Safety Tag Transfer During Safety Controller Qualification

An industrial control system, comprising:

• a first safety controller, including:
• a memory configured to store a first set of instructions to perform a control function, a second set of instructions to perform a diagnostic function, a third set of instructions to perform a qualification function, a fourth set of instructions to perform a communication function, and safety data, and
• a processor having a first core operative to execute the control function, a second core operative to selectively execute the diagnostic function and the qualification function, and a third core operative to execute the communication function;
• a second safety controller, including:
• a memory configured to store a first set of instructions to perform a control function, a second set of instructions to perform a diagnostic function, and a third set of instructions to perform a qualification function, a fourth set of instructions to perform a communication function, and safety data, and
• a processor having a first core operative to execute the control function, a second core operative to selectively execute the diagnostic function and the qualification function, and a third core operative to execute the communication function;
• and
• a dedicated communication interface connected between the first safety controller and the second safety controller, wherein:
• the first safety controller is operative to:
• disable the diagnostic function and enable the qualification function on the second core of the processor corresponding to the first safety controller, and
• transmit the safety data from the memory of the first safety controller to the second safety controller via the dedicated communication interface using the qualification function;
• and
• the second safety controller is operative to:
• store the safety data received from the first safety controller in the memory of the second safety controller with the qualification function executing on the second safety controller, and
• disable the qualification function and enable the diagnostic function in the second core of the processor corresponding to the second safety controller to execute the diagnostic function in tandem with the diagnostic function executing in the second core of the processor corresponding to the first safety controller.

A method for transferring data between safety controllers during qualification, the method comprising the steps of:

• establishing a dedicated communication channel between a first communication core executing in a first safety controller and a second communication core executing in a second safety controller;
• preparing safety data for transfer from the first safety controller to the second safety controller;
• transferring parameters for the dedicated communication channel from the first communication core to a first safety core executing in the first safety controller;
• transferring the safety data from the first safety core to a second safety core executing in the second safety controller;
• verifying the safety data received at the second safety controller with the second safety core;
• and
• enabling operation of a safety task in tandem on the first safety core and the second safety core upon successful transfer of the safety data from the first safety controller to the second safety controller.