WO2009007228A1

WO2009007228A1 - Identifying improper cabling of devices

Info

Publication number: WO2009007228A1
Application number: PCT/EP2008/057920
Authority: WO
Inventors: Wolfgang Wimmer
Original assignee: Abb Technology Ag
Priority date: 2007-07-09
Filing date: 2008-06-23
Publication date: 2009-01-15
Also published as: EP2163024A1; US20100110904A1; EP2015501A1; US8344736B2; EP2163024B1; CN101689985B; ATE506775T1; ES2364535T3; DE602008006404D1; CN101689985A

Abstract

The present invention is concerned with the identification of an improper cabling of control system devices connected to redundant communication networks of a distributed control system, in particular a substation automation system. As proposed in the standard IEC 62439 (Parallel Redundancy Protocol PRP), messages including a sender identification or source address as well as network or associated device port identification are transmitted from a sending device to a receiving device over the redundant networks. The receiving or destination device determines a connect status indicating whether or not a message has been received on a particular device port, as well as an error event indicating whether or not said device port is associated to the network identified in the received message. By doing so for at least two distinct sending devices, the invention produces, in addition to diagnosing an improper communication path between two devices, an indication as to the location and/or type of wrong cabling. Single error events are preferably supplanted by error rates calculated as a probability of receiving messages on a device port not associated to the network identified in the received message and compared to error thresholds for the purpose of identifying improper cabling.

Description

DESCRIPTION

IDENTIFYING IMPROPER CABLING OF DEVICES

FIELD OF THE INVENTION

The invention relates to the field of industrial communication systems with redundant communication networks, and in particular to substation automation systems. It departs from a method of identifying improper cabling of devices connected to redundant networks as described in the preamble of claim 1.

BACKGROUND OF THE INVENTION

In industrial communication networks of distributed control systems, reliability or availability is a key issue, because a failing communication network generally entails an interruption of the control system eventually leading to a shut down of the controlled industrial process. Therefore, communication network redundancy is an important feature of all industrial control systems demanding high availability, in particular in case of Ethernet based communication with commercial switches or if one of the redundant networks is an existing network like the Internet. In order to prevent wrong or improper cabling of the redundant networks to the ports of a device of the control system, dedicated designs of the plugs for the different networks or a color-coding of cables and plugs to facilitate visual inspection can be envisaged. However, these methods require an additional engineering effort, generate additional cost for tailor-made parts, and are incompatible with commercial off-the-shelf components or already existing communication networks.

Alternatives rely on an identification of the ports of the device and/or the redundant networks to which the ports are assigned, and include this identification in a message sent through the network. The patent application publication US2004061486 discloses a way of detecting improper cabling in a system comprising boards within a computer or memory system, which boards are connected by redundant backend networks or communication loops. Messages identifying, by means of a backend identifier or loop ID, a redundant backend network are spread by a host processor and evaluated in order to determine whether or not all the boards are connected to the same redundant backend network. This method is specific for loop topologies serially interconnecting neighboring boards. The identification of an individual wrongly connected port requires user intervention and starts with an investigation of the nearest board to the host processor signaling a wrong cabling.

Substations in high and medium- voltage power networks include primary devices such as electrical cables, lines, bus bars, switches, power transformers and instrument transformers, which are generally arranged in switch yards and/or bays. These primary devices are operated in an automated way via a Substation Automation (SA) system. The SA system comprises microprocessor based, programmable secondary devices, so-called Intelligent Electronic Devices (IED) responsible for protection, control and monitoring of the primary devices. The IEDs are generally assigned to one of three hierarchical levels, i.e. the station level, the bay or application level, and the process level being separated from the bay level by a process interface. The station level of the SA system includes an Operator Work Station (OWS) with a Human-Machine Interface (HMI) and a gateway to a Network Control Centre (NCC). IEDs on the bay level, also termed bay units, in turn are connected to each other and to the IEDs on the station level via an inter-bay or station bus. The communication network connection points of the latter, i.e. the (ports of the) Ethernet switches to which the various application and station level IEDs are connected, have a relatively short Mean Time To Failure (MTTF). Hence, each IED is connected, via two distinct ports to two distinct and hence redundant communication networks as physical communication channels (managed according to Parallel Redundancy Protocol PRP), or to two distinct switches in a ring configuration (managed e.g. according to Rapid Spanning Tree Protocol RSTP, or to IEC 62439 Media Redundancy Protocol MRP).

In contrast to direct cable connections as in the communication loops mentioned above, communication networks or buses comprise a plurality of access points or switches from which cables connect to the devices of the control system, i.e. to their ports and communication circuits. In addition to diagnosing a link between two devices comprising a wrong cabling that jeopardizes the wanted redundancy, an identification of the exact location (device and port) of an improper connection is also desired. This identification may comprise an indication if only one port is connected or if both ports are connected to the same network, or if both ports are cross-connected to the wrong networks. DESCRIPTION OF THE INVENTION

It is therefore an objective of the invention to identify, with a high probability, incorrect cable connections of control system devices connected to redundant communication networks. This objective is achieved by a method of and a device for identifying an improper cabling according to claims 1 and 6, respectively. Further preferred embodiments are evident from the dependent patent claims.

As proposed in the standard IEC 62439 (Parallel Redundancy Protocol PRP), messages including a sender identification or source address as well as network or associated device port identification are transmitted from a sending device to a receiving device over the redundant networks. The receiving or destination device determines a connect status indicating whether or not a message has been received on a particular device port, as well as an error event indicating whether or not said device port is associated to the network identified in the received message. By doing so for at least two distinct sending devices, the invention produces, in addition to diagnosing an improper communication path between two devices, an indication as to the location and/or type of wrong cabling.

In preferred variants, single error events are supplanted by error rates calculated as a probability of receiving messages on a device port not associated to the network identified in the received message and compared to error thresholds for the purpose of identifying improper cabling. As some messages might be delayed on one port more than on the other, or might be missing due to temporary disturbances in some network, reverting to said probabilities prevents singular messages from faking a particular failure situation and wrong conclusions being drawn.

The proposed method can be used with standard, off-the-shelf communication networks like switch based Ethernet systems or Internet, and standardized protocols such as TCP/IP protocol, and does not necessitate any hardware modifications. An automated and correct diagnosis of the wrongly connected port(s) of up to two devices is possible, and a correct diagnosis in many situations where even more devices are wrongly connected can also be achieved. The invention is most beneficially applied to Substation Automation (SA) systems, for which supervising Intelligent Electronic Devices (IED) as the receiving devices are configured for various purposes by means of an IEC 61850 SCL configuration file. Apart from Substation Automation, it is evident that the principles and methods are likewise applicable to other automation systems with a standardized configuration description, such as wind power, hydro power and Distributed Energy Resources (DER).

The code of a computer program for carrying out all or some of the steps according to the invention may be stored in a computer program product, e.g. in a computer readable medium, either in the memory of a computer or other device for performing the steps, or on a data carrier that can be inserted into the computer or device.

BRIEF DESCRIPTION OF THE DRAWINGS

The subject matter of the invention will be explained in more detail in the following text with reference to preferred exemplary embodiments which are illustrated in the attached drawings, in which:

Fig.1 schematically shows a communication system with two redundant networks; and Fig.2 is a table enumerating the failure situations of a communication link.

The reference symbols used in the drawings, and their meanings, are listed in summary form in the list of reference symbols.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

Fig.l shows a communication system with five devices 1 - 5 interconnected via two redundant communication networks A, B. In the configuration depicted, the devices 1 and 3 are properly connected, by means of a terminal cable between each of their respective device ports IA, IB; 3A, 3B to the associated network. On the other hand, port 2B of device 2 is not connected at all, port 4B of device 4 is erroneously connected to network A instead of network B, and ports 5A and 5B of device 5 are cross-connected to the respective wrong network (dashed circles). Any communication link or path of the system comprises first cable connections between a first device and the communication networks, and second cable connections between a second device and the communication networks. As depicted, either one or both of the first and second cable connections could comprise one or two improper or wrong cablings.

According to the standard IEC 62439 related to industrial communication via Parallel Redundancy Protocol (PRP), any message is sent across each of the two redundant communication networks and comprises an identification of the network or channel to which the sending port is assigned, i.e. either network A or network B, in addition to the source and destination IP addresses of each normal IP level message. At a device receiving a message, standard supervision procedures then monitor if and what messages arrive on its network A and on its network B.

Fig.2 is a table enumerating the 16 possible failure situations of a particular link or path between a supervised and a supervising device as defined by combining wrong port connections at the supervisory device with wrong port connections at the supervised device (columns 2 to 5). It is assumed that a complete disconnection of a cable at either one of the devices is detected by other means, e.g. by the end-end supervision of the communication link. Columns 6 and 7 show the resulting error rates errA, errB per receiving port at the supervising device defined as the ratio of the messages received via a wrong network to the total number of messages received from the supervised device. The connect status conA, conB (columns 8 and 9) indicates if any messages from the supervised device arrive at all at the respective port. As shown in the ultimate column, the combination of error rate and connect status allows identifying 10 distinct signatures for the 16 failure situations. Of these, only the signatures numbered 1, 2, 8 and 9 are unambiguously assignable to a single failure situation.

An error rate as reported in Fig.2, i.e. the ratio of erroneous to all messages for a particular port, in theory adopts one out of at least three values (0, 50, 100). In reality the resulting rate, as an average of a plurality of error events related to individually received messages, will fluctuate about these values due to temporary transmission errors, therefore appropriate error thresholds (e.g. <25, 25-75, >75) defining respective probability zones are set. The actual error rates are then compared to these error thresholds in order to identify a signature.

In order to distinguish the remaining ambiguous signatures and identify the underlying failure situations, the results of several, i.e. at least two, supervised devices are compared at the supervising device. If they all indicate a wrong connection at the supervising device, i.e. by displaying the same or a comparable non-zero errA or errB rate, then the failure is with high probability at the supervising device. If there is a supervised device with error rate 0 and connect status 1 at a particular port, and another supervised device exhibits a higher error rate, then the failure is assumed to be at said another supervised device. This allows discriminating the signatures numbered 3, 4, 5, 6 and 7 as well as the first and last failure situation, the result being unambiguous and corresponding to the actual situation with a high probability. If required, accuracy can always be increased by including failure situations from still further communication paths linking a supervising and a supervised device.

In terms of Substation Automation (SA), each Intelligent Electronic Device (IED) redundantly connected to the communication networks is either a supervising IED (e.g. a bay level IED for protection and control at the bay level) or a supervised IED (e.g. a station level IED). The corresponding functionality is part of the SA configuration data as comprised in a Substation Configuration Description (SCD) or a Configured IED Description (CID) file. The latter files are encoded in a Standardized Configuration description Language (SCL) based on an XML schema according to the IEC 61850 standard for substation communication. Configuration data related to individual IEDs and comprising their addresses, their physical connection to the communication network A or B, the application functions and their supervision capabilities is directing the configuration of the IED by a system engineering tool. Typically, each bay level IED is automatically configured to supervise between 3 to 5 station level (supervised) IEDs and to appropriately disseminate the resulting decisions related to improper cabling.

LIST OF DESIGNATIONS

1 to 5 Devices in an industrial communication or control system

A, B Redundant communication networks IA to 5 A Device ports assigned to network A

IB to 5B Device ports assigned to network B

Claims

PATENT CLAIMS

1. Method of identifying improper cabling of devices (1 - 5) connected to redundant industrial communication networks (A, B), comprising

- establishing, by a receiving device (3), a first connect status (conA, conB) depending on whether or not a receiving port (3 A, 3B) of the receiving device (3) does receive a message from a first sending device (1),

- receiving, via a receiving port (3 A, 3B) of the receiving device (3), a message from the first sending device (1), and establishing a first error event depending on whether or not an identifier (A, B) of the receiving port does match a network identifier (A, B) of the received message, characterized in that the method comprises

- establishing, by the receiving device (3), a second connect status (conA, conB) depending on whether or not a receiving port (3 A, 3B) of the receiving device (3) does receive a message from a second sending device (2),

- receiving, via a receiving port (3 A, 3B) of the receiving device (3), a message from the second sending device (2), and establishing a second error event depending on whether or not an identifier (A, B) of the receiving port does match a network identifier (A, B) of the received message, and

- identifying an improper cabling at the receiving device (3) and/or one of the sending devices (1, 2) based on the established first and second connect status (conA, conB) and error events.

2. The method according to claim 1, characterized in that it comprises - receiving, via the receiving ports (3 A, 3B) of the receiving device (3), a plurality of messages from the sending devices (1, 2),

- determining, for each receiving port, a first and second error rate (errAl, errB2) related to the number of error events established for the plurality of messages received from the first or second sending device, and - identifying an improper cabling at the receiving device (3) and/or one of the sending devices (1, 2) based on the determined error rates.

3. The method according to claim 2, characterized in that it comprises

- identifying an improper cabling at the receiving device (3) and/or one of the sending devices (1, 2) by comparing the error rates with error thresholds.

4. The method according to one of claims 1 to 3, characterized in that the redundant communication networks (A, B) are part of a Substation Automation (SA) system.

5. The method according to claim 4, characterized in that the receiving device (3) and the sending devices (1, 2) are configured as supervising and supervised Intelligent Electronic Devices (IED) by means of an IEC 61850 SCL configuration file.

6. A device (3) for identifying improper cabling of devices (1 - 5) connected to redundant industrial communication networks (A, B), comprising means for

- establishing a first and second connect status (conA, conB) depending on whether or not a receiving port (3 A, 3B) of the device (3) does receive a message from a first or second sending device (1, 2),

- receiving, via a receiving port (3A, 3B), a message from the first or second sending device (1, 2), and establishing a first or second error event depending on whether or not an identifier (A, B) of the receiving port does match a network identifier (A, B) of the received message, and

- identifying an improper cabling at the device (3) and/or one of the sending devices (1, 2) based on the established first and second connect status (conA, conB) and error events.

7. The device according to claim 6, characterized in that it is configured as a supervising Intelligent Electronic Device (IED) by means of an IEC 61850 SCL configuration file.

8. A computer program for identifying improper cabling of devices (1 - 5) connected to redundant industrial communication networks (A, B), which is loadable in and executable on a data processing unit and which computer program performs, when being executed by one or several communicating data processing units, the method according to one of claims 1 to 5.