Method and system of sending reset signals only to slaves requiring reinitialization by a bus master

[0002] This invention relates to a method of operating a bus master on a field bus on the basis of the master/slave principle and more particularly to the operation of such a bus in the event of a fault.

[0003] Field buses based on the master/slave principle are used for communication between automated systems and field devices for controlling an industrial process. A number of such field buses have been standardized to allow devices made by different manufacturers to communicate with one another. One protocol for operating such a bus is known as the PROFIBUS™ protocol.

[0004] In a field bus based on the master/slave principle, a bus master is allocated at least one slave, but usually a number of slaves. When such a field bus is initialized, the bus master attempts to contact each of these slaves on the field bus by means of cyclic inquiry. Each slave contacted in this way is initialized and parameterized, so that it is then possible for data interchange with the bus master to start.

[0005] During this initialization of the field bus, all the outputs of all the slaves are firstly reset, as in the PROFIBUS™ protocol. For safety reasons, this procedure is stipulated in Standard EN 50170.

[0006] If during continuous operation a fault occurs in the bus master that imposes reinitialization of the field bus, the preinitialized outputs of the slaves are reset anyway. This resetting results in equipment and devices connected to these outputs adopting undesirable operating states which cause the controlled industrial process to come to a standstill.

[0007] For safety reasons, the slaves are themselves designed to reset their outputs automatically after a predetermined time, known as the communication-free time, has elapsed with no communication. This procedure also causes the controlled industrial process to come to a standstill.

[0008] The present invention provides a method of operating a bus master on a field bus based on the master/slave principle, which, in the event of a fault, makes it possible to reinitialize the bus master within a predefined time, to start communication between the bus master and the slaves again, and in so doing to prevent the preinitialized outputs of the connected slaves from being reset.

[0009] A method of operating a bus master on a field bus in the event of a fault. The field bus has at least one slave connected to it. The bus master runs a separate state table for each connected slave, which stores the operating state of each connected slave. Each state table is deleted when initialization takes place for the first time. The method has the steps of:

[0010] a. assuming upon the fault event that full bootstrap initialization has taken place for each connected slave; and

[0011] b. reinitializing upon the fault event the bus master such that a check is run to ascertain whether full bootstrap initialization has taken place for each connected slave, and, if it has, the content of each state table is retained in unmodified form, and, if it has not, the state table for the slave that was not fully initialized is deleted and bootstrap initialization is imposed on the not fully initialized slave.

[0012] A method for operating a bus master on a field bus. The bus master has one or more slaves connected to it and the field bus. The method comprises:

[0013] a. assuming upon the occurrence of a fault that full bootstrap initialization has taken place for each of the one or more slaves;

[0014] b. reinitializing the bus master upon the fault occurrence such that a check is run to ascertain whether full bootstrap initialization has taken place for each of the one or more slaves;

[0015] c. retaining the content of a state table in the bus master for each of the one or more slaves for which full bootstrap initialization has taken place; and

[0016] d. deleting the state table content for each of the one or more slaves for which full bootstrap initialization has not taken place and imposing full bootstrap initialization on the not fully initialized slaves.

[0017] A system that has:

[0018] a. a bus master;

[0019] b. one or more slaves, the bus master having a state table having contents for each of the one or more slaves;

[0020] c. a field bus connecting the one or more slaves to the bus master;

[0021] the bus master assuming that upon the occurrence of a fault full bootstrap initialization has taken place for each of the one or more slaves;

[0022] the bus master reinitialized upon the fault occurrence such that a check is run to ascertain whether full bootstrap initialization has taken place for each of the one or more slaves;

[0023] the bus master retaining the state table contents for each of the one or more slaves for which full bootstrap initialization has taken place; and

[0024] the bus master deleting the state table contents for each of the one or more slaves for which full bootstrap initialization has not taken place and imposing full bootstrap initialization on the not fully initialized slaves.

[0025] FIG. 1 shows a basic diagram of an automated system.

[0026] FIG. 2 shows a diagram of a process station having a redundant bus master.

[0027] FIG. 3 shows a diagram of redundant process stations having a separate bus master.

[0028] The automated system 10 shown in FIG. 1 has a system bus 1 to which at least operating, observation and configuration means, abbreviated to control equipment 2 below, and process stations 3 are connected. The control equipment 2 is used to supply the process stations 3 with the applications corresponding to the automated task, the applications' code and associated parameters being transmitted to the individual process stations 3.

[0029] Each of the process stations 3 is allocated at least one field device 4 which is operatively connected in an appropriate manner to the process 7 that is to be automated. A field bus 5 is provided for communication between the process stations 3 and the field devices 4. This field bus 5 is designed according to the PROFIBUS™ protocol standard EN 50170. The PROFIBUS™ protocol is a master/slave bus protocol. This means that the bus master determines the timing and content of communication on the bus.

[0030] For communication through the field bus 5, the process station 3 is equipped with a bus master 301, and each field device 4 is equipped with a slave 401. Each bus master 301 and each slave 401 comprises a dedicated computational device with separate execution and processing routines. Each slave 401 is preconfigured individually. Information about the type and features as well as identifying characteristics of the slave 401 and of the associated field device 4 are preset in this case.

[0031] At bootstrap initialization, the bus master 301 runs through a number of states. When the system is switched on, starting from the state in which there is no action or communication, the master configuration of the bus master 301 is first loaded. During this procedure, the bus master 301 is informed of the individual presets of each slave 401. The connection to the slaves 401 is then established, exclusively zero data being transferred in the output direction. After communication has been established successfully, application data is interchanged with the slaves 401.

[0032] For each slave 401, the bus master 301 runs a separate state table, the so-called slave handler, which runs through a number of states for each slave 401 at bootstrap initialization. In this context, the slave handler is first started without any configuration. Subsequently, the slave 401 is addressed on the field bus 5. During this procedure, all the output data is set to zero. After the slave 401 has been detected, it is supplied with configured parameters, the outputs remaining at zero. The configuration of the slave 401 is then loaded and compared with the expected individual presets, the outputs continuing to remain at zero. After this, the diagnostic data of the slave 401 is read, the outputs continuing to remain at zero. In so far as configuration and parameterization are completed without error, cyclic data interchange between the bus master 301 and the respective slave 401 is started, the outputs of the slave 401 being set on the basis of the application data.

[0033] During correct operation, all the slaves 401 are in the data interchange state. If a fault occurs in the bus master 301, necessitating a restart, the method of the present invention first assumes that each connected slave 401 is fully initialized. The bus master 301 is then reinitialized such that a check is run to ascertain whether full initialization has taken place for each connected slave (401) as assumed. For each slave 401 that has actually been fully initialized, data interchange between the bus master 301 and this slave 401 is continued immediately.

[0034] In the absence of the present invention every slave 401 would after the occurrence of a fault reset its output for safety reasons after the passage of the predefined maximum communication-free time. The present invention prevents the resetting of the outputs of those slaves 401 that during the maximum communication-free time continue established communication requested by the bus master 301 that was reinitialized upon the occurrence of the fault. This prevention of the resetting of those slaves 401 that continue established communication during the maximum communication-free time avoids undesirable operating states in the controlled industrial process 7.

[0035] For each slave 401 that has not been fully initialized, the state table is deleted and hence the bootstrap initialization described above is imposed. This case arises whenever the fault imposing reinitialization occurs during bootstrap initialization or during a reconfiguration phase. As the relevant slaves 401 were in a different state than the data interchange state at the instant of the fault, the imposed bootstrap initialization advantageously avoids any change of state relevant to the process 7.

[0036] In an advantageous refinement of the invention, the method of the present invention can also be applied to bus master redundancy. Bus master redundancy is not provided as such in accordance with the PROFIBUS™ system standard EN 50170. In order nevertheless to increase the availability of a PROFIBUS™ system, at least two bus masters 301 and 302 are provided which, as shown in FIG. 2, are installed in the same process station 3 or, as shown in FIG. 3, are each allocated to a separate process station 31 and 32. The description that follows refers to two bus masters 301 and 302 allocated to separate process stations 31 and 32, as illustrated in FIG. 3.

[0037] The two process stations 31 and 32 are coupled to one another through a direct connection 6 and are configured identically. This means, specifically, that the two process stations 31 and 32 are loaded with the same applications having an identical code and identical parameters. Furthermore, the same processes are started on the two process stations 31 and 32. However, only the process station 31 is activated, while the other process station 32 is switched to the passive mode. In this context, it may be expedient to execute the started processes exclusively on the active process station 31. The direct connection 6 is used to transfer data from the active process station 31 to the passive process station 32. This includes the received application data that is to be output and the configuration data of the associated slaves 401.

[0038] The interface 321 between the process station 32 that has been switched to the passive mode and the system bus 1, and the interface 322 between the bus master 302 and the field bus 5, are connected physically but switched to passive mode logically.

[0039] During correct operation, all of the slaves 401 are in the data interchange state. If a fault occurs in the active bus master 301, the previously passive bus master 302 is activated and the previously active bus master 301 is switched to the passive mode. When the previously passive bus master 302 is activated, it is first assumed that each connected slave 401 is fully initialized. In this context, the previously passive bus master 302 is initialized such that a check is run to ascertain whether full initialization has taken place for each connected slave 401 as assumed. For each slave 401 that has actually been fully initialized, data interchange between the bus master 301 and the fully initialized slave 401 is continued immediately.

[0040] In the absence of the present invention every slave 401 would after the occurrence of a fault reset its output for safety reasons after the passage of the predefined maximum communication-free time. The present invention prevents the resetting of the outputs of those slaves 401 that during the maximum communication-free time continue established communication requested by the bus master 302 that was activated upon the occurrence of the fault. This prevention of the resetting of the slaves 401 that continue established communication during the maximum communication-free time avoids undesirable operating states in the controlled industrial process 7.

[0041] For each slave 401 that has not been fully initialized, the state table is deleted and hence the bootstrap initialization described above is imposed. This case arises whenever the fault imposing reinitialization occurs during bootstrap initialization or during a reconfiguration phase. As the relevant slaves 401 were in a different state than the data interchange state at the instant of the fault, the imposed bootstrap initialization advantageously avoids any change of state relevant to the process 7.

[0042] For communication purposes, the activated bus master 302 adopts the bus address of the malfunctioning bus master 301. Consequently, this method is completely transparent for the connected slaves 401. Advantageously, this means that all the available slaves 401 can continue to be operated without limitation.

[0043] A further advantage is that it is possible to dispense with state adjustment between the redundant bus masters 301 and 302. The bus master 301 taking over is synchronized in the state of the slaves 401 that are allocated to it.

[0044] It is to be understood that the description of the preferred embodiment(s) is (are) intended to be only illustrative, rather than exhaustive, of the present invention. Those of ordinary skill will be able to make certain additions, deletions, and/or modifications to the embodiment(s) of the disclosed subject matter without departing from the spirit of the invention or its scope, as defined by the appended claims.