Patent Grant
11550270
The present invention relates to a method for creating a redundant automation system and a computer program, a computer-readable medium, where the redundant automation system comprises at least one automation installation to be controlled, which is installed at an installation location with associated peripheral units and two control applications, which are communicatively coupled to one another via a synchronization path, configured to control the automation installation and which are communicatively connected to the automation installation, where one of the control applications operates as the master and the other control application operates as a reserve, such that in the event of the application operating as the master control fails, the control application operating as a reserve takes over and functions as the master. The present invention further relates to
In automation environments, there is an increasing requirement for high availability solutions suitable for reducing any stoppage periods of an automation installation to a minimum. Against this background, redundant automation systems of are currently know, which are characterized by the fact that two mutually synchronizing control applications are connected to the peripheral units of the automation installation such that, in the event of a failure, the function of the control application operating as the master can be taken over at any time by the control application working as a reserve. With respect to the frequency of the synchronization and the scope thereof, a distinction can be made between various manifestations, particularly warm standby and hot standby.
Recently, the possibility of outsourcing control applications to a cloud has been increasingly discussed. A cloud is in particular an infrastructure that is, for example, made available via the internet and which, as a rule, provides storage space, computing power and/or application software without requiring corresponding infrastructures to be installed and stored on a local computer. With a cloud, as a rule, the hardware is not operated or provided by the actual user of an application. A cloud or cloud computing can be particularly understood to mean the provision of IT infrastructure as a service, possibly from a remote location. A cloud can be reached via the internet or also operated by a company as a “private cloud” with which the IT infrastructure can be reached via a network, such as a company intranet.
When outsourcing control applications to a cloud, it should be noted that annual failure times of several hours are to be expected with all large cloud providers. A consideration on a monthly basis even shows that a mean time to failure (MTTF) of less than one month is to be expected, where the failures entail a few minutes to a few hours of downtime. For example, an analysis of the failures of various cloud providers in March 2019 revealed an average downtime of approximately 17 minutes within the 30 day period, where the two cloud providers with the longest failure times were not taken into account. Therefore, the users of cloud-based services must assume their applications will be unavailable for a few minutes each month. In the case of a control application, this unavoidably results in a stoppage of the automation installation, which will probably be unacceptable to the operator of the installation. In this context, it should be noted that present-day programmable logic controllers have an average lifetime of 10 years and more depending upon the type.
As a result, the availability achievable at present or the achievable MTTF of cloud services seems to be adequate for current applications, such as webservers or databases. An attempt is frequently made to increase availability for these applications using cold or warm standby systems, which are started in the event of a failure. However, the availability of such conventional system considered inadequate for applications in automation technology because the status of the control applications, and hence of the automation process, must be maintained in the event of a failure. This can only be achieved by using “hot stand-by” systems.
In view of the foregoing, it is therefore an object of the present invention to provide an alternative redundant automation system and a method for creating the redundant automation system that over comes the problems found in convention automation systems.
This and other objects and advantages are achieved in accordance with the invention by a redundant automation system comprising at least one automation installation to be controlled, which is installed at an installation location and two control applications, which are communicatively coupled to one another via a synchronization path, configured to control the automation installation, form part of a cloud-computing structure of which the computing resources are provided at different locations and which are communicatively connected to the automation installation via the internet or via a comparable computer network, and which has a plurality of communication hubs and communication paths connecting these to one another, where one of the control applications operates as the master and the other control application operates as a reserve, such that in the event that the control application operating as the master fails, the control application operates as a reserve takes over and functions as the master and where the locations of the computing resources for the control applications are selected such that the control applications are connected to the automation installation via two different communication paths that preferably have no or a minimal number of common communication hubs. Therefore, in accordance with the invention, the control applications are outsourced to a cloud. Herein, to improve the mean time to failure (MTTF), the control applications are communicatively connected to the automation installation or to the peripheral units thereof via separate communication paths of the internet or the comparable computer network. Herein, it is ensured that the communication paths have no or, if this is not possible due the installation location and/or locations of the computing resources for the control applications in relation to the topology of the internet or the comparable computer network, a minimal number of common communication hubs. This is advantageous because, if the communication path between the control application working as the master and the automation installation were to fail, reliable function of the communication path between the control application operating as the reserve and the automation installation is ensured and the control application operating as the reserve can take over and function as the master. This results in an improvement of the MTTF of the control applications to a value suitable for automation technology.
In according with one embodiment of the present invention, the synchronization path connecting the control applications to one another is a communication path of the internet or the comparable computer network, where the synchronization path and the two communication paths connecting the control applications to the automation installation have no or a minimal number of common communication hubs. This also results in an improvement of the MTTF of the control applications.
The computing resources for the control applications are preferably computing centers, i.e., buildings or premises that accommodate the central computing technology of one or even more companies. The advantage consists in the fact that it is possible to access existing resources.
Advantageously, the computing resources for the control applications are decoupled from one another with respect to energy supply. If the computing resources are, for example, different computing centers decoupled from one another with respect to their supply, then the automation system is also available when the energy supply of a computing center fails. In particular, the locations of the computing resources for the control applications are supplied with energy from separate networks that are completely decoupled from one another. Thus, the locations can, for example, be selected such that they are arranged in different regions or states with non-intercoupled energy supplies.
It is also an object of the present invention to provide a method for creating a redundant automation system, in particular an automation system in accordance with disclosed embodiments of the invention, where the method includes: a) providing information on the network topology of the internet or a comparable computer network including information on its structure of communication hubs and on communication paths connecting these to one another; b) providing information on computing centers present within the network topology, including information on the locations thereof; c) identifying the installation location of an automation installation to be controlled within the network topology; d) identifying at least one pair of computing centers, which is connectable to the automation installation within the network topology via communication paths and which have a minimal number of overlaps and/or common communication hubs, in particular no overlaps and/or no common communication hubs; and e) selecting a pair of computing centers identified in step d) including the associated communication paths.
In a first step a), information on the network topology of the internet or a comparable computer network is collected and provided, i.e., information on the specific arrangement of the devices and lines that form the Internet or computer network, are connected to each other via the computer and exchange data, where the term “lines” should be understood to mean both wired and radio-based transmission links. The information can be obtained base on the basis on static information, such as, existing maps relating to submarine cables and/or by determining the network topology by means of network management protocols etc. In a further step b) information is provided on computing centers present within the network topology, including information on the locations thereof. In step c), the installation location of the automation installation to be controlled within the network topology is identified. When steps a) to c) have been performed, in principle all the information required to connect the automation installation to be controlled or the peripheral units thereof to one of the computing centers is available. In a further step d), at least one pair of computing centers is identified, which can be connected within the network topology via communication paths with the automation installation and have a minimal number of overlaps and/or common communication hubs, in particular no overlaps and/or no common communication points. Therefore, particularly those computing centers are identified which, if possible, can be connected to the automation installation on completely independent communication paths of the known network topology. In a step e), one of the pairs of computing centers, including the associated communication paths, identified in step d) is selected. Accordingly, a maximum MTTF is achieved in the event of one of the communication paths between the automation system and one of the two computing centers failing.
Advantageously, in step b) additional information on the power supply and/or on the present utilization and/or on the computing power of the computing centers is provided, where the selection in step e) occurs taking account of at least one item of this additional information. If, in step d), for example, a plurality of potential pairs of computing centers are determined with which the automation installation could be connected via different communication paths, then the selection in step e) is made based on further criteria. For example, a check can be performed to determine which pairs of computing centers have independent power supplies so that only pairs of computing centers with an independent power supply are included in the narrower selection.
Alternatively or additionally, the present utilization of the computing centers of the pairs identified in step d) can be checked. Accordingly, for the selection in step e), preference is given to the pairs whose computing centers have a low level of utilization. Alternatively or additionally, the computing power of the corresponding computing centers can be used as a selection criterion in step e), where precedence is given to computing centers with high computing power. If a plurality of additional criteria is included in the selection in step e), priorities or importance identifiers can be assigned to the individual criteria.
In accordance with one embodiment of the present invention, the method further includes: f) providing two control applications configured to control the automation installation, where the control applications are configured such that one of the control applications operates as the master and the other control application operates as the reserve and such that, in the event of the control application operating as the master failing, the control application operating as the reserve takes over and functions as the master, g) storing the control applications in the computing centers selected in step e); h) coupling the control applications via a synchronization path; and i) connecting the control applications to the automation installation via the communication paths selected in step e).
Herein, the synchronization path selected in step h) is preferably selected such that the synchronization path and the two communication paths connecting the control applications to the automation installation have no or a minimal number of common communication hubs.
It is a further object of the present invention to provide a computer program comprising program code means which, when executed by a processor at least one computer, causes the at least one computer to perform the method in accordance with disclosed embodiments of the invention.
Moreover, it is also an object of the invention to provide a computer-readable medium that comprises program instructions which, when executed by a processor of at least one computer, cause the at least one computer to perform the method in accordance with the disclosed embodiments of the invention.
The computer-readable medium can, for example, be a CD-ROM or a DVD or a USB or a flash memory. It should be noted that a computer-readable medium should not exclusively be understood to be a physical medium, but may also, for example, also be present in the form of a data flow and/or a signal representing a data flow.
Other objects and features of the present invention will become apparent from the following detailed description considered in conjunction with the accompanying drawings. It is to be understood, however, that the drawings are designed solely for purposes of illustration and not as a definition of the limits of the invention, for which reference should be made to the appended claims. It should be further understood that the drawings are not necessarily drawn to scale and that, unless otherwise indicated, they are merely intended to conceptually illustrate the structures and procedures described herein.
Further features and advantages of the present invention will become clear from the following description with reference to the attached drawing, in which:
In a first step a), information on the topology of a computer network 3 is provided. In the present case, the computer network 3 is the Internet. However, alternatively, the computer network 3 can also be a comparable computer network, such as a company intranet communicatively connecting a plurality of company locations to one another. The information provided in step a) is at least information on the structure or partial structure of the computer network 3, which is formed by communication hubs 4 and communication paths 5 interconnecting these to one another. The communication paths 5 can be wired and/or radio-based transmission links. Here, the information was obtained based on static information, such as maps showing currently existing submarine cables and radio-based transmission links. Further, information was also obtained by determining the network topology via network management protocols. In addition, in step a) supplementary information on the computer network 3 can be provided, such as information on transmission speeds of individual communication paths 5, information collected based on failure statistics relating to the probability of failure of communication hubs 4 and/or communication paths 5.
In a further step b) information on computing centers 6 present within the network topology depicted in
If an automation system 1 is to be created now for an automation installation 2, in step c) the installation location of the automation installation 2 within the network topology is identified, see
In a subsequent step d) at least one pair of computing centers 6 is then identified, which can be connected to the automation installation 2 within the network topology via communication paths 5 and which have a minimal number of overlaps and/or common communication hubs 4, in particular no overlaps and/or no common communication hubs. In the example depicted, a total of 22 such pairs can be formed. Each of these pairs comprise an African computing center 6 and a computing center 6 arranged outside Africa.
In a further step e), a pair of computing centers 6 identified in step d) including the associated communication paths 5 is then selected. If, as in the present exemplary embodiment in step d), a plurality of pairs of computing centers 6 were identified, then the selection in step e) can occur based on further criteria, such as based on the above-mentioned transmission speeds of the individual communication paths 5, the probability of failure of communication hubs 4 and/or communication paths 5. Preferably, in step b) further additional information on the power supply and/or on the present utilization and/or on the computing power of the computing centers 6 is provided and can be used in step e) for selecting an optimal pair. For example, in step e), a check can be performed to determine which pairs of computing centers 6 have power supplies that are independent of each other, where only pairs of computing centers 6 with power supplies that are then independent of each other are included in the narrower selection. Alternatively or additionally, the present utilization of the computing centers 6 can be checked, where pairs with computing centers 6 with a low level of utilization are given preference. Alternatively or additionally, it is also possible for a comparatively high computing power of both computing centers 6 in a pair to be decisive for the selection. Weighting factors can be assigned to the individual additional criteria in order to weight them to a greater or lesser degree in the selection to be made in step e).
In a step f), two control applications 7 configured to control the automation installation 2 are then provided. The control applications 7 are configured such that one of the control applications 7 operates as the master and the other control application 7 operates as the reserve, where in the event of the control application working as the master 7 failing, the control application operating as the reserve 7 takes over and functions as the master.
In the step g), the control applications 7 are stored in the computing centers 6 selected in step e).
Subsequently, in step h), the control applications 7 are coupled via a synchronization path 8, which is preferably selected such that the synchronization path 8 and the two communication paths 5 connecting the control applications 7 to the automation installation 2 have no overlaps and/or a minimal number of common communication hubs 4. If this not possible, then the communication paths 5 and the synchronization path 8 are selected such that they have as few overlaps and/or common hubs 4 as possible.
In step i), the control applications 7 are connected to the automation installation 2 via the communication paths 5 selected in step e) and the computing centers 6 via the selected synchronization path 8. This results in the arrangement depicted in
In the present case, a computer program comprising program code means is provided which, when executed by the processor of at least one computer, cause the at least one computer to perform the above-described disclosed embodiments of the method in accordance with the invention. Only the identification of the installation location in step c) must occur via user input.
Even though its control applications 7 form a part of a cloud-computing structure, the automation system 1 in accordance with disclosed embodiments of the invention is characterized by very high level of availability. This availability can be further optimized by the type of synchronization mechanism with which the control applications 7 are synchronized and by the way in which the output data is handled in the redundant automation system 1. Here, reference is made to the method for operating a redundant automation system 1 disclosed in the publication EP 2 657 797 B1, which can also be transferred to the redundant automation system 1 with disclosed embodiments of the invention.
Although the invention has been illustrated and described in greater detail by the preferred exemplary embodiment, the invention is not restricted by the disclosed examples and other variations can be derived herefrom by the person skilled in the art without departing from the scope of protection of the invention.
Thus, while there have been shown, described and pointed out fundamental novel features of the invention as applied to a preferred embodiment thereof, it will be understood that various omissions and substitutions and changes in the form and details of the devices illustrated, and in their operation, may be made by those skilled in the art without departing from the spirit of the invention. For example, it is expressly intended that all combinations of those elements which perform substantially the same function in substantially the same way to achieve the same results are within the scope of the invention. Moreover, it should be recognized that structures and/or elements shown and/or described in connection with any disclosed form or embodiment of the invention may be incorporated in any other disclosed or described or suggested form or embodiment as a general matter of design choice. It is the intention, therefore, to be limited only as indicated by the scope of the claims appended hereto.
| Number | Date | Country | Kind |
|---|---|---|---|
| 19201463 | Oct 2019 | EP | regional |
| Number | Name | Date | Kind |
|---|---|---|---|
| 20120089749 | Barthel | Apr 2012 | A1 |
| 20130290776 | Grosch et al. | Oct 2013 | A1 |
| 20160154693 | Uhde | Jun 2016 | A1 |
| 20160274552 | Strohmenger | Sep 2016 | A1 |
| 20170063666 | Ahuja | Mar 2017 | A1 |
| 20190199626 | Thubert et al. | Jun 2019 | A1 |
| 20190302742 | Grosch et al. | Oct 2019 | A1 |
| Number | Date | Country |
|---|---|---|
| 2657797 | Oct 2013 | EP |
| 3070548 | Sep 2016 | EP |
| Entry |
|---|
| Hegazy, Tamir et al., Industrial Automation as a Cloud Service, 2014, IEEE (Year: 2014). |
| EP Search Report dated Feb. 17, 2020 based on EP19201463 filed Oct. 4, 2019. |
| Anonymous: “IP Address—Wikipedia”, Wikipedia, 7. Oct. 2019, pp. 1-11. |
| Anonymous: “IP Routing—Wikipedia”, Wikipedia, 7. Oct. 2019, pp. 1-3. |
| Number | Date | Country | |
|---|---|---|---|
| 20210103254 A1 | Apr 2021 | US |
