition to the fault state  56  as indicated by state transition arrow  58 . In the fault state  56 , forwarding of traffic between ports  20  and  22  will be blocked and no advertise messages  46  will be transmitted; however, the fault will continue to be monitored. 
         [0043]    Alternatively, while the gateway  16   a  is in the active state  50  or listen state  42 , if physical connection is lost on all the uplink ports  22  or higher level connection fault is detected on the ports  22 , the gateway  16   a  will transmit an advertise message  46  denoting a fault state  56  and will transition to the fault state  56  per state transition arrow  59  or state transition arrow  61  as appropriate, again blocking traffic between the ports  20  and the ports  22  and ceasing transmission of the advertise message  46  in the fault state  56 . 
         [0044]    While in the backup state  48 , if an advertise message  46  is received from a gateway  16   b  denoting a fault state or if advertise messages  46  are not received from an active gateway  16   b  for predetermined time out period, the gateway  16   a  will move to the listen state  42  as indicated by state transition arrow  57 . As before in this listen state  42 , traffic is blocked between ports  20  and  22 . 
         [0045]    While the gateway  16   a  is in the fault state  56 , it continues to monitor the advertise messages  46  and if the connection on ports  22  is restored and the advertise messages  46  indicate an active gateway  16   b  having a precedence greater than the receiving gateway  16   a,  the program  36  transitions to the backup state  48  as indicated by state transition arrow  55 . Alternatively, if the connection on ports  22  is restored and the received advertise messages  46  are from a gateway  16   b  having a lower precedence than the receiving gateway  16   a,  the program  36  transitions from the fault state  56  to the listen state  42  as indicated by state transition arrow  60 . The gateway  16   a  stays in the fault state  56  per state transition arrow  62 , if the advertise messages  46  are not received from an active gateway  16   b  for predetermined time out period and the connection on ports  22  is still not restored. 
         [0046]    It is possible for partial network fault to occur so that data traffic is lost in only one direction on a given section of network medium  18  suggesting to a gateway  16   a  that an active higher precedence gateway  16   b  device is lost when in fact it is simply a failure of the network medium  18 . To prevent multiple gateways  16  from being enabled in this situation a gateway  16   a  in active state  50  that receives advertise messages  46  from a gateway  16  in the active state  50  but having a lower precedence will block traffic forwarding from ports  20  to  22  until this condition is cleared by the user. 
         [0047]    Certain terminology is used herein for purposes of reference only, and thus is not intended to be limiting. For example, terms such as “upper”, “lower”, “above”, “below”, “clockwise”, and “counterclockwise” refer to directions in the drawings to which reference is made. Terms such as “front”, “back”, “rear”, “bottom” and “side”, describe the orientation of portions of the component within a consistent but arbitrary frame of reference which is made clear by reference to the text and the associated drawings describing the component under discussion. Such terminology may include the words specifically mentioned above, derivatives thereof, and words of similar import. Similarly, the terms “first”, “second” and other such numerical terms referring to structures do not imply a sequence or order unless clearly indicated by the context. 
         [0048]    When introducing elements or features of the present disclosure and the exemplary embodiments, the articles “a”, “an”, “the” and “said” are intended to mean that there are one or more of such elements or features. The terms “comprising”, “including” and “having” are intended to be inclusive and mean that there may be additional elements or features other than those specifically noted. It is further to be understood that the method steps, processes, and operations described herein are not to be construed as necessarily requiring their performance in the particular order discussed or illustrated, unless specifically identified as an order of performance. It is also to be understood that additional or alternative steps may be employed. 
         [0049]    References to a controller, computer or processor or its equivalent can be understood to include one or more computational devices including microprocessors, field programmable gate arrays, and application specific integrated circuits that can implement state aware logic and that can communicate in a stand-alone and/or a distributed environment(s), and can thus be configured to communicate via wired or wireless communications with other processors, where such one or more processor can be configured to operate on one or more processor-controlled devices that can be similar or different devices. Furthermore, references to memory, unless otherwise specified, can include one or more processor-readable and accessible memory elements and/or components that can be internal to the processor-controlled device, external to the processor-controlled device, and can be accessed via a wired or wireless network.