# US 9,929,944 B2 · Redundancy device unit and method for determining fault in industrial control system, industrial control system and industrial system comprising redundancy device unit > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,929,944 B2 - Document ID: US9929944B2 - Status: Granted - Kind: B2 - Application number: 14/437,858 - Filed: 2012-11-07 - Published: 2015-10-15 - Granted: 2018-03-27 - Earliest claimed: 2012-11-07 - Assignees: ABB Schweiz AG - Applicants: ABB Schweiz AG - Inventors: Ye Xu; Axel Lohbeck; Dieter Henkel - Web page: https://patentgrep.com/patent/US9929944B2 ## CPC - H04L 45/28: using route fault recovery - G05B 19/0423: {Input/output} - G05B 19/4184: {characterised by fault tolerance, reliability of production system} - G05B 23/0237: {based on parallel systems, e.g. comparing signals produced at the same time by same type systems and detect faulty ones by noticing differences among their responses} - G06F 11/0736: {in functional embedded systems, i.e. in a data processing system designed as a combination of hardware and software dedicated to performing a certain function (testing or monitoring of automated control systems G05B23/02)} - G06F 11/079: {Root cause analysis, i.e. error or fault diagnosis (in a hardware test environment G06F11/22; in a software test environment G06F11/36)} - G06F 11/2007: {using redundant communication media} - G06F 11/221: {to test buses, lines or interfaces, e.g. stuck-at or open line faults} - H04L 12/6418: {Hybrid transport} - G05B 2219/33315: Failure detection and reconfiguration - G05B 2219/34449: Fault tolerant control, task from one microprocessor can be done by other - G05B 2219/34477: Fault prediction, analyzing signal trends - G06F 11/2017: {where memory access, memory control or I/O control functionality is redundant (redundant communication control functionality G06F11/2005; redundant storage control functionality G06F11/2089)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G05B: CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS (systems for controlling or regulating non-electric variables G05D; systems for regulating electric or magnetic variables G05F; control devices or systems insofar as characterised by mechanical features only G05G) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A redundant device unit includes a first device connected with a field device via a first link and a second link in series. The first device, initially active in use, when active sends diagnostic information indicating whether there is a fault in the first link and/or the second link. A second device connected with the field device via the second link and a third link in series, initially passive in use, receives the first diagnostic information from the first device. When the first diagnostic information indicates that there is a fault in the first link and/or the second link, the first device switches to passive and the second device switches to active and generates second diagnostic information indicating whether there is a fault in the second link and/or the third link. A determination regarding the fault is made based on the first and second diagnostic information. ## Claims ### Claim 1 A redundant device unit for determining a fault of an industrial control system, comprises: a first device configured to be connected with a field device via a first link and a second link in series, the first device being configured to be initially active in use and send first diagnostic information indicating when the first device is active, whether there is a fault in the first link and/or the second link; and a second device configured to be connected with the field device via the second link and a third link in series, the second device being configured to be initially passive in use and receive the first diagnostic information from the first device wherein the first diagnostic information is routed through the first link and the third link; wherein, when the first diagnostic information indicates that there is a fault in the first link and/or the second link, the first device is switched into passive and the second device is switched into active and generates second diagnostic information indicating, when the second device is active, whether there is a fault in the second link and/or the third link, and a determination regarding the fault of the industrial control system is made based on the first and second diagnostic information. ### Claim 2 (depends on 1) The redundant device unit according to claim 1, wherein when the second diagnostic information indicates that there is a fault in the second link and/or the third link, it is regarded as there is a fault in the second link. ### Claim 3 (depends on 1) The redundant device unit according to claim 1, wherein when the second diagnostic information indicates that there is no fault in the second link and the third link it is determined that there is a fault in the first link. ### Claim 4 (depends on 1) The redundant device unit according to claim 1, wherein the second device is further configured to send the second diagnostic information when the fault in the second link is fixed, and the first device is further configured to receive the second diagnostic information and update the first diagnostic information according to the received second diagnostic information. ### Claim 5 (depends on 3) The redundant device according to claim 3, wherein the first diagnostic information further comprises information indicating whether the first device is active or passive, and the second diagnostic information further comprises information indicating whether the second device is active or passive. ### Claim 6 (depends on 5) The redundant device unit according to claim 5, wherein the first device is further configured to determine whether the second device is ready to take over the operation of the first device before the first device is switched into passive and the second device is switched into passive, and the first device is switched into passive and the second device is switched into passive if the second device is determined as ready to take over the operation of the first device. ### Claim 7 (depends on 1) The redundant device unit according to claim 1, wherein each of the first device and the second device is provided with a serial communication interface, and the first device sends the first diagnostic information through the serial communication interface of the first device and the second device receives the first diagnostic information through the serial communication interface of the second device. ### Claim 8 (depends on 7) The redundant device unit according to claim 7, wherein the fault in the first link comprises a fault in a field circuit and/or a fault in a data bus cable, and the fault in the second link comprises a fault of the field cable. ### Claim 9 (depends on 8) The redundant device unit according to claim 8, wherein one or more of the first link, second link and the third link are cables. ### Claim 10 (depends on 9) The redundant device unit according to claim 9, wherein the first device and the second device are input/output modules. ### Claim 11 A method for determining a fault of an industrial control system, wherein the industrial control system comprises a first device connected with a field device via a first link and a second link in series and a second device connected with the field device via the second link and a third link in series, the first device is configured to be initially active in use, and the second device is configured to be initially passive in use, the method comprising steps of: the second device obtaining from the first device first diagnostic information indicating, when the first device is active, whether there is a fault in the first link and/or the second link; when the first diagnostic information indicating that there is a fault in the first link and/or the second link, switching the first device into passive and switching the second device into active; obtaining from the second device second diagnostic information indicating, when the second device is active, whether there is a fault in the second link and/or the third link; when the second diagnostic information indicates that there is no fault in the second link and/or the third link, determining that there is a fault in the first link; and when the second diagnostic information indicates that there is a fault in the second link and/or the third link, determining that there is a fault in the second link. ### Claim 12 (depends on 11) The method according to claim 11, wherein the method further comprises: determining whether the second device is ready to take over the operation of the first device before switching the first device into passive and switching the second device into active; and if the second device is determined as ready to take over the operation of the first device, switching the first device into passive and switching the second device into active. ### Claim 13 (depends on 1) An industrial control system for determining a fault therein, wherein the Industrial control system comprises at least one redundant device unit according to claim 1. ### Claim 14 (depends on 13) The industrial control system according to claim 13, wherein, the industrial control system is a process control system, the first device and the second device are used for collecting data from the field device or controlling the field device. ### Claim 15 (depends on 13) An industry system for determining a fault therein, comprising an industrial Control system according to claim 13 and the field device. ### Claim 16 (depends on 2) The redundant device unit according to claim 2, wherein when the second diagnostic information indicates that there is no fault in the second link and the third link, it is determined that there is a fault in the first link. ### Claim 17 (depends on 2) The redundant device unit according to claim 2, wherein the second device is further configured to send the second diagnostic information when the fault in the second link is fixed, and the first device is further configured to receive the second diagnostic information and update the first diagnostic information according to the received second diagnostic information. ### Claim 18 (depends on 4) The redundant device unit according to claim 4, wherein the first diagnostic information further comprises information indicating whether the first device is active or passive, and the second diagnostic information further comprises information indicating whether the second device is active or passive. ### Claim 19 (depends on 6) The redundant device unit according to claim 6, wherein each of the first device and the second device is provided with a serial communication interface, and the first device sends the first diagnostic information through the serial communication interface of the first device and the second device receives the first diagnostic information through the serial communication interface of the second device. ### Claim 20 A method for determining a fault of an industrial control system, the method comprising steps of: a second device obtaining from a first device, when active, first diagnostic information indicating whether there is a fault in a first link and/or a second link; when the first diagnostic information indicates that there is a fault in the first link and/or the second link, switching the first device into passive and switching the second device into active; obtaining from the second device, when active, second diagnostic information indicating whether there is a fault in the second link and/or a third link; when the second diagnostic information indicates that there is no fault in the second link and/or the third link, determining that there is a fault in the first link; when the second diagnostic information indicates that there is a fault in the second link and/or the third link, determining that there is a fault in the second link; and wherein the industrial control system comprises the first device connected with a field device via the first link and the second link in series and the second device connected with the field device via the second link and the third link in series, the first device is configured to be initially active in use, and the second device is configured to be initially passive in use.