Protection of industrial equipment from network storms emanating from a network system

1. A method for protecting a networked industrial controller from network storms, the networked industrial controller has a real-time operating system and communication components performing communication exchanges with connected networks, the method comprising steps of:

(a) Initializing a watchdog thread monitor thread within the real-time operating system's kernel to have the watchdog thread monitor thread a kernel level priority;

(b) configuring a watchdog thread to periodically (every T Alive time) send an alive event signal to the watchdog thread monitor thread if all other threads of application programs are operating normally;

(c) starting the watchdog thread monitor thread waiting for receiving the alive event signal within a timeout period T AliveTout (T AliveTout is longer than T Alive );

(d) identifying a network storm in response to the alive event signal; and

(e) controlling the communication exchanges in response to the alive event signal and current phase of the watchdog thread monitor thread;

wherein the watchdog thread monitor thread has four different phases:

(i) Normal; indicating that the networked industrial controller is communicating with the connected networks normally;

(ii) Disabling Communication Exchanges; indicating that the networked industrial controller is in the process of disabling communication exchanges with the connected network;

(iii) Communication Exchanges Disabled; indicating that the communication exchanges from the networked industrial controller have been disabled and no data is exchanged with the connected networks;

(iv) Re-enabling Communication Exchanges; indicating that the networked industrial controller is in the process of enabling communication exchanges with the connected networks.

2. The method of claim 1 , wherein the steps (d) and (e) for identifying a network storm and controlling the communication exchanges further comprising:

(d1) if no alive event signal is received during the timeout period T AliveTout and the current watchdog thread monitor thread phase is either “Normal” or “Re-enabling Communication Exchanges”, then

(e1) disabling the communication exchanges and changing the watchdog thread monitor thread phase to “Disabling Communication Exchanges”; and

(e2) returning to step (c).

3. The method of claim 1 , wherein the steps (d) and (e) for identifying a network storm and controlling the communication exchanges further comprising:

(d1) if no alive event signal is received during the timeout period T AliveTout and the current watchdog thread monitor thread phase is neither “Normal” nor “Re-enabling Communication Exchanges”, then

(e1) returning to step (c).

4. The method of claim 1 , wherein the steps (d) and (e) for identifying a network storm and controlling communication exchanges further comprising:

(d1) if the alive event signal is received during the timeout period T AliveTout and the current watchdog thread monitor thread phase is “Disabling Communication Exchanges”, then

(e1) changing the watchdog thread monitor thread phase to “Communication Exchanges Disabled” and displaying “Network Overload”; and

(e2) returning to step (c).

5. The method of claim 1 , wherein the steps (d) and (e) for identifying a network storm and controlling the communication exchanges further comprising:

(d1) if the alive event signal is received during the timeout period T AliveTout and the current watchdog thread monitor thread phase is “Communication Exchanges Disabled” and the communication exchanges have been disabled for a period of time T Re-enable (T Re-enable is longer than T AliveTout ), then

(e1) re-enabling the communication exchanges and changing the watchdog thread monitor thread phase to “Re-enabling Communication Exchanges”; and

(e2) returning to step (c).

6. The method of claim 1 , wherein the steps (d) and (e) for identifying a network storm and controlling the communication exchanges further comprising:

(d1) if the alive event signal is received during the timeout period T AliveTout and the current watchdog thread monitor thread phase is “Communication Exchanges Disabled” and the communication exchanges have not been disabled for a period of time T Re-enable (T Re-enable is longer than T AliveTout ), then

(e1) returning to step (c).

7. The method of claim 1 , wherein the steps (d) and (e) for identifying a network storm and controlling the communication exchanges further comprising:

(d1) if the alive event signal is received during the timeout period T AliveTout and the current watchdog thread monitor thread phase is “Re-enabling Communication Exchanges”, then

(e1) changing the watchdog thread monitor thread phase to “Normal” and displaying “Network Overload Cleared”; and

(e2) returning to step (c).

8. The method of claim 1 , further comprising step (f) repeating steps (c), (d) and (e).

9. The method of claim 1 , wherein the networked industrial controller is using Windows CE as an operating system, the connected networks are using TCP/IP as communication protocol and communication exchanges are Ethernet communication exchanges.

10. The method of claim 5 wherein T Alive is in the range of 200 milliseconds to 1 second.

11. The method of claim 5 wherein T Alive is 500 milliseconds.

12. The method of claim 1 wherein T AliveTout is longer than T Alive and is in the range of 1 second to 30 seconds.

13. The method of claim 1 wherein T AliveTout is 1.2 seconds.

14. The method of claim 1 wherein T Re-enable is longer than T AliveTout and is equal and greater than 2 seconds.

15. The method of claim 1 wherein T Re-enable is 20 seconds.

16. A computer-readable memory medium comprising program instructions to protect a networked industrial controller from network storms, the networked industrial controller has a real-time operating system and communication components performing communication exchanges with connected networks, wherein the program instructions are executable to:

(a) Initializing a watchdog thread monitor thread within the real-time operating system's kernel to have the watchdog thread monitor thread a kernel level priority;

(b) configuring a watchdog thread to periodically (every T Alive time) send an alive event signal to the watchdog thread monitor thread if all other threads of application programs are operating normally;

(c) start the watchdog thread monitor thread waiting for receiving the alive event signal within a timeout period T AliveTout (T AliveTout is longer than T Alive );

(d) identify a network storm in response to the alive event signal; and

(e) control the communication exchanges in response to the alive event signal and current phase of the watchdog thread monitor thread;

wherein the watchdog thread monitor thread has four different phases:

(i) Normal; indicating that the networked industrial controller is communicating with the connected networks normally;

(ii) Disabling Communication Exchanges; indicating that the networked industrial controller is in the process of disabling communication exchanges with the connected network;

(iii) Communication Exchanges Disabled; indicating that the communication exchanges from the networked industrial controller have been disabled and no data is exchanged with the connected network;

(iv) Re-enabling Communication Exchanges; indicating that the networked industrial controller is in the process of enabling communication exchanges with the connected network.

17. The memory medium of claim 16 , wherein the steps (d) and (e) for identifying a network storm and controlling the communication exchanges further comprising:

(d1) if no alive event signal is received during the timeout period T AliveTout and the current watchdog thread monitor thread phase is either “Normal” or “Re-enabling Communication Exchanges”, then

(e1) disabling the communication exchanges and changing the watchdog thread monitor thread phase to “Disabling Communication Exchanges”; and

(e2) returning to step (c).

18. The memory medium of claim 16 , wherein the steps (d) and (e) for identifying a network storm and controlling the communication exchanges further comprising:

(d1) if no alive event signal is received during the timeout period T AliveTout and the current watchdog thread monitor thread phase is neither “Normal” nor “Re-enabling Receives”, then

(e1) returning to step (c).

19. The memory medium of claim 16 , wherein the steps (d) and (e) for identifying a network storm and controlling the communication exchanges further comprising:

(d1) if the alive event signal is received during the timeout period T AliveTout and the current watchdog thread monitor thread phase is “Disabling Communication Exchanges”, then a network storm is identified;

(e1) changing the watchdog thread monitor thread phase to “Communication Exchanges Disabled” and displaying “Network Overload”; and

(e2) returning to step (c).

20. The memory medium of claim 16 , wherein the steps (d) and (e) for identifying a network storm and controlling the communication exchanges further comprising:

(d1) if the alive event signal is received during the timeout period T AliveTout and the current watchdog thread monitor thread phase is “Communication Exchanges Disabled” and the communication exchanges has been disabled for a period of time T Re-enable (T Re-enable is longer than T AliveTout ), then

(e1) re-enabling the communication exchanges and changing the watchdog thread monitor thread phase to “Re-enabling Communication Exchanges” and

(e2) returning to step (c).

21. The memory medium of claim 16 , wherein the steps (d) and (e) for identifying a network storm and controlling the communication exchanges further comprising:

(d1) if the alive event signal is received during the timeout period T AliveTout and the current watchdog thread monitor thread phase is “Communication Exchanges Disabled” and the communication exchanges have not been disabled for a period of time T Re-enable (T Re-enable is longer than T AliveTout ), then

(e1) returning to step (c).

22. The memory medium of claim 16 , wherein the steps (d) and (e) for identifying a network storm and controlling the communication exchanges further comprising:

(d1) if the alive event signal is received during the timeout period T AliveTout and the current watchdog thread monitor thread phase is “Re-enabling Communication Exchanges”, then

(e1) changing the watchdog thread monitor thread phase to “Normal” and displaying “Network Overload Cleared”; and

(e2) returning to step (c).

23. The memory medium of claim 16 further comprising step (f) repeating steps (c), (d) and (e).