Fault tolerant industrial automation control system
View Patent ↗A combination of a component-based automation framework, software-based redundancy patterns, and a distributed, reliable runtime manager, is able to detect host failures and to trigger a reconfiguration of the system at runtime. This combined solution maintains system operation in case a fault occurs and, in addition, automatically restores fault tolerance by using backup contingency plans, and without the need for operator intervention or immediate hardware replacement. A fault-tolerant fault tolerance mechanism is thus provided, which restores the original level of fault tolerance after a failure has occurred—automatically and immediately, i.e., without having to wait for a repair or replacement of the faulty entity. In short, the invention delivers increased availability or uptime of a system at reduced costs and complexity for an operator or engineer by adapting automatically to a new environment.
1. A method of providing fault tolerance in an Industrial Automation and Control System IACS including a plurality of hosts connected to a communication bus, wherein each host executes cyclically a number of components according to a configuration, comprising the steps of:
executing an active instance of a critical component on a first host and synchronizing a first standby instance of the critical component instantiated on a second host with the active instance;
detecting a failure of the first host;
activating a first backup configuration including executing the first standby instance as the now active instance of the critical component on the second host, and including synchronizing therewith a second standby instance of the critical component instantiated on a third host;
providing first backup configurations to each host;
detecting a failure of the first host by all further hosts; and
activating, at all further hosts, a first backup configuration corresponding to the failure of the first host.
2. The method of claim 1 , comprising
providing a second backup configuration including assigning a third standby instance of the critical component to a fourth host.
3. A computer program product including computer program code for controlling one or more processors of an Industrial Automation Control System IACS including a plurality of execution hosts connected to a communication bus, wherein each host executes cyclically a number of components according to a configuration, the program comprising the steps of:
executing an active instance of a critical component on a first host and synchronizing a first standby instance of the critical component instantiated on a second host with the active instance;
detecting a failure of the first host;
activating a first backup configuration including executing the first standby instance as the now active instance of the critical component on the second host, and including synchronizing therewith a second standby instance of the critical component instantiated on a third host;
providing first backup configurations to each host;
detecting a failure of the first host by all further hosts; and
activating, at all further hosts, a first backup configuration corresponding to the failure of the first host.
4. An Industrial Automation System having one or more processors and a computer program product including computer program code for controlling the one or more processors to perform the following process steps: executing an active instance of a critical component on a first host and synchronizing a first standby instance of the critical component instantiated on a second host with the active instance; detecting a failure of the first host; activating a first backup configuration including executing the first standby instance as the now active instance of the critical component on the second host, and including synchronizing therewith a second standby instance of the critical component instantiated on a third host; providing first backup configurations to each host; detecting a failure of the first host by all further hosts; and activating, at all further hosts, a first backup configuration corresponding to the failure of the first host.