US 7,043,728 B1Granted

Methods and apparatus for fault-detecting and fault-tolerant process control

AssigneeInvensys Systems, Inc.

InventorSamuel Galpin

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method of process, industrial, environmental or other control includes executing a first sequence of instructions in a first process (or thread) and executing a second sequence of instructions in a second process (or thread) that is loosely coupled with the first. States of the first and second processes are compared following their respective completions of the first and second instruction sequences. The comparison can cover registers, memory, flags, interrupts, tasks, and/or events in each of the respective processes. Execution of further instruction sequences by either process is delayed pending a favorable comparison of the process states. If the process achieve comparable states, the first process can take up execution of a third sequence, while the second process takes up execution of a fourth sequence. In the event that one of the processes does not complete its respective instruction sequence within a set period of time, or if the process states do not otherwise favorably compare after execution of the respective sequences, the method calls for signaling an error. A device for process, industrial, environmental or other control operates in accord with such a method.

Claims14

Dependent claims

A computerized method of operation of a control system, comprising

A. with a first scheduler associated with a first process selecting a highest priority event associated with the first process, where the first process is any of a first computer process and a first computer thread,
B. with a second scheduler associated with a second process the second process being loosely coupled with respect to the first process, selecting a highest priority event associated with the second process, where the second process is any of a second computer process and a second computer thread,
C. with each of the first scheduler and the second scheduler, comparing for identity of the highest priority event selected by the first scheduler with the highest priority event selected by the second scheduler,
D. with the first scheduler, responding to an agreement of identity indicated in step (C) by selecting a first sequence of instructions in the first process,
E. with the second scheduler, responding to an agreement of identity indicated in step (C) by selecting a second sequence of instructions in the second process,
F. with each of the first and second schedulers, comparing for identity of the selection made by the first scheduler with the selection made by the second scheduler,
G. with the first scheduler, responding to an agreement of identity indicated in step (F) by executing, in the first process, the first sequence of instructions,
H. with the second scheduler, responding to an agreement of identity indicated in step (F) by executing, in the second process, the second sequence of instructions,
I. responding to a non-agreement of identity occurring more than a selected number of times in any of steps (C) and (F) by rolling back each of the first and second processes to prior states in which an agreement of identity indicating the first process and the second process executed their respective instruction sequences substantially identically was achieved, and
J. wherein each of the first and second processes execute on any of a process control field device, a block controller, a process controller, a process control plant server, a process control enterprise server, an industrial control device, an industrial control system, an environmental control device, an environmental control system, other control device, and other control system.

7 more elements

A control apparatus comprising one of more digital data processors capable of executing any of a process or a thread, comprising

A. a first scheduler associated with a first process the first scheduler configured to select a highest priority event associated with the first process, where the first process is any of a first computer process and a first computer thread,
B. a second scheduler associated with a second process the second scheduler configured to select a highest priority event associated with the second process, where the second process is any of a second computer process and a second computer thread,
C. each of the first scheduler and the second scheduler further configured to compare for identity of the highest priority event selected by the first scheduler with the highest priority event selected by the second scheduler,
D. the first scheduler further configured to respond to an agreement of identity indicated in step (C) by selecting a first sequence of instructions in the first process,
E. the second scheduler further configured to respond to an agreement of identity indicated in step (C) by selecting a second sequence of instructions in the second process,
F. each of the first scheduler and the second scheduler further configured to compare for identity of the selection made by the first scheduler with the selection made by the second scheduler,
G. the first scheduler further configured to respond to an agreement of identity indicated in step (F) by executing, in the first process, the first sequence of instructions,
H. the second scheduler further configured to respond to an agreement of identity indicated in step (F), by executing, in the second process, the second sequence of instructions,
I. each of the first scheduler and the second scheduler further configured to respond to a non-agreement of identity occurring more than a selected number of times in any of steps (C) and (F) by rolling back each of the first and second processes to prior states in which an agreement of identity indicating the first process and the second process executed their respective instruction sequences substantially identically was achieved, and
J. wherein each of the first and second processes execute on any of a process control field device, a block controller, a process controller, a process control plant server, and a process control enterprise server, industrial control device, an industrial control system, an environmental control device, an environmental control system, other control device, and other control system.

7 more elements

Dependencies are inferred from the claim text.