Method for enacting failover of a 1:1 redundant pair of slave processors

Claim 1

A method for accomplishing a failover in a process control system, the process control system having a master controller operatively connected to a communication link; and at least one pair of slave input/output processors IOPs), each IOP being operatively connected to the communication link wherein a first IOP of the pair is a primary slave IOP and a second IOP of the pair is a secondary slave IOP, the first and second IOP having a first and second data base, respectively, the first and second IOP each executing the same tasks utilizing a first and second clocking system, respectively, and further wherein the data bases of the first and second IOPs are synchronized, communications by the master controller being made only to the first IOP including communications which modify the first data base, the first and second IOPs being unable to communicate with each other, and further wherein the first and second IOPs are each operatively connected to an output switching device such that control of said output switch device is coordinated between said first and second IOP, and wherein each of said first and second IOP can sense a state of an output control signal from the other IOP to said output switching device, the method for accomplishing a failover, comprising the steps of: the primary slave IOP a) upon detecting an error, verifying the availability of a secondary slave IOP; b) setting the output control signal to indicate backup is being requested; c) taking itself out of being the primary slave IOP; the secondary slave IOP d) sensing that the output control signal from the other IOP of the pair of IOPs has been set indicating that the primary slave IOP has detected a failure; e) assuming the role of the primary slave IOP; the master controller f) detecting an error with the primary slave IOP; g) interrogating the primary and secondary slave IOPs for a status input; h) arbitrating between the first and second IOP to determine the IOP that is to take on the primary role; and i) awarding the more operational IOP the role of the primary slave IOP, thereby completing the failover operation.

Claim 2

A method for accomplishing a failover in a process control system, the process control system having a master controller operatively connected to a communication link; and at least one pair of slave input/output processors IOPs), each IOP being operatively connected to the communication link wherein a first IOP of the pair is a primary slave IOP and a second IOP of the pair is a secondary slave IOP, the first and second IOP having a first and second data base, respectively, the first and second IOP each executing the same tasks utilizing a first and second clocking system, respectively, and further wherein the data bases of the first and second IOPs are synchronized, communications by the master controller being made only to the first IOP including communications which modify the first data base, the first and second IOPs being unable to communicate with each other, and further wherein the first and second IOPs are each operatively connected to an output switching device such that control of said output switch device is coordinated between said first and second IOP, and wherein each of said first and second IOP can sense a state of an output control signal from the other IOP to said output switching device, the method for accomplishing a failover, comprising the steps of: the primary slave IOP a) upon detecting an error, verifying the availability of a secondary slave IOP; b) setting the output control signal to indicate backup is being requested; c) taking itself out of being the primary slave IOP; the secondary slave IOP d) sensing that the output control signal from the other IOP of the pair of IOPs has been set indicating that the primary slave IOP has detected a failure; e) assuming the role of the primary slave IOP; the master controller f) detecting an error with the primary slave IOP; g) interrogating the primary and secondary slave IOPs for a status input; h) arbitrating between the first and second IOP to determine the IOP that is to take on the primary role; and i) awarding the more operational IOP the role of the primary slave IOP, thereby completing the failover operation.

Claim 5

A method for accomplishing a failover, according to step 2, wherein the step of clearing comprises: clearing a flag internal to the IOP which is utilized internally to the IOP to indicate that it is in a primary role, the flag including the value of the logical address assigned by the master controller to the IOP.

Claim 6

A method for accomplishing a failover, according to step 2, wherein the step of clearing comprises: clearing a flag internal to the IOP which is utilized internally to the IOP to indicate that it is in a primary role, the flag including the value of the logical address assigned by the master controller to the IOP.