Safe Failover Between Redundant Controllers

Abstract

A control device is used with at least one further control device in controlling an industrial system to which the control device and further control device are connected via a data network. The control device functions as primary controller when it feeds control signals to the industrial system, and functions function as a backup controller when it routinely performs a failure detection on the primary controller via the data network, and transforms into the primary controller in reaction to a positive failure detection. The backup controller transforms into the primary controller only when a network reference point, NRP, responds to a call from the backup controller, wherein the NRP is a node in the data network which connects the primary controller and backup controller to the industrial system. A malfunctioning NRP can be replaced at runtime.

Dependencies are inferred from the claim text.