Method for a redundant transmission system with prp and fault prediction

0001The invention relates to a method for operating a transmission system which has a first network and at least one further network, data being exchanged between these at least two networks in that data from the first network is supplied to duplicating means, wherein the supplied data are transmitted wirelessly by means of PRP to separating means via at least two transmission paths and are forwarded by the separating means to the connected further network, according to the features of claim 1. Existing transmission systems were in <patcit id="pcit0001" dnum="WO2011160957A"><text>WO2011 / 160957 on December 29, 2011</text></patcit> and in <patcit id="pcit0002" dnum="US2010110904A"><text>US2010 / 110904 on May 6, 2010</text></patcit> disclosed.

0002Such known transmission systems are used in safety-critical cases in process engineering systems, stationary or mobile work equipment, for example in work vehicles such as cranes or the like.

0003It is important that data are reliably transmitted from the first network to the at least further network. Such a security-critical data transmission is particularly important when the data is transmitted over a wireless transmission path. There has already been an improvement in this regard such that not only one transmission link, but at least two, preferably exactly two, transmission links are used for this safety application (also called safety application). A further improvement of this redundant data transmission has taken place in that it is wireless, i.e. via radio or light, using the PRP (Parallel Redundancy Protocol), which is a layer 2 redundancy method that is independent of higher layers and above all suitable for real-time Ethernet mechanisms.

0004From a security point of view, such a transmission system works satisfactorily because there is redundancy of the two transmission links. For example, if a wireless transmission link is disturbed or fails, the at least second transmission link can be used to ensure data transmission from the first to the further network.

0005However, it cannot be ruled out that, despite this redundancy, the data transmission between the two networks is disrupted in an impermissible manner under safety-critical aspects.

0006Although the redundancy is significantly increased in such transmission systems with at least two transmission links and safety-critical aspects have been taken into account, there is nevertheless the risk that such a transmission system will not work absolutely free of errors. Due to the redundancy mechanism, which is implemented by means of wireless data transmission with the help of PRP over two mutually independent transmission links, there is a risk that an apparently error-free transmission system is present due to the error compensation using PRP, which is in fact not the case because of the Redundancy mechanism can detect and compensate for internal system errors. For example, individual data packets lost on the transmission path cannot be recognized by the operator of the transmission system. The redundancy mechanism can give the impression that the transmission system is working without errors, but this is not the case, since errors are compensated independently by the transmission system. For example, in the event that one of the at least two transmission links is permanently disrupted or has completely failed, the data can still be transmitted via the other available transmission link, which results in a transmission system that appears to be operating without errors. However, there is then the risk that, in the event of a malfunction or failure of the only available transmission link, reliable data transmission can no longer be guaranteed and, as a result, safety-critical situations can arise, which must actually be avoided due to the redundancy. In such a case, the redundancy mechanism would be permanently active and the data would only be transmitted over the only available transmission link, whereas the at least further transmission link is no longer available, which, however, is not or not readily apparent to a user of the transmission system. This means that there is no longer any redundancy reserve available because the actual redundancy mechanism, namely the separate transmission of data from one network to the other, is permanently disrupted.

0007Such a case is in <figref idref="f0002">Figure 2</figref> shown. It can be seen from this that data is transmitted permanently and error-free over one transmission path, whereas the same data that is transmitted over the other transmission path is 100% lost because, for example, this transmission path has completely failed. The 100% error-free data transmitted over one transmission path arrive in the further network without errors, so that the data transmission is maintained and the operation of the transmission system is guaranteed without errors. However, if there is a disruption in the transmission path, with which 100% of the data was previously transmitted, the redundancy mechanism is impaired or, in the worst case, even completely canceled, so that critical situations can unfavorably arise.

0008The invention is therefore based on the object of improving a method for operating a transmission system with regard to its safety reserves.

0009This object is achieved by the features of claim 1.

0010According to the invention it is provided that the data are transmitted as data packets and it is determined whether a data packet was transmitted or not and, based on this, it is derived whether the transmission system is working properly or not. With the solution of the invention it can thus be determined whether the redundancy mechanism is working or not and, based on this, a statement can be made as to whether the transmission system is error-free or error-prone, that is, is working using the redundancy mechanism. This creates the possibility for the user to monitor the transmission system and possibly initiate countermeasures. If, for example, it is determined that all data packets have been transmitted error-free both over one and the other transmission path, it can be deduced from this that the entire transmission system is working without errors and the required and desired redundancy reserve is available without restriction. However, if it is found that part of the data over one transmission link and / or part of the data over the other transmission link was not transmitted without errors (for example because one of the transmission links was disrupted or there is an error in components of the transmission system), it can be deduced from this that the transmission system can still transmit data from one network to the other, However, the redundancy reserve is limited. Depending on how large the extent of the data packets transmitted as faulty or not at all, it can be deduced whether this is still permissible and the required redundancy reserve has not yet fallen below or whether this is already the case, so that it is necessary to use at least one Initiate error analysis or, if necessary, countermeasures.

0011In a further development of the invention, each error-free transmitted data packet is counted and related to the total number of transmitted data packets, and a failure probability is calculated from this. The redundancy box knows how large the number of data packets is that are sent on a transmission path. This number can be transmitted to the separating means (redundancy box), this separating means counting the data packets which have been transmitted error-free on this transmission link and are received by them. These two numbers are set in relation, whereby in the case of error-free transmission the subscription ratio is equal to 1. However, if it is less than 1, it can be assumed that data packets were lost during transmission on the transmission path due to malfunctions, failures or the like. Then a decision can be made as to the extent to which the ratio is less than 1. If it is, for example, between 0.9 and 1 or between 0.8 and 1, it can be assumed that the data transmission is still working, but that the redundancy mechanism has started. However, in this case the redundancy reserve (which is, for example, a ratio of 0.9 or 0.8) is not yet undershot, so that intervention by a user of the transmission system is not yet necessary. Only when this redundancy reserve is further undershot, for example 0.9 or 0.8, is the user to intervene with regard to an error analysis or error analysis. An error elimination after the error analysis has been carried out, although the reliable data transmission between the first and the further network is still taking place. In such a case, a failure of the transmission system or an impairment can be counteracted despite further correct data transmission. This is of particular advantage from a safety-critical point of view, since, according to the invention, errors can be recognized in advance and acted accordingly.

0012In a further development of the invention, the procedure described above takes place separately from one another for each transmission link. This means that for each transmission link, each error-free transmitted data packet is counted and related to the total number of transmitted data packets and a failure probability or the aforementioned redundancy reserve is calculated from this. This failure probability or the redundancy reserve is displayed in a particularly advantageous manner. Appropriate means are provided for this. These means can, for example, be a kind of traffic light that signals whether the transmission system is working 100% error-free, including all units of the transmission system, without the redundancy mechanism having used. With the appropriate light sources, this status could be displayed in green, for example. If, however, a certain probability of failure is calculated so that the redundancy reserve is no longer equal to 1 but less than 1, this can be indicated by light sources, for example in yellow. This takes place as long as the redundancy reserve is less than 1, but above a predefinable threshold that is less than 1 and greater than 0. This threshold can be, for example, at the pre-recorded value 0.9 or 0.8 or values ​​deviating therefrom. In any case, this color signals to the operator of the transmission system that the redundancy mechanism has started and that the data transmission is still error-free, but limited in terms of redundancy. From this he can deduce whether he wants to carry out an error analysis and, depending on this, eliminate the errors found. Detected errors can be, for example, disturbances in the transmission path or hardware errors in components of the transmission system. Only when the probability of failure exceeds a predefinable threshold, which is equivalent to falling below the redundancy reserve below a threshold value less than 1, is there a significant restriction not only in data transmission but also in redundancy, so that safety-critical states can arise if this state is maintained . It is therefore necessary to act in such a case, which can be signaled by red light sources, in order to avoid such safety-critical conditions. In addition to the display that there is a certain probability of failure, it can alternatively or in addition to this be thought that if the probability of failure exceeds or exceeds a predeterminable threshold, the redundancy reserve falls below a predefinable value less than 1, a notification is triggered. This can be, for example, an SMS message or a comparable message, an e-mail, or the like, which a network administrator receives, for example.

0013The method presented can be applied to a transmission system that is included in the <figref idref="f0001">Figure 1</figref> is shown.

0014<figref idref="f0001">Figure 1</figref> shows a basic arrangement of a transmission system which has two networks 2, 3 which are intended to exchange data with one another. This data exchange can take place either unidirectionally from the network 2 to the network 3 (or vice versa), but also bidirectionally between the two networks 2, 3.

0015The networks 2, 3 can be simple or complex networks, for example in a ring or line topology or the like. However, it is also conceivable that such a network 2, 3 comprises only a single element such as, for example, a sensor, an actuator, a control device or the like.

0016In order to transmit the data of the network 2 to the network 3, for example, duplication means 4 are present. These doubling means 4 divide the supplied data stream into two data streams. Likewise, the merging of the two data streams takes place via separating means 5 after they have been received, the received data streams being forwarded to the network 3 after the merging.

0017The transmission of the data between the doubling means and the separating means 5 takes place wirelessly by means of PRP via two similar or different transmission paths 6, 7. The wireless transmission takes place in an advantageous manner via radio, optical transmission also being conceivable. It is also conceivable that one transmission link 6 is a radio transmission link and the second transmission link 7 is an optical data transmission link. If both transmission links 6, 7 are, for example, radio transmission links, the data, more precisely the data packets, can be transmitted over these two radio transmission links, for example at the same frequency or different frequencies and otherwise the same parameters or different transmission parameters. Similar transmission links 6, 7 are to be preferred with regard to their structure, whereas transmission links 6, 7 that are different from one another (for example optical / radio or transmission parameters that differ from one another) are preferred with regard to increasing the redundancy.

0018After the data has been fed from the primary network 2 to the duplication means 4 (also referred to as a redundancy box in PRP), it is arranged there that each data packet is transmitted several times over the same transmission path 6, 7 and / or an error correction value is assigned to each data packet. The data packets are then transmitted in a corresponding manner via the transmission links 6, 7, with the data packets being appropriately evaluated by the separating means 5 (in the case of PRP also referred to as a redundancy box), processed if necessary and fed to the further network 3 as data packets.

0019The above description of the <figref idref="f0001">Figure 1</figref> relates to a unidirectional data transmission from the first network 2 to the further, in particular the second network 3. For this purpose, the doubling means 4 are designed to split the data stream and the separating means 5 are designed to merge the received data stream.

0020If data transmission from the network 3 to the network 2 is also desired, further doubling means 4 or separating means 5 can be present in the transmission path between the network 3 and the network 2, so that a double structure results. As an alternative to this, the means 4, 5 can also be designed not only to double the supplied data stream, but also to separate the data streams supplied via the transmission links 6, 7, which also applies to the separating means 5.

List of reference symbols

0021<dl id="dl0001" compact="compact"><dt>1.</dt><dd>Transmission system</dd><dt>2.</dt><dd>First network</dd><dt>3.</dt><dd>Another network</dd><dt>4.</dt><dd>Doubling agent</dd><dt>5.</dt><dd>Separating agent</dd><dt>6.</dt><dd>First transmission link</dd><dt>7.</dt><dd>Second transmission path</dd></dl>