Method for controlling failover between redundant network interface modules

Claim 3

The method of claim 1 further comprising the step of the secondary NIM terminating its operation if the secondary NIM is unable to communicate with the first network.

Claim 4

The method of claim 2 in which each communication between the NIMs includes current operating status of the NIM originating such a communication, and further comprising the step of the secondary NIM terminating its operation if the secondary NIM detects it has suffered a hardware or a software failure.

Claim 5

The method of claim 3 further comprising the step of the primary NIM failing over to the secondary NIM if the primary NIM detects it has suffered a hardware or a software failure.

Claim 6

The method of claim 4 in which the primary NIM fails over to the secondary NIM without communicating status information in a status message to the secondary NIM that it has suffered a hardware or a software failure.

Claim 7

The method of claim 5 in which each of the predetermined time intervals is one second.

Claim 8

The method of claim 6 in which the first local area network is a token passing network.

Claim 9

The method of claim 7 in which the second local area network is a token passing network.

Claim 10

In a process control system including an universal control network (UCN) and a local control network (LCN), each being a local area network (LAN) with each network including a plurality of modules, the modules of the UCN and the modules of the LCN communicating with one another over a communication bus, a pair of network interface modules other NIM being designated as a secondary, each of the NIMs being connected between the communication buses of the UCN and the LCN and functioning to provide communication and data translation between the UCN and the LCN, the primary NIM providing such function unless replaced by the secondary NIM, and the secondary NIM being available to provide this function instead of the primary NIM upon the occurrence of predetermined failover conditions, a method for providing the communication function comprising the steps of: (a) the secondary NIM transmitting to the primary NIM at least once during every first period of time over the UCN communication bus a status message, the secondary NIM's status message including the current operating status of the secondary NIM and the status of the LCN as determined by the secondary NIM; (b) the primary NIM transmitting to the secondary NIM at least once during every first period of time over the UCN communication bus a status message, the primary NIM's status message including the current operating status of the primary NIM and the status of the LCN as determined by the primary NIM; (c) the primary NIM transmitting to the secondary NIM at least once during every first period of time over the LCN communication bus a status message, the primary NIM's status message including current operating status of the primary NIM, of the UCN as determined by the primary NIM, and updating data with which the secondary NIM updates the secondary NIM's data base so that the data base of the secondary NIM substantially matches the that the data base of the secondary NIM substantially matches the data base of the primary NIM; (d) the secondary NIM transmitting to the primary NIM upon receiving a predetermined number of messages from the primary NIM in step (c) containing updating data or during every first period of time, which ever first occurs, over the LCN communication bus a status message, the secondary NIM's status message including the current operating status of the UCN as determined by the secondary NIM; (e) the primary NIM failing over tot he secondary NIM if the primary NIM is unable to communicate with the LCN, and the secondary NTM is able to communicate with the LCN and status messages containing such data are received by both NIMs; (f) the secondary NIM terminating its operations if it determines that it is unable to communicate with the LCN; (g) the primary NIM terminating operation of the secondary NIM if the secondary NIM is unable to communicate with one of the LANs; (h) the primary NIM terminating communications with the secondary NIM if the secondary NIM crashes; and (i) the secondary NIM taking over the function of the primary NIM if the primary NIM crashes, if the primary NIM is commanded to shut down by a command from a universal control station module of the first network, or if the primary NIM is powered down.

Claim 11

In a process control system including an universal control network (UCN) and a local control network (LCN), each being a local area network (LAN) with each network including a plurality of modules, the modules of the UCN and the modules of the LCN communicating with one another over a communication bus, a pair of network interface modules other NIM being designated as a secondary, each of the NIMs being connected between the communication buses of the UCN and the LCN and functioning to provide communication and data translation between the UCN and the LCN, the primary NIM providing such function unless replaced by the secondary NIM, and the secondary NIM being available to provide this function instead of the primary NIM upon the occurrence of predetermined failover conditions, a method for providing the communication function comprising the steps of: (a) the secondary NIM transmitting to the primary NIM at least once during every first period of time over the UCN communication bus a status message, the secondary NIM's status message including the current operating status of the secondary NIM and the status of the LCN as determined by the secondary NIM; (b) the primary NIM transmitting to the secondary NIM at least once during every first period of time over the UCN communication bus a status message, the primary NIM's status message including the current operating status of the primary NIM and the status of the LCN as determined by the primary NIM; (c) the primary NIM transmitting to the secondary NIM at least once during every first period of time over the LCN communication bus a status message, the primary NIM's status message including current operating status of the primary NIM, of the UCN as determined by the primary NIM, and updating data with which the secondary NIM updates the secondary NIM's data base so that the data base of the secondary NIM substantially matches the that the data base of the secondary NIM substantially matches the data base of the primary NIM; (d) the secondary NIM transmitting to the primary NIM upon receiving a predetermined number of messages from the primary NIM in step (c) containing updating data or during every first period of time, which ever first occurs, over the LCN communication bus a status message, the secondary NIM's status message including the current operating status of the UCN as determined by the secondary NIM; (e) the primary NIM failing over tot he secondary NIM if the primary NIM is unable to communicate with the LCN, and the secondary NTM is able to communicate with the LCN and status messages containing such data are received by both NIMs; (f) the secondary NIM terminating its operations if it determines that it is unable to communicate with the LCN; (g) the primary NIM terminating operation of the secondary NIM if the secondary NIM is unable to communicate with one of the LANs; (h) the primary NIM terminating communications with the secondary NIM if the secondary NIM crashes; and (i) the secondary NIM taking over the function of the primary NIM if the primary NIM crashes, if the primary NIM is commanded to shut down by a command from a universal control station module of the first network, or if the primary NIM is powered down.

Claim 12

The method of claim 9 in which the first period of time is one second.

Claim 13

The method of claim 10 in which the universal control network is a token passing network.

Claim 14

The method of claim 11 in which the local control network is a token passing network.