RU2679739C1 - Automation system with dynamic functional architecture - Google Patents

Abstract

FIELD: network communication.SUBSTANCE: automation system with a dynamic functional architecture contains at least two Intelligent Electronic Devices (IED) interconnected through a communication network and made with the possibility of redistribution of functions among themselves on the basis of critical states identified in the automation system.EFFECT: improved system reliability and reduced hardware reserve.7 cl, 4 dwg

Description

FIELD OF TECHNOLOGY

The invention under consideration relates to the field of building automation systems based on a combination of (two or more) microprocessor-based intelligent electronic devices (Eng. “Intelligent Electronic Devices”, abbreviated - IED).

BACKGROUND

Known redundant automation system SIMATIC S7-400H [1] from the manufacturer Siemens (Germany). The indicated system consists of two identical hardware and software complexes mutually reserving each other. These complexes are interconnected by a data transmission channel for synchronization, ensuring synchronization of operations. The disadvantage of this system is the high hardware redundancy, characterized by a complete duplication of system components. Another disadvantage of the system is a significant decrease in the system availability factor in the event of failure of one of the software and hardware complexes that mutually reserve each other during the recovery period of the failed complex by operating personnel.

As a prototype is considered a substation automation system of high availability [2]. The system includes several intelligent electronic devices (IEDs) interconnected via a communications “station bus”. The system also includes at least one backup IED also connected to the communication “station bus”. The system [2] provides for the identification of inactivity (failures) of regularly functioning IEDs with the transfer of the configuration image of the inactive (failed) IED to the standby IED, with the perception of the standby IED of the received configuration and the subsequent functioning of the standby IED in the role of the previously inactive (failed) IED. In this case, the identification of the inactivity (failure) of the IED in the system is carried out by a dedicated IED manager (“IED manager”) connected to the IED through the communication “station bus”.

Within the framework of the system [2], it is possible to backup several IEDs of a system at once by means of one backup IED, which reduces the requirements for high hardware redundancy of the system. In addition, within the framework of the above system, a significant decrease in the coefficient of readiness to perform certain functions of the system in case of failure of one of the IEDs is excluded, since the functions of the failed IED are immediately transferred to the standby IED for execution automatically; it does not require waiting for the completion of the restoration (including, possibly, replacement from the spare set) of the failed IED by operating personnel

However, the disadvantage of the above prototype is the inability to transfer to the backup IED a partial configuration of the inactive (failed) IED, for example, only individual, critical functions, since it is possible to transfer the configuration only to the extent of the configuration of the whole IED, and, accordingly, the possibility of partial replacement of the backup configuration is excluded IED configuration of the device that has become inactive (it is possible only to completely replace the configuration of the backup IED configuration from azavshego device). Moreover, in the case when separate IED systems perform along with critical functions other less important functions (whose reliability is not very important), the failure of these IEDs will lead to the forced launch of less important functions on the backup IEDs, which in some cases can be considered as Redundant and, accordingly, unjustified use of hardware resources of the backup IED.

Another disadvantage of the above prototype [2] is that the identification of inactivity (failure) of the IED in the system is carried out by a dedicated central device - the “IED manager”, as well as the fact that the configuration of the IEDs, then downloaded to the backup IEDs, is also stored only on the specified device “IED manager”. At the same time, the IED manager device itself becomes a bottleneck in terms of the reliability of the entire system, causing the need to solve the reliability problem of the IED manager device itself.

SUMMARY OF THE INVENTION

The technical result of the application of the present invention is to increase the availability factor of the automation system while reducing the need for the amount of hardware reserve used in the system.

The proposed automation system is characterized in that it includes at least two intelligent electronic devices (IEDs) configured to perform automation functions and connected to each other via a communication network. In this case, unlike the prototype, IED systems are configured to detect critical conditions in the system according to the results of information interaction through a communication network with other IEDs in the system, where the list of critical conditions in the system includes the failure of at least one IED in the system . In addition, the IED systems are configured to perform operations coordinated with other IEDs in the redistribution of functions between the IEDs based on critical conditions identified in the automation system. At the same time, the above operations of the redistribution of functions coordinated with other IEDs include starting at least one automation function f ₁ in one of the IEDs of the system after the failure of another IED in the system that previously performed the above function f ₁ before the failure was detected.

In particular, at least one IED in an automation system may be configured to perform at least two different automation functions (e.g., f ₁ and f ₂ ), at least one of which (e.g., f ₁ ) at some point in time, it can remain in the specified IED in an inactive state, that is, it cannot be executed, and at some other moment of time, the specified function can be launched for execution.

The above technical result is achieved due to the fact that in the event of failure of individual IEDs in the system, it is possible to transfer the backup IED to perform not only the entire set of functions completely performed by the previously failed IED, but also individual functions of the failed IED, for example, only critical (from the point of reliability view) functions. This ensures a more optimal use of hardware (in particular, computing or computing and communication) resources of the backup IEDs, and thus, the need for the required number of backup IEDs used in the system is reduced. In addition, within the framework of the claimed invention, an additional increase in the system availability coefficient is provided due to the exclusion from the system of the central IED control device (in the prototype, the “IED manager” device), the functions of which are distributed among all IED systems in the framework of this invention (accordingly, The “IED manager” is no longer a bottleneck in terms of system reliability).

In the particular case of the invention, the list of critical conditions in an automation system may include, in addition to failures of individual IEDs in the system, events of the following nature:

- a failure (i.e., a failure that occurs for a short time and subsequently resolves itself) in at least one of the IEDs of the system;

- failure to perform at least one automation function in one of the IED systems;

- a significant overload of the computing and communication resources of one of the IED systems, including overloading the IED by the input and / or output communication traffic of the communication network and / or overloading the internal processor of the IED and / or filling the internal memory of the IED and / or the state of the internal memory of the IED close to filling.

The list of operations of the coordinated redistribution of functions between the IEDs in the system may additionally include:

- in the event of a failure of one of the IEDs or a significant overload of the computing and communication resources of one of the IEDs, the launch of all or part of the functions of the above IEDs on another IEDs;

- in the event of failure of the execution of at least one automation function in one of the IED systems, the launch of the specified functions, for example, in another IED system.

At the same time, since the above events can be regarded as precautionary states in the automation system, the corresponding performance of the redistribution of functions during these events reduces the likelihood of a subsequent real failure of the automation functions, which, thus, contributes to an additional increase in the reliability of the automation system.

Also, in addition to this, the IEDs in the system can be configured to both self-diagnose the current state and diagnose the current state of other IEDs in the system through information interaction through a communication network with other IEDs, which makes it possible to more reliably identify the above critical events regarded as pre-failure conditions, which further reduces the likelihood of a subsequent real system failure, and thus further increases the reliability of the systems automation.

In addition, the list of coordinated redistribution of operations may include stopping the execution of individual automation functions in the IED of the system, which may be necessary, for example, to reserve relay protection and automation functions in the automation system of an electrical substation, since the presence in the system several simultaneously executed instances of one and the same relay protection and control function potentially leads to an increase in the number of false relay protection operations, and, thus, to a decrease in the reliability of relay protection functions BUT.

In the particular case, the automation system may also further include a configuration workstation, controlled, in particular, by an operator, connected directly to the IED of the system or via a communication network. Moreover, the above workstation can be configured to perform settings in each of the IED systems:

- a list of automation functions performed by the IED;

- a list of automation functions that are in the inactive state of the IED system;

- a list of critical conditions in the automation system;

- criteria for identifying critical conditions in an automation system;

- settings of algorithms for performing operations of coordinated redistribution of functions in each of the IED systems.

In this particular case, high flexibility is provided for configuring the automation system.

In another particular case, at least one of the IEDs of the system may include a module for performing automation functions, a module for dynamic redistribution of functions, and a communication module, where the above three modules are paired together within the IED. At the same time, the communication module in the IED provides the connection of this IED to the communication network and information exchange with other IEDs of the automation system through the communication network. The automation function module of this IED is configured to perform the functions of the automation system and interact with other IEDs of the system through the communication module of the IED through the communication network in order to perform the functions of the automation system. The module of dynamic redistribution of functions of this IED is configured to:

- identification based on the results of information interaction with other IED systems through the communication module of this IED through a communication network of critical conditions in the automation system;

- performing operations of coordinated redistribution of functions between this IED and other IEDs in the system based on the critical redistribution of critical state functions detected by this module in the automation system.

In the aforementioned particular case, the rigid separation of functional tasks between the three modules in the IED allows these modules to be executed in a highly hardware independent manner. In particular, for example, each of these modules can be made on the basis of a separate set of electronic components, each of which contains, including, a separate computing core (microprocessor) and a separate memory (including both operational and possibly non-volatile). At the same time, the above separation of the module for performing automation functions and the module for dynamic redistribution of functions makes it possible to completely eliminate or minimize the effect of the performance of the operations of redistributing functions on the performance of the automation functions directly by the IED, thereby ensuring the reliability of the performance of the IED directly on the automation functions.

Similarly, the implementation of the IED communication module in the form of a single and highly hardware independent of the automation functions module and the dynamic redistribution of functions of this IED allows for a centralized ordered arbitration of communication messages transmitted by this IED to other IEDs in the system, including messages, transmitted in order to fulfill the functions of an automation system (i.e. messages initiated by a module for performing automation functions transmitted by another IED in a communication network), and messages broadcast by another IED to perform dynamic redistribution of functions in the system (initiated by the dynamic redistribution of IED functions). At the same time, the mutual influence, on the one hand, of information exchange between this IED and other IEDs of the system with the aim of performing dynamic redistribution of functions, and, on the other hand, of information exchange with the aim of fulfilling system automation functions, is eliminated (which allows you to save the system availability factor in comparison with the availability coefficient of a traditional automation system without dynamic redistribution of functions.

BRIEF DESCRIPTION OF THE DRAWINGS

In FIG. 1 is a diagram describing the general structure and functioning of the proposed automation system.

In FIG. 2 and FIG. Figure 3 shows diagrams describing an example algorithm for the mutual functioning of IED devices in the proposed automation system in the event of a failure of one of the IEDs, followed by the redistribution of one of the automation functions from the failed IED to one of the other regularly functioning IED systems.

In FIG. 4 is a diagram of an IED device as part of an automation system in one of the particular cases of the invention, where the above IED includes an automation function module (13), a dynamic redistribution of automation functions (14), and a communication module (15).

DETAILED DESCRIPTION OF THE INVENTION

The proposed automation system 1 (see. Fig. 1) is implemented and in general terms operates as follows. System 1 includes several intelligent electronic devices (IEDs) 2 ⁽¹⁾ , 2 ⁽²⁾ , ... 2 ^(N) (respectively, in Fig. 1 - N IEDs; in general, N can be any integer no less than 2). The indicated IEDs 2 ⁽¹⁾ , 2 ⁽²⁾ , ... 2 ^(N) are interconnected via a communication network 3.

Each of the IEDs 2 ⁽¹⁾ , 2 ⁽²⁾ , ... 2 ^{(N) is} configured to perform the functions of an automation system 4 and carry out information exchange 5 through a communication network 3 with other similar IEDs (from the set of many IEDs 2 ⁽¹⁾ , 2 ⁽²⁾ , ... 2 ^(N) ) - note: hereinafter, when specifying an arbitrary IED from the whole set of IEDs 2 ⁽¹⁾ , 2 ⁽²⁾ , ... 2 ^(N), the subscript can be omitted, accordingly, IEDs can be denoted simply by the Arabic numeral “2”) to ensure that the automation system functions. In addition, each of IED 2 ⁽¹⁾ , 2 ⁽²⁾ , ... 2 ^{(N) is} configured to:

- identification of critical conditions in the automation system (pos. 6 in Fig. 1) according to the results of information interaction (pos. 7) through a communication network 3 with other IED 2;

- performing operations coordinated with other IED 2 redistribution of functions (pos. 8 in Fig. 1) between this IED and other IED 2 in the system based on critical conditions identified in the automation system, where the above operations 8 are carried out through information interaction (pos. 9) with other IEDs 2 via communication network 3.

Automation system 1 may be, for example, an automation system of an electrical substation. In this case, the automation functions performed by IEDs 2 (item 4 in Fig. 1) can be, for example, the relay protection and control functions of a substation switchgear, emergency automation functions, electrical measurements, electricity metering, etc.

In addition, system 1 can be an automation system in any other industry, based on a set of automatic electronic devices connected by a data transmission network. At the same time, the automation functions performed by IEDs 2 (item 4 in Fig. 1) in the industrial automation system (production automation) can be, for example, the functions of controlling individual actuators at the facility, the functions of measuring electrical quantities, etc. P.

As the communication network 3 can be used, for example, an Ethernet network (IEEE 802.3), a network based on an asynchronous interface (e.g.
RS-485), CAN (Contrtoller Area Network), Profibus, wireless network, e.g. Wi-Fi (IEEE 802.11), etc.

If system 1 is an automation system of an electrical substation, an Ethernet network (IEEE 802.3) can be used as a communication network, while
exchange 5 (see Fig. 1) between IEDs 2 through a communication network 3 to ensure the implementation of automation functions in system 1 can be carried out, for example, through communication protocols that comply with IEC 61850 group standards (including IEC 61850-8- 1, including GOOSE and MMS, and IEC 61850-9-2). In this case, information exchange 5 may include transmitting relay protection relay signals (eg, in GOOSE message format), transmitting blocking signals of switching devices (for example, disconnectors) between IEDs of cells of various substation connections, transmitting primary measurement data in IEC format 61850-9-2, etc.

In a more general case (for example, in automation systems in other industries), information exchange 5 between IEDs 2 through in system 1 can be carried out, for example, via Modbus protocols; EtherCAT or Profinet (when using an industrial Ethernet network); CANbus, CANopen or DeviceNet (when using a CAN data network).

As critical conditions in system 1, detected (item 6 in Fig. 1) by IEDs 2 ⁽¹⁾ , 2 ⁽²⁾ , ... 2 ^(N) , failures of individual IEDs 2 may appear. These failures can be detected in a system, for example, as follows. Each of the IEDs in system 1 sends to the other IEDs 2 through the communication network 3 (within the framework of information interaction 7) periodic messages (for example, in the case of an automation system for electrical substations, these can be GOOSE or MMS messages in accordance with IEC 61850-8-1 ) transmitted over the Ethernet communication network 3), confirming to other IEDs that this IED is functioning properly. In the event of an IED failure (including a shutdown of the IED due to a power outage, an internal program freezing, failure of any critical hardware component of the IED, etc.), the IED ceases to transmit the above periodic messages to the other IEDs. The fact that other IEDs in the system record the sudden loss of periodic messages from the above IED is regarded by other IEDs as the current failure of the above IED. In this case, if IEDs 2 identify a critical state in system 1, in particular, the above-described failure of one of the IEDs, the above-mentioned IEDs 2 perform operations of coordinated redistribution of functions (item 8 in Fig. 1). In particular, if one of the IEDs fails, at least one of the automation functions performed by the previously failed IEDs (for example, f ₁ - see Fig. 2) is started for execution in another IED system that is currently functioning normally. At the same time, the algorithm for selecting a specific IED (or IEDs) in the system that takes over (taking) the functions of the failed IED can be determined, for example, in one of the following ways:

1) A specific IED or a list of IEDs that take over the functions of a specific failed IED in system 1 is selected when the system is configured by personnel (for example, commissioning or operational personnel of the automation object) - for this purpose, system 1 may additionally include including a configuration workstation 10 for performing system configuration.

2) The choice of a specific IED (IED), taking over the functions of the failed IED, is determined by the IEDs of the system together through the information interaction of the IEDs with each other (item 9 in Fig. 1) and automatically based on specialized internal selection algorithms defined in each IED. These selection algorithms can provide, for example, the selection of one of several IEDs, which at the given time is the least loaded computing resources (processor, internal memory) or, for example, the least loaded communication interfaces of the IED with communication network 3, or maybe according to some other selection criteria. The above algorithms can also be set (configured) when configuring the system by personnel, including connecting a configuration workstation 10 to the system (see Fig. 1).

In FIG. 2 illustrates the execution scenario in the considered automation system 1 of a coordinated redistribution of automation functions in case of failure of one of the IEDs of the system (in FIG. 2 - IED 2 ⁽⁴⁾ ) and launching at least one automation function that previously functioned in the failed IED, in another normally functioning IED system. In this scenario, the three IEDs (2 ⁽²⁾ , 2 ⁽³⁾ and 2 ⁽⁴⁾ ) of the automation system perform four automation functions: f ₁ , f ₂ , f ₃ and f ₄ , where the function f ₁ is critical with reliability points of view, and the functions f ₂ , f ₃ and f ₄ are less critical. Moreover, the function f ₁ in the system under consideration is located in all 3 IEDs 2 ⁽²⁾ , 2 ⁽³⁾ and 2 ⁽⁴⁾ , and in IED 2 ^{(4), the} function f ₁ is in the active state (it is normally started and performed), and in IEDs 2 ⁽²⁾ and 2 ^{(3), the} specified function is in an inactive state. In FIG. 2 f ₁ ^(k) (k = 2, 3 or 4) - denotes an instance of the same automation function f ₁ located in the corresponding IED-e 2 ^(k) . If one of the IEDs fails, for example, 2 ⁽⁴⁾ (see Fig. 2), the function f _{1 is} restarted to run on another functioning IED from among the IEDs 2 ⁽²⁾ , 2 ⁽³⁾ . In this case, the failure of IED 2 ^{(4) is} detected by other IEDs 2 ⁽²⁾ , 2 ⁽³⁾ , for example, by the loss of receipt of periodic messages 7 from IED 2 ⁽⁴⁾ (see Fig. 2), confirming the fact of the current normal functioning IED 2 ⁽⁴⁾ . In case of failure of the IED, for example, 2 ⁽⁴⁾ , the remaining IEDs perform a coordinated redistribution of functions 8, namely that the function f _{1 is} launched for execution on one of 2 ⁽²⁾ or 2 ⁽³⁾ . In this case, on which specific IED of the IEDs 2 ⁽²⁾ or 2 ^{(3) the} function f ₁ will be restarted to perform, it is determined by the IEDs 2 ⁽²⁾ and 2 ⁽³⁾ together based on the results of information interaction 9 between the indicated IEDs based on internal selection criteria defined in each of devices 2 ⁽²⁾ and 2 ⁽³⁾ . In particular, in FIG. 2 example, IEDs 2 ⁽²⁾ and 2 ⁽³⁾ together automatically selected IED 2 ⁽³⁾ , respectively, the function f _{1 is} restarted to run in IED 2 ⁽³⁾ (item 11 in Fig. 2). In this case, in the event of an IED 2 ⁽⁴⁾ failure, the f ₄ function performed before the IED 2 ⁽⁴⁾ failure does not restart on other regularly functioning IEDs in the system, since the f ₄ function is assumed to be low priority. In the case of automation of an electrical substation, the function f ₁ can be, for example, the relay protection and distribution function of the power distribution, and the functions f ₂ , f ₃ and f ₄ can be, for example, the functions of electrical measurements of operating parameters, electricity metering and measurements of electric power quality indicators, respectively.

In FIG. 3 illustrates an option for the subsequent development of events. The possible failure of yet another IED (e.g., 2 ⁽³⁾ ) is considered in addition to the previously encountered failure in IED 2 ⁽⁴⁾ in FIG. 2. The embodiment of FIG. 3 is identical to the scenario with two IEDs (2 ⁽²⁾ and 2 ⁽³⁾ ), in which these IEDs fulfill three automation functions: f ₁ , f ₂ , and f ₃ , where the function f ₁ is critical from the point reliability, and the functions f ₂ and f ₃ are less critical. Function f ₁ is located in 2 IEDs 2 ⁽²⁾ and 2 ⁽³⁾ (see Fig. 3), moreover, in IED 2 ^(3), function f ₁ is in an active state (it is normally started and executed), and IED 2 ⁽²⁾ - inactive. If IED 2 ⁽³⁾ fails, function f ₁ restarts to run on IED 2 ⁽²⁾ . In this case, the failure of IED 2 ^{(3) is} detected by IED 2 ⁽²⁾ , for example, by the loss of periodic messages 7 from IED 2 ⁽³⁾ (see Fig. 3), confirming the fact of the current normal functioning of IED 2 ⁽³⁾ . In the event of a failure of IED 2 ⁽³⁾ , IED 2 ⁽²⁾ performs the redistribution of functions 8, which consists in starting the function f ₁ (pos. 12 in Fig. 3).

In a more general case, the system may include a larger number of IEDs and, accordingly, redundant automation functions than are shown in the examples in FIG. 2 and 3.

As shown in FIG. 2 and FIG. 3 examples of system implementation eliminates any need for a separate hardware reserve, because hardware reserve (IED-devices) is ensured by regular IED-devices of the system, which perform the basic functions of the system, but the system refuses to perform critically less important functions (redundancy of which is not required). In this case, a slight additional introduction to the system of hardware reserve (IED-devices) allows you to further significantly increase the availability factor of the system.

In addition, since the functions of the central “IED manager” device (devices from the prototype) are actually distributed between all IED devices of the system, with an increase in the number of IED devices in the system, the problem of the “IED manager” device as a system bottleneck is minimized, and thus, the system availability factor is further enhanced. Thus, the achievement of the claimed technical result of the invention is achieved.

In the claimed automation system in terms of redundancy of individual automation functions, it is possible to have the same automation function (currently active) launched for execution simultaneously on two, or possibly more than two IED 2 systems.

Each of the devices 2 in the system 1 can be made on the basis of a hardware platform that includes a microprocessor and memory (operational and / or non-volatile), as well as communication interfaces of the corresponding type for connecting to a communication network 3

In the particular case, at least one of the IED 2 (see Fig. 4) of the system can be performed with a module 13 for performing automation functions, a module 14 for dynamic redistribution of automation functions and a communication module 15, where the above three modules are paired with each other.

In this case, the module 15 provides the connection of IED 2 to the communication network 3, and information exchange with other IEDs in the system through the communication network 3, including information exchange 5 in order to ensure that these IEDs perform automation functions together with other IEDs in the system, and information exchange in order to perform redistribution of functions in the automation system, including:

- information exchange 7 with other IEDs in order to identify critical conditions in the automation system;

- information exchange 9 with other IEDs in order to perform operations of dynamic redistribution of functions between this IED and other IEDs in the system.

The module 13 for the implementation of automation functions provides the performance of 4 functions of the automation system and initiates information exchange 5 with other IEDs of the automation system through the communication module 15 in order to ensure the implementation of the functions of the automation system.

The module of dynamic redistribution of functions 14 provides:

- identification of critical conditions in the automation system 6;

- performing operations coordinated with other IEDs in the redistribution of functions (pos. 8 in Fig. 4) between this IED and other IEDs based on critical conditions identified in the automation system.

Moreover, each of the modules 13 and 14 can be made separately from the other in the form of a set of interconnected electronic components, including a microprocessor, memory blocks (operational and / or non-volatile), etc.

Similarly, module 15 can be performed on the basis of a separate computing core (microprocessor), which performs its functions independently of module 13 and from module 14, and provides information data switching between communication network 3 and each of modules 13 and 14 separately.

INFORMATION SOURCES

1. “SIMATIC Automation System S7-400H Fault-tolerant Systems. Manual ”/ A5E00068197-07, 07/2006 (Order number: 6ES7988-8HA11-8BA0) (SIMATIC S7-400H automation system manual: 07/2006 edition, manufacturer’s order number: 6ES7988-8HA10-8BA0).

2. US Patent No. US 7882220, IPC G06F 15/173, 2011

Claims (7)

1. An automation system with a dynamic functional architecture, comprising at least two intelligent electronic devices (IEDs) configured to perform automation functions and interconnected via a communication network, characterized in that the above IEDs are configured to detect critical conditions in automation system based on the results of information interaction through a communication network with other IED systems, where the list of critical conditions in the system includes failure of at least one IED in the system, and with the possibility of performing operations of coordinated redistribution of functions between the IEDs of the system based on critical conditions identified in the automation system, where operations of coordinated redistribution of functions between the IEDs of the system include starting at least one automation function f ₁ in one of the IEDs of the system after the failure of another IED in the system that previously performed the above function f ₁ before the failure was detected. 2. The automation system according to claim 1, characterized in that at least one IED in the system is configured to perform at least two different automation functions, at least one of which may be inactive in the IED at some point in time state, that is, not executed, and at some other point in time to run in the specified IED. 3. The automation system according to claim 1, characterized in that the list of critical conditions in the system includes a failure in at least one of the IEDs of the system, or failure to perform at least one automation function in one of the IEDs of the system, or a significant overload of computing - communication resources of one of the IED systems, including overloading the IED by the input and / or output communication traffic of the communication network and / or overloading the internal processor of the IED and / or filling the internal memory of the IED and / or the state of the internal memory of the IED, bl viscous to filling, the operation between the agreed redistribution IED functions in the system include starting to perform at least one automation functions in one IED after the detection system corresponding critical condition in the system. 4. The automation system according to claim 3, characterized in that the IED systems are configured to both self-diagnose the current state and diagnose the current state of other IEDs in the system by means of information interaction with other IEDs through the communication network, and IED systems are configured to identify critical conditions in the automation system based on the results of self-diagnosis of the current state and diagnostics of the current state of other IEDs in the system. 5. The automation system according to claim 1, characterized in that the operations of the coordinated redistribution of functions include stopping the execution of individual automation functions in the IED system. 6. The automation system according to claim 1 or 2, characterized in that it further includes a configuration workstation connected to the IED of the system directly or via a communication network, configured to configure in each IED a list of automation functions performed by the IED, a list of automation functions in an inactive state, a list of critical states in an automation system, criteria for identifying critical states in an automation system, and also with the ability to configure neniya operations coordinated reallocation of functions. 7. The automation system according to claim 1, characterized in that at least one of the IED systems comprises a module for performing automation functions, a module for dynamic redistribution of functions and a communication module, where the above three modules are paired with each other, while the communication module provides connecting the IED to the communication network and exchanging information with other IEDs of the automation system via the communication network, and the module for performing automation functions is configured to perform system functions we automate and interact with other IED systems through the IED communication module through the communication network in order to perform the functions of the automation system and the dynamic redistribution module is configured to identify critical conditions in the automation system and the results of information interaction with other IED systems through the communication module through the communication network with the ability to perform operations of coordinated redistribution of functions between this IED and other mi IED automation system based on identified critical conditions in the automation system.

Images