Method for redundant controller synchronization for bump-less failover during normal and program mismatch conditions

A method for synchronizing redundant controllers in a process control network with one controller operating as a primary controller to perform process control and the other controller operating as a backup controller, wherein each of the redundant controllers has a plurality of control areas each having a process control application program for performing process control functions, wherein each control area includes state information that is used by the process control application program to perform the process control functions, and that is updated when the control area executes to perform process control, and wherein at least two of the control areas execute at different frequencies, the method comprising:

• executing the process control application program of one of the control areas of the primary controller;
• formatting a synchronization message at the primary controller with state information from the executed control area after the process control application program executes;
• transmitting the synchronization message from the primary controller to the backup controller;
• and
• updating the state information of a control area of the backup controller corresponding to the executed control area of the primary controller with the state information from the synchronization message in response to receiving the synchronization message at the backup controller.

A pair of redundant controllers in a process control network, wherein the redundant controllers are communicatively linked to each other and to the other devices of the process control network, each of the redundant controllers comprising:

• a plurality of control areas each having a process control application program for performing process control functions, wherein each control area includes state information that is used by the process control application program to perform the process control functions, and that is updated when the control area executes to perform process control, and wherein the control areas further include output I/O modules that format and transmit process control messages containing process output values used by corresponding controlled field devices to assume operational states determined by the process control application programs of the control areas;
• a control synchronization program;
• and
• wherein one redundant controller operates as a primary controller to perform process control by executing the process control applications of the control areas, and the other redundant controller operates as-a backup controller,
• wherein a controller mismatch condition exists when the redundant controllers are programmed with different configurations of control areas.
• wherein the primary controller transmits a primary controller failure message to the backup controller during a failover condition,
• wherein the backup controller determines whether a controller mismatch condition exists in response to receiving the primary controller failure message from the primary controller,
• wherein the control synchronization program of the backup controller retrieves process output values of the output I/O modules of the control areas of the primary controller in response to determining that a controller mismatch condition exists at the backup controller,
• wherein the backup controller determines state information for the control areas of the backup controller using the retrieved process output values of the output I/O modules of the control areas of the primary controller, and
• wherein the backup controller begins performing process control functions at the backup controller by executing the process control application programs of the control areas of the backup controller after one of determining that a controller mismatch condition does not exist and determining the state information for the control areas after determining that a controller mismatch condition exists.

A method for performing a failover in a pair of redundant controllers in a process control network from one controller functioning as a primary controller to perform process control to the other controller functioning as a backup controller, wherein each of the redundant controllers has a plurality of control areas each having a process control application program for performing process control functions, wherein each control area includes state information that is used by the process control application program to perform the process control functions, and that is updated when the control area executes to perform process control, wherein the control areas further include output I/O modules that format and transmit process control messages containing process output values used by corresponding controlled field devices to assume operational states determined by the process control application programs of the control areas, and wherein a controller mismatch condition exists when the controllers are programmed with different configurations of control areas, the method comprising:

• transmitting a primary controller failure message from the primary controller to the backup controller:
• determining whether a controller mismatch condition exists in response to receiving the primary controller failure message at the backup controller;
• retrieving process output values of the output I/O modules of the control areas of the primary controller in response to determining that a controller mismatch condition exists;
• determining at the backup controller state information for the control areas of the backup controller using the retrieved process output values of the output I/O modules of the control areas of the primary controller;
• and
• begin performing process control functions at the backup controller by executing the process control application programs of the control areas of the backup controller.

A pair of redundant controllers in a process control network, wherein the redundant controllers are communicatively linked to each other and to the other devices of the process control network, each of the redundant controllers comprising:

• a plurality of control areas each having a process control application program for performing process control functions, wherein each control area includes state information that is used by the process control application program to perform the process control functions, and that is updated when the control area executes to perform process control;
• and
• a control synchronization program,
• wherein one redundant controller operates as a primary controller to perform process control by executing the process control applications of the control areas, and the other redundant controller operates as a backup controller,
• wherein the control synchronization program of the primary controller causes:
• the primary controller to transmit a synchronization message to the backup controller after the process control application program of a control area executes to perform process control, the synchronization message containing state information from the control area,
• wherein the control synchronization program of the backup controller receives the synchronization message and the backup controller updates the state information of a control area of the backup controller corresponding to the executed control area of the primary controller with the state information from the synchronization message in response to receiving the synchronization message at the backup controller,
• wherein the control synchronization program of the primary controller formats and causes the primary controller to transmit a token message including configuration information for the control areas of the primary controller,
• wherein the control synchronization program of the primary controller receives the token message and stores the configuration information from the token message at the backup controller,
• wherein, when the backup controller is powered up, the control synchronization program of the backup controller determines whether the backup controller has received synchronization messages containing values for all of the configuration information of the primary controller identified in the token message as synchronization messages are received at the backup controllers, and
• wherein the backup controller transmits a backup ready message to the primary controller in response to determining that the backup controller received synchronization messages containing values for all of the configuration information of the primary controller identified in the token message.

A method for initializing a backup controller of a pair of redundant controllers in a process control network wherein one controller of the pair functions as a primary controller to perform process control and the other controller functions as a backup controller, wherein each of the redundant controllers has a plurality of control areas each having a process control application program for performing process control functions, wherein each control area includes state information that is used by the process control application program to perform the process control functions, and that is updated when the control area executes to perform process control, wherein the primary controller transmits token messages including configuration information for the control areas of the primary controller, and wherein the primary controller formats and transmits a synchronization message with state information from an executed control area after the process control application program of the control area executes to perform process control, the method comprising:

• powering up the backup controller;
• receiving a token message from the primary controller at the backup controller;
• storing the configuration information from the token message at the backup controller;
• receiving synchronization messages transmitted by the primary controller at the backup controller;
• updating the state information of the control areas of the backup controller corresponding to the executed control areas of the primary controller with the state information from the synchronization messages in response to receiving the synchronization messages at the backup controller;
• determining whether the backup controller has received synchronization messages containing values for all of the configuration information of the primary controller identified in the token message;
• and
• transmitting a backup ready message from the backup controller to the primary controller in response to determining that the backup controller received synchronization messages containing values for all of the configuration information of the primary controller identified in the token message.