Abstract:
The present invention relates to a method of negotiating an active or a passive role assignment to a first and a second control means of a network element. The control means are redundant and operate dependent on their respective active or passive role. The invention furthermore relates to a control means therefor, a program module for a control means therefor and a network element therefor. 
     The method comprises the steps of:
       determining an operability state parameter for each of said control means dependent on their respective ability to perform their respective functionality;   mutually transmitting said operability state parameters between said control means; and   determining an active role or a passive role by said control means dependent on said respective operability state parameters.

Description:
The invention is based on a priority application EP 02 360 061.2 which is hereby incorporated by reference. 
   FIELD OF THE INVENTION 
   The present invention relates to a method of negotiating an active or a passive role assignment to a first and to at least one second control means of a network element, the first and the at least one second control means being redundant and operating dependent on their respective active or passive role. The invention furthermore relates to a control means therefor, a program module for a control means therefor and a network element comprising a first control means and at least one second control means therefor. 
   BACKGROUND OF THE INVENTION 
   A network element in a communication network, e.g. a cross-connect equipment in a synchronous digital hierarchy (SDH) network or a switching center in a switched telecommunications network, has to be high reliable. Thus, some components, hardware and/or software components, of such network elements are redundant. For example central processing units (CPU), hardware controller or other control means of a cross-connect equipment are usually redundant. If for example a first and a second controller alternatively may control a predetermined hardware equipment, the first controller may play an active role whereas the second controller may play a passive role or vice versa. Only the active controller controls actively the hardware equipment, the passive controller is in a stand-by mode concerning the hardware to be controlled. The passive controller may however perform other functionalities in the passive/stand-by mode. The respective active role or passive role has to be assigned to the first and the second controller in order to avoid active-active or passive-passive conflicts between the first and the second controller. In an active-active conflict both controllers intend to control the hardware, in a passive-passive conflict none of both is responsible for the hardware. 
   It is known that a superordinated third controller coordinates the respective active role and the passive role of the first and the second controller. The third controller assigns the active role to the first and the passive role to the second controller or vice versa. It is however expensive to provide a superordinated controller. Furthermore, the superordinated controller is an additional source of error. In the case of, e.g., a malfunction of the superordinated controller or of a disturbed communication between the superordinated and the subordinated controllers, the active and passive roles cannot be properly assigned to the subordinated redundant controllers. 
   SUMMARY OF THE INVENTION 
   Accordingly one object of the invention is to provide a reliable method of negotiating an active or a passive role assignment to a first and to at least one second control means of a network element. Further objects of the invention are to provide an appropriate control means, an appropriate program module for a control means and an appropriate network element. 
   This objects are to be attained by a method in accordance with the technical principle of claim  1 , a control means, a program module for a control means therefor and a network element therefor, said control means, said program module and said network element being in accordance with technical principles of further independent claims. 
   In this respect one principle of the invention is that two or more redundant control means interactively negotiate their respective active or passive role. The control means, for example central processing units (CPU) or, preferably, hardware controllers, determine their respective operability state parameter. The operability state parameters for a control means depend on its respective ability to perform its functionality. The control means mutually transmit their operability state parameters. Usually—except for, e.g., transmission problems and/or a malfunction of a control means—each of the control means is informed about the operability states of the other redundant control means. Based on this information the control means determine their respective active or passive role dependent on said operability state parameters. A typical result of the above negotiation is, that one control means plays the active role whereas one or more further control means play a passive role. However, other scenarios are possible wherein for example two control means play an active role whereas one or more control means are in a passive role, e.g. in a stand-by or hot stand-by mode. 
   A control means according to the invention can execute the method according to the invention. The control means may contain hardware and/or software means to carry out steps of the method. The control means may for example run a program module according to the invention. A network element according to the invention, e.g. a cross-connect system or any other telecommunication equipment of a synchronous digital hierarchy (SDH), a synchronous optical network (SONET), an optical transport hierarchy (OTH) or the like, a (call-level) circuit switch of a switched network, a router of a routed network or the like, may contain two or more control means mentioned above. A network element according to the invention may also contain two or more disjoint groups of control means. The respective control means of one of said groups may negotiate their respective active or passive role assignment independently of the control means of the other groups. 
   Advantageous further effects of the invention will be seen from the dependent claims and the specification. 
   A control means assigns preferably an active role to itself if its operability state is better than the operability state of a further, redundant control means. On the other hand, a control means determines a passive role for itself if its operability state is worse than the operability of a further, redundant control means. 
   To determine its operability state a control means may compare its own operability state parameter with one or more operability state parameters of one or more redundant control means. The operability state parameter may preferably have values of a predetermined order, whereby e.g. a higher value represents a better ability to perform a respective functionality as a lower value. The control means may compare the values in order to determine whether to play an active role or a passive role. 
   Basically two operability states are sufficient: Fully functional and not operational. It is however preferred to provide more than two operability states: the more different values an operability state parameter may have, the finer is the granularity of assessing the operability state of a control means. 
   In a preferred embodiment of the invention, a unique identifier, for example a so-called tag, is assigned to each of the control means. The unique identifiers are mutually transmitted between the control means. The identifiers may for example be used to identify the mutually transmitted operability state parameters. 
   The identifiers, especially its respective values, may be also used to determine the active and passive roles for the redundant control means: two or more control means may have the same operability state. In such a scenario, when a so-called active-active role conflict or a so-called passive-passive role conflict occurs, the control means having an identifier with e.g. the highest or the lowest value may play the active role, the other control means play a passive role. 
   The communication between the redundant control means may be disturbed, for example due to a broken communication line and/or due to a non-working control means. The control means could be for example partly or totally not operational or currently not existing in the network element, e.g. plugged out. If a control means does not receive the operability state parameter of a redundant “partner” control means, it assumes that the redundant partner control means plays a passive role and assigns consequently an active role to itself. 
   It is preferred, that the redundant control means mutually transmit information about their respective roles. It has however to be noted, that it is also possible that the control means only mutually transmit their operability state parameters. 
   The initial role of the redundant control means at their respective system start is preferably a role “undetermined”. It is however possible, that a control means starts for example with one of the roles passive or active. 
   A suitable embodiment of the invention provides, that the control means transmit their respective operability state parameter and/or their respective unique identifier and/or their respective information about their role via one common message respectively. One single message may however carry only one or two elements of the aforementioned data, e.g., only a state parameter and a unique identifier or, in another scenario, an operability state parameter and information about the role of a sending control means. 
   The aforementioned data, the operability state parameter and/or unique identifier and/or information about the role of a control means, are preferably transmitted at the system start of a control means. Preferably, also in the subsequent “normal” operation said data is periodically transmitted. A currently passive control means can, e.g., due to a periodical transmission detect a malfunction/non-function of a redundant, currently active control means. Another embodiment of the invention provides, that a control means forwards said data when a relevant state changes, for example if its operability state and/or its (active-passive-undetermined) role changes. Combinations of the aforementioned conditions for transmission are possible. 
   A suitable embodiment of the invention provides to use finite state machines (FSM): in connection with the operability states and/or in connection with the roles (active—passive—undetermined). The states of the finite state machines may represent the operability states or the roles of the respective control means respectively. 
   The finite state machine(s) consist of a set of states (preferably including an initial state), a set of input events, a set of output events and a state transition function. The function takes the current state and an input event and returns the new set of output events and the next state. A FSM according to the invention may be a deterministic FSM where the next state is uniquely determined by a single input event. Also a non-deterministic FSM is possible having several next states for a given input event. It has however to be noted that a non-deterministic FSM may be translated, e.g. automatically by means of a computer program, into a deterministic one that will produce the same output given the same input. 
   A control means according to the invention is preferably suited to control a hardware device, is a so-called controller. More preferably two or more controllers together are responsible for at least one common hardware device. For example two controller commonly control one or more modules of a rack. Only one of the controllers actively controls the functions of the rack module(s); the other controller(s) is or are passive. The passive controller(s) may however perform other functionalities in the passive/stand-by mode. 
   The following description will serve to explain the advantages of the invention on the basis of working examples as illustrated in the accompanying drawings. 

   
     BRIEF DESCRIPTION OF THE DRAWINGS 
       FIG. 1  shows a network element NE according to the invention containing controllers CC 1 , CC 2 , LC 1  to LC 5  for the performance of the method in accordance with the invention. 
       FIG. 2  shows a finite state machine FSMS run by the controllers CC 1 , CC 2 , LC 1  to LC 5  and containing states representing the operability states of the aforementioned controllers. 
       FIG. 3  shows a finite state machine FSMR also run by the controllers CC 1 , CC 2 , LC 1  to LC 5 . The states of the finite state machine FSMR represent in contrast to the finite state machine FSMS the respective roles of the aforementioned controllers. 
       FIG. 4  shows a program flow chart of a program module PM run by the controllers CC 1 , CC 2 , LC 1  to LC 5 . 
       FIG. 5  shows in detail, however very diagrammatically, the controller LC 1  and the program module PM according to  FIGS. 1 and 4  respectively. 
       FIG. 6  shows messages M 1 , M 2  sent and received by the controller LC 1  according to  FIGS. 1 and 5 . 
   

   DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS 
   Reference will now be made in detail to the present preferred embodiments of the invention as illustrated in the accompanying drawings. In describing the preferred embodiments and applications of the present invention, specific terminology is employed for the sake of clarity. However, the invention is not intended to be limited to the specific terminology so selected, and it is understood that each specific element includes all technical equivalents that operate in a similar manner to accomplish a similar purpose. 
     FIG. 1  shows a very diagrammatically presented arrangement by way of example, with which the invention may be put into practice. A network element NE contains controllers CC 1 , CC 2 , LC 1  to LC 5 . The network element NE is for example a cross-connect equipment in a synchronous digital hierarchy (SDH) network or any other transmission network. The network element NE might however be a switching center of a switched network, a router of a routed network, e.g. an IP router (IP=Internet Protocol), or any other equipment that has to be high reliable. The network element NE might also be an element of a remote control system. 
   The controllers CC 1 , CC 2 , LC 1  to LC 5  are control means according to the invention. The controllers CC 1 , CC 2  are superordinated controller or central controller controlling and supervising the subordinated controllers LC 1 , LC 2  and LC 3  to LC 5  via connections A 1  to A 5  and B 1  to B 5  respectively. The central controllers CC 1 , CC 2  may control further subordinated controllers (not shown). The central controllers CC 1 , CC 2  are redundant whereby one controller CC 1  or CC 2  controls actively the subordinated controller LC 1  to LC 5 , is consequently playing an active role, whereas the respective other controller CC 1 , CC 2  is in a standby mode playing a passive role. The central controllers CC 1 , CC 2  negotiate their respective active and passive role via a connection VC. The connection VC and the connections A 1  to A 5  and B 1  to B 5  are for example LAN (Local Area Network) connections. The communication on the aforementioned connections may be based on TCP/IP (Transmission Control Protocol/Internet Protocol). 
   The subordinated controller LC 1 , LC 2  are redundant. They are for example so-called shelf controller controlling the hardware equipment H 1  of a shelf SS 1 . The shelf SS 1  may for example represent or contain a switching matrix, a so-called center-stage or a so-called input/output stage, of the network element NE. The controller LC 1 , LC 2  negotiate their active or passive role via a connection CL 1 . The connection CL 1  is for example a PCI-like bus connection (PCI=Peripheral Component Interconnect). 
   In one embodiment of the invention the controller LCI controls via connections C 11 , C 12  hardware components H 11 , H 12 , e.g. switching elements, interface cards or the like, of the hardware equipment H 1  and the controller LC 2  controls via connections C 21 , C 22  hardware components H 21 , H 22  of the hardware equipment H 1 . The components H 11 , H 12  are for example pairwise redundant to the components H 21 , H 22 . When the controller LC 1  is active, it controls actively the components H 11 , H 12 . When the controller LC 2  is active, it controls the components H 21 , H 22  that are in this case also active. 
   In a preferred embodiment of the invention however one of the controllers LC 1 , LC 2  actively controls the hardware equipment H 1  as a whole. The respective other controller LC 1 , LC 2  is passive and does not influence the components H 11 , H 12 , H 21 , H 22 . Even the passive controller LC 1  or LC 2  may however receive data indicating the respective function from the components H 11 , H 12 , H 21 , H 22  in order to quickly change in the active role. 
   The shelf SS 1  may contain more or less components than the components H 11 , H 12 , H 21 , H 22  and more than two controller LC 1 , LC 2 . 
   The controllers LC 1 , LC 2  and the hardware components H 11 , H 12 , H 21 , H 22  are preferably interconnected by a common bus, for example on a back panel of the shelf SS 1 . The connections CL 1 , C 11 , C 12 , C 21 , C 22  are preferably established on that bus, that is for example a PCI-like bus. 
   The subordinated controllers LC 3  to LC 5  control hardware equipment H 2  of a shelf SS 2  via connections C 3  to C 5 . The hardware equipment H 2  contains one or more hardware components, e.g. interface cards, memory arrays or the like. The controller LC 3  to LC 5  are redundant to each other and negotiate their respective active or passive role to control the hardware equipment H 2  via a connection CL 2  that is for example a bus connection. As a result of that negotiation one controller LC 3 , LC 4  or LC 5  is actively controlling the hardware equipment H 2 , whereas the respective other controllers LC 3 , LC 4  or LC 5  play a passive role. 
   Other active, active-standby, passive-standby configurations are possible: for example two active controllers LC 3 , LC 4  may jointly control the hardware equipment H 2  whereas the respective third controller LC 5  is passive. 
   The controllers LC 1  and LC 2  and/or LC 3 , LC 4  or LC 5  might also be suited to control subordinated software, for example program modules run by the hardware equipments H 1  and H 2 . 
   For simplification the controllers CC 1 , CC 2 , LC 1  to LC 5  are of similar design and only diagrammatically depicted as block diagrams of functions. Each controller CC 1 , CC 2 , LC 1  to LC 5  may be an integrated circuit and/or contain a printed circuit board.  FIG. 5  shows, e.g., a block diagram for the controller LC 1  that may also represent the controllers CC 1 , CC 2 , LC 2  to LC 5 . The controller LC 1  possesses connecting means TR for the transmission and reception of data, e.g., via the connections A 1 , B 1 , C 11 , C 12  and CL 1 . The connecting means TR for example may comprise a bus interface, an Ethernet board, a modem or the like. Furthermore the controller LC 1  possesses control means PU (“processing unit”) and memory means MEM that are connected with each other and with the connecting means TR by connections, which are not illustrated. The control means PU are for example processors or processor arrays with which a program code of program modules may be executed, which are stored in memory means MEM, for example program code of a program module PM according to the invention. In order to be executed the program module PM is loaded from the memory means MEM into the control means PU. The memory means MEM are for instance in the form of flash memory modules and/or RAM modules. Furthermore the controller LC 1  may have display means as for example light emitting Diodes (LED), an LCD (liquid crystal display) or the like. Input means, for example a keyboard and/or a computer mouse, may be connected with the controller LC 1 . The controller LC 1  is run by an operating system as for instance a real time operating system (RTOS) or Unix. 
   The program module PM contains in the present embodiment sending means TX and receiving means RX for sending data to and receiving data from the redundant controller LC 2 . The transmission means RX, TX may be also suited to communicate with the superordinated controller CC 1 , CC 2 . The program module PM contains also a determination means DET. The function of the means DET will be described in detail. Furthermore the program module PM contains and/or represents and/or runs finite state machines FSMS and FSMR. The states of the machine FSMS represent the operability states and the states of the machine FSMR represent the role of the controller LC 1  (see  FIGS. 2 and 3 ). The program module PM may be encoded in various programming languages. By carrying out the program code of the program module PM the controller LC 1  performs the steps of a method according to the invention. 
   Basically the controllers CC 1 , CC 2 , LC 2  to LC 5  may be equipped with the program module PM and perform consequently the same or similar steps as described below. 
   The machine FSMS has in the present embodiment for example four different states NHW, NCF, NCA, and FF representing respective operability states of the controller LC 1 . The program module PM detects the respective operability state preferably in cooperation with the operating system and/or other (not shown) program modules and/or means of the controller LC 1 , for example in cooperation with the connecting means TR. 
   The states NHW, NCF, NCA, FF may be interpreted with:
         FF=“fully functional”. This is the best state in which the functionality of the controller is not limited. In this state the controller LC 1  has received configuration data CD from the active one of the controllers CC 1 , CC 2 . Consequently the communication with the active controller CC 1 , CC 2  is not disturbed. Furthermore, the controller LC 1  can access and is able to control the hardware equipment H 1 .   NCA=“no central controller access”. In this state the controller LC 1  is functional for stand-alone operation, i.e. basically able to control the hardware equipment H 1 . The controller LC 1  has already received the configuration data CD. The connections A 1  and/or B 1  with the superordinated controllers CC 1 , CC 2 , at least the connection A 1  or B 1  with the respective active controller CC 1 , CC 2 , is/are however disturbed, e.g. due to a broken LAN cable.   NCF=“not configured”. The controller LC 1  is in this state right after its system start when it has still not received the configuration data CD from the active one of the controllers CC 1 , CC 2 . In the state NCF the controller LC 1  is basically able to access and/or control the hardware equipment H 1 . It might be the case that even if the controller LC 1  has not received the configuration data CD it is able to run the hardware equipment H 1  according to basic configuration data (not shown) that is permanently stored in the memory means MEM.   NHW=“no hardware access”. This is the worst state in which the controller LC 1  has no access to the hardware equipment H 1 .       

   More or less states than the states NHW, NCF, NCA, and FF are possible. For example in addition to the state NCA further states “no access to controller CC 1  ” and “no access to controller CC 2 ” could be defined. 
   The states NHW, NCF, NCA, FF represent the operability states of the controller LC 1  in an ascending order. In the present embodiment the values 1 to 4 are assigned to the states NHW, NCF, NCA, FF. Thus, a higher value of the operability state parameter represents a better ability of the controller LC 1  to perform its functionality. 
   The finite state machine FSMS ( FIG. 2 ) works as follows. The initial state of the controller LC 1  is the state NCF. As the connections to both the hardware equipment H 1  and at least the active one of the controllers CC 1 , CC 2  are usually fully operational, the controller LC 1  receives the configuration data CD, finalizes its system start routines and switches in a transition T 1  to the state FF. 
   If the connections A 1  and/or B 1  to the superordinated controllers CC 1 , CC 2  are lost, the controller LC 1  changes in a transition T 2  to the state NCA. After reestablishing the connections A 1  and/or B 1  the controller LC 1  changes in a transition T 3  to the state FF. 
   If the controller LC 1  looses at least partly the access to the hardware equipment H 1  it changes from each of the states FF, NCA, NCF to the state NHW (transitions T 4 , T 5 , T 6 ). In the opposite direction, the controller LC 1  changes form the state NHW in the best possible state NCF, NCA, FF via transitions T 7 , T 8 , T 9  if the access to the hardware equipment H 1  is recovered. 
   The finite state machine FSMR ( FIG. 3 ) works as follows. The initial role of the machine FSMR is the role UN that is for example “undecided”. Depending on the ability of the controller LC 1  to perform its functionality in comparison with the respective operability of the controller LC 2  the machine FSMR switches to one of the roles AC (=active) or PA (=passive). If the relation of the operability states of the controllers LC 1 , LC 2  changes, the controllers LC 1 , LC 2  also change their respective roles AC or PA. 
   In the present embodiment the controllers LC 1 , LC 2  mutually transmit messages M 1 , M 2 . The controller LC 1  sends for example the message M 1  to the controller LC 2  and receives the message M 2  from the controller LC 2 . The message M 1  contains for example an operability state parameter ST 1  representing the respective operability state of the controller LC 1 , e.g. NHW, NCF, NCA or FF, an information RO 1  about the role of the controller LC 1 , e.g. UN, AC or PA, and an identifier ID 1  uniquely identifying the controller LC 1 . The identifier ID 1  could also be called a tag. The identifier ID 1  may be e.g. derived from a hardware feature of the controller LC 1  such as its hardware address, a unique serial number or the like. 
   The identifier ID 1  is in the present embodiment of the invention used to both to identify the controller LC 1  and to resolve active/active and passive/passive role conflicts between the controllers LC 1 , LC 2  which will be explained later. 
   The message M 2  contains a triple ST 2 , RO 2 , ID 2  representing the operability state, role and identification of the controller LC 2  accordingly. 
   The operability state parameters ST 1 , ST 2  may obtain the values 1 to 4 assigned to the states NHW, NCF, NCA, and FF. The role information RO 1 , RO 2  may have values 1 to 3 assigned to the roles UN, PA, AC. The values of the identifier ID 1 , ID 2  are for example 1 and 2. 
   The messages M 1  and M 2  are for example sent at the system start of the controllers LC 1 , LC 2  and/or if a hardware component of the hardware equipment H 1  is removed or input and/or if the state of the connections A 1 , A 2 , B 1 , B 2  between the controllers LC 1 , LC 2  and the superordinated controllers CC 1  and/or CC 2  changes (e.g. due to communication problems or the like) and/or if the state of the connections C 11 , C 12 , C 21 , C 22  between the controllers LC 1 , LC 2  and the hardware equipment H 1  changes. The controllers LC 1 , LC 2  may also periodically and/or at random times or at any other time condition send the messages M 1  and M 2 . 
   The program flow chart of  FIG. 4  shows a possible flow according to which the program module PM, i.e. the determination means or function DET, changes between the roles UN, PA, AC depending on, inter alia, the operability states NHW, NCF, NCA, FF. 
   The chart of  FIG. 4  represents a possible embodiment of the following rules:
         If a controller is in the role undecided (UN), it changes to the role active (AC) or passive (PA) after it has received at least the operability state parameter, preferably the complete triple comprising the operability state parameter, the role and the identifier, from each other controller. This is done according to the following further rules.   A controller plays an active role (AC) if all controllers have an operability state indicating a lower ability to perform their respective functionality.   A controller changes to the passive role (PA) if any other controller has an operability state indicating a higher ability to perform its functionality.   If two or more controllers are equally able to play the active role (AC), only the one with the highest identifier (tag) value remains active (AC), all other controllers change to the passive role (PA). By this rule active/active role conflicts are resolved.   If no controller is in the active role, the controller with the highest identifier (tag) value becomes active; all other controllers change to or remain in the passive role. This resolves all passive/passive role conflicts and facilitates the initial transition from the role undecided.   A controller does not change its role if there are other controllers with the same operability state level, and there is no active/active or passive/passive conflict.       

   Explanation of the chart of  FIG. 4 : 
   In a start step S 1  the program module PM adopts the role UN. Then it moves (see arrow T 41 ) to a step S 2  in which it waits for a message from a redundant controller. The program modules PM of the controller LC 1 , LC 2  wait for the messages M 2 , M 1  respectively. 
   If the program module PM does not receive the respective message M 1 , M 2  it adopts after a timeout TO the role AC (=step S 3 ) and moves subsequently back (see arrow T 42 ) to the step S 2  waiting aging for a possible message M 1 , M 2  containing a triple ST 1 , RO 1 , ID 1  or ST 2 , RO 2 , ID 2  from the respective redundant controller LC 1 , LC 2 . 
   The time of the timeout TO is preferably longer than the periods between the usual transmission of the messages M 1 , M 2 . 
   The following description refers only to the program module PM of the controller LC 1 . 
   If the preferably secure and reliable communication between the controllers LC 1  and LC 2  is not disturbed and the controller LC 2  works properly, the program module PM receives the message M 2  and moves shown by an arrow T 43  to a step S 4 . 
   In the step S 4  the program module PM compares the operability state of the controller LC 1  with the current operability state of the controller LC 2 . To this end, the program module PM compares the values of the respective operability state parameters ST 1  and ST 2 . In the step S 4  the program module PM asks the question “Is the local operability state better than the operability state of remote (redundant) controller(s)?” or in the present embodiment “Is the local operability state, the operability state of the controller LC 1 , better than the operability state of remote (redundant) controller(s), the operability state of controller LC 2 ?” If the answer is “Yes”, the program module PM moves (shown by an arrow T 44 ) to a step S 5  in which it adopts the active role AC. The program module PM may in step S 4  compare the values of the operability state parameters ST 1 , ST 2 . A higher value represents for example a better operability state of the respective controller LC 1 , LC 2 . After performing step S 5  the program module PM moves back via arrow T 46  to step S 2  and waits again for an operability state information from the controller LC 2 . 
   If however the answer to the question of step S 4  is “No”, in other words, if the operability state of the controller LC 1  is equal to or worse than the operability state of the controller LC 2 , the program module PM moves (shown by an arrow T 47 ) to a step S 6 . In the step S 6  the program module PM asks the question “Is the local operability state worse than the operability state of remote (redundant) controller(s)?” in other words, “Is the operability state of controller LC 1  worse than the operability state of the controller LC 2 ?” If the answer is “yes”, the program module PM moves (shown by an arrow T 48 ) to a step S 7  in which it adopts the passive role PA. From step S 7  the program module PM moves illustrated by an arrow T 49  back to step S 2  and waits for a message from the controller LC 2 . 
   If however the answer to the question of step S 6  is “No”, the operability states of the controllers LC 1 , LC 2  are equal. Then, the program module PM moves (shown by an arrow T 50 ) to a step S 8  in which it adopts either the active role AC or the passive role PA if the current role of the controller LC 1  is still the undetermined role UN. Thus, an initial role transition from undetermined to either active or passive is performed. If the current role prior to step S 8  is already AC or PA, the program module PM does not change the respective role in step S 8 . 
   From step S 8  the program module PM moves (via arrow T 51 ) to a step S 9  in which it checks the respective roles of the controllers LC 1 , LC 2 . To this end, the program module PM may compare the values of the information RO 1  and RO 2 . If the local role of the controller LC 1  is not equal to the remote role of the controller LC 2 , so to speak “local role not equal to remote role”, the respective roles remain unchanged. Consequently, the program module PM loops back via arrow T 52  to step S 2 . 
   If however the roles of the redundant controllers LC 1 , LC 2  are equal (active-active or passive-passive conflict) the program module PM moves (shown by an arrow T 53 ) to a step S 10  in which it evaluates the identifiers or tags ID 1 , ID 2 . If e.g. the value of the (local) identifier ID 1  is higher than the value of the (remote) identifier ID 2 , the program module PM moves (see arrow T 54 ) to a step S 11  in which it adopts the active role AC. Otherwise, the program module PM moves (see arrow T 55 ) to a step S 12  in which it adopts the passive role PA. From steps S 11  and S 12  the program module PM moves back to the step S 2  (see arrows T 56  and T 57  respectively). 
   After determining the respective role AC or PA the program module PM instructs the controller LC 1  to play the respective role. The program module PM instructs, e.g., the connecting means TR to not send commands to the hardware equipment H 1  if the controller LC 1  is in the passive role. 
   The controllers CC 1  and CC 2  as well as the controllers LC 3  to LC 4  may negotiate their respective active or passive role accordingly. Thus, the active-passive role assignment is negotiated on the same hierarchical level respectively. A coordinating aid of a superordinated control means is not needed. In other words, the controllers LC 1 , LC 2  would be able to negotiate their respective active or passive role according to the invention even if there were no superordinated controllers CC 1 , CC 2 . 
   Even if the above explained “software” solution is a preferred embodiment of the invention, a more or less “hardware” oriented embodiment of the invention is also possible. In addition to the program module PM or instead of it the controller LC 1  may for example contain a hardware module HM according to the invention. The module HM provides basically the same functionality as the program module PM, i.e. performs the steps of a method according to the invention. The module HM contains for example means RXH, TXH, DETH, FSMSH and FSMRH that are similar—at least in view of the respective functions—to the means RX, TX, DET, FSMS and FSMR of the program module PM. The module HM may be for example an integrated circuit or “chip” separate from the controller LC 1 . An integrated solution, e.g. a one-chip-solution or a one-printed-circuit-board-solution, are however preferred in which the module HM forms an integral part of the controller LC 1 . The module HM might be for example an ASIC (Application Specific Integrated Circuit). 
   It is however possible to provide a combined hardware-software solution. A modified hardware module HM could for example comprise (hardware) only means RXH, TXH, DETH cooperating with means FSMS and FSMR of a modified program module PM (without means RX, TX, DET).