Control Unit and Method For Operating An Industrial Automation System Communication Network Comprising A Plurality Of Communication Devices

A method for operating an industrial automation system communication network comprising a plurality of communication devices, the method comprising:

• controlling, by a plurality of control units redundant with respect to each other, functions of a plurality of associated communication devices, mutually redundant control units of the plurality of control units comprising identically configured state machines, which in an error-free state generate identical output variables from identical input variables, the plurality of associated communication devices being assigned to a Software Defined Network comprising a communication control plane designated as a Control Plane and a data transmission plane designated as a Data Plane, and the plurality of control units being assigned to the Control Plane and the plurality of associated communication devices being assigned to the Data Plan;
• determining, by each control unit of the plurality of control units, for user-side communication service requests, a path between a first communication device at a first end node and a second communication device at a second end node via third communication devices which comprise at least one of (i) routers and (ii) switches, the plurality of control units specifying flow tables, from which at least one of (i) routing tables and (ii) forwarding tables are derived for third communication devices respectively assigned to the plurality of control units;
• determining, by the plurality of control units, whether necessary system resources are available along the determined paths during a scheduled usage period;
• reserving, by the plurality of control units, system resources necessary for the communication service requests in an event of each positive verification result and controlling routing or switching functions of the third-party communication devices in accordance with determined paths;
• transferring, by the plurality of associated communication devices, communication-specific input variables to all mutually associated redundant control units of the plurality of control units;
• checking the output variables generated by the mutually redundant control units for deviations from each other;
• and
• performing a switchover to reserve control units in an event of deviations or deactivating control units of the plurality of control units having output variables which deviate with respect to a majority of mutually redundant control units of the plurality of control units in an event the deviations.

A control unit comprising:

• a processor;
• and
• memory;
• wherein the control unit is configured to:
• control functions of a plurality of assigned communication devices jointly with at least one redundant control unit, mutually redundant control units comprising identically configured state machines which are configured to generate, in an error-free state, identical output variables given identical input variables, the plurality of assigned communication devices being assigned to a Software Defined Network comprising one communication control plane designated as a Control Plane and one data transmission plane designated as a Data Plane, and the mutually redundant control units being assigned to the Control Plane and the communication devices being assigned to the Data Plane;
• determine for user-side communication service requests in each case a path between a first communication device at a first end node and a second communication device at a second end node via third communication devices comprising at least one of (i) routers and (ii) switches, and the mutually redundant control units specifying flow tables, from which at least one of (i) routing tables and (ii) forwarding tables for third communication devices respectively assigned to the control units are derivable;
• verify whether necessary system resources are available along the determined paths during a scheduled usage period;
• reserve system resources necessary for each communication service requests in an event of a positive verification result and control routing or switching functions of the third communication devices in accordance with the determined paths;
• receive at least one of (i) measurements and (ii) event messages from assigned communication devices as input variables;
• check their own output variables and the output variables of the redundant control unit for deviations relative to each other;
• switch over to reserve control units or deactivate control units having output variables that deviate with respect to a majority of mutually redundant control units in the event of deviations.