Process control interface system having triply redundant remote field units

• US 5,428,769 A
• Filed: 03/31/1992
• Issued: 06/27/1995
• Est. Priority Date: 03/31/1992
• Status: Expired due to Fees

• Current Assignee: The Dow Chemical Company (Dow, Inc.)
• Original Assignee: The Dow Chemical Company (Dow, Inc.)
• Inventors: Grai, Timothy J., Hoy, Robert S., Fernandez, G. Paul, Glaser, Robert S.
• Primary Examiner(s): Beausoliel, Jr., Robert W.
• Assistant Examiner(s): Decady, Albert
• Application Number:
  US07/864,931
• Time in Patent Office: 1,183 Days
• Field of Search: 395/575, 371/68.3, 371/8.2, 371/15.1, 371/36, 364/228.3, 364/269.1, 364/268.9, 364/242.6, 340/825.06
• US Class Current: 700/4
• CPC Class Codes: G05B 19/0425 Safety, monitoring
• CPC Class Codes: G05B 2219/14123 Majority voting, dynamic redundant, persistency and integrity
• CPC Class Codes: G05B 2219/24184 Redundant I-O, software comparison of both channels
• CPC Class Codes: G05B 2219/24187 Redundant processors run identical programs
• CPC Class Codes: G05B 2219/24189 Redundant processors monitor same point, common parameters
• CPC Class Codes: G05B 2219/24192 Configurable redundancy
• CPC Class Codes: G05B 2219/25428 Field device
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems

Abstract

A process control interface system having a network of distributed triply redundant input/output field computer units. The system includes a plurality of self-contained remotely located triply redundant field computer units connected to decision making redundant process control computers through a bi-directional communication network having at least two concurrently active communication channels. Each of the field computer units include a set of at least redundant field computers for arbitrating both input and output signals. The input arbitration method enables a plurality of selectable default input conditions, such as select HIGH and select LOW, in the event that a majority agreement cannot be reached among valid input signals. The output arbitration method includes a plurality of selectable default output conditions, such as fail SAFE and fail LAST. Each of the default input and output conditions may be rapidly adjusted through software selection. The field computer units also include individual abort circuits for each output signal to be transmitted to a device which affects the operation of the physical process. These abort circuits effectively enforce the output value signals arbitrated independently through each of the three redundant field computers using a voting procedure.

Claims

1. In a process control system having process computer means for making process control decisions which affect a physical process, a distributed interface system, comprising:

a plurality of self-contained remotely located triply redundant computer units connected to said computer means through a communication network having at least two active bi-directional communication channels, each of said triply redundant computer units including

means for receiving raw analog and digital input signals from sensors associated with said physical process,

means for arbitrating each of said input signals.

means for transmitting said arbitrated input signals to said process computer means via said network,

means for receiving output value signals from said process computer means, means for providing independent triply redundant arbitration of said output value signals received from said process computer means, and

means for processing each of said triply redundantly arbitrated output value signals through a set of individual abort circuits which are connected to a device associated with said physical process, such that each of the outputs from the set of abort circuits for a particular arbitrated output value signal are coupled together to provide a common output to a device associated with said physical process and allowed to drive said device unless specifically inhibited.

2. The invention according to claim 1, wherein said means for providing arbitration of said output value signals includes a plurality of software selectable default conditions.

3. The invention according to claim 1, wherein said network includes controller means for individually changing a direction of communication signal flow on at least one signal distribution level over each of said communication channels.

4. The invention according to claim 3, wherein said network includes a plurality of interconnected breakout circuits for directing bi-directional serial communications between said process computer means and each of said triply redundant computer units.

5. The invention according to claim 4, wherein a first of said breakout circuits is connected to said process computer means to direct communication from said process computer means to predetermined groups of said triply redundant computer units, and a plurality of second breakout circuits are connected to said first breakout circuit to direct communication to specific triply redundant computer units, each of said second breakout circuits being connected to a plurality of said triply redundant computer units.

6. The invention according to claim 5, wherein each of said breakout circuits includes means for enabling any of said breakout circuits to be configured as first or second breakout circuits.

7. The invention according to claim 6, wherein each of said breakout circuits includes means for enabling any of said breakout circuits to repeat received signals at a predetermined signal strength.

8. The invention according to claim 1, wherein said network includes means for broadcast downloading of updated software from said process computer means to a plurality of said triply redundant computer means through said network.

9. The invention according to claim 3, wherein each of said communication channels forms a physical fiber optic ring connected to said process computer means on a first level of signal distribution for said network.

10. In a field computer unit,

a set of at least three redundant computers,

means associated with said redundant computers for receiving and independently arbitrating analog and digital signals for each input and output channel of said field computer unit, and

means for processing said independently arbitrated output signals from each of said redundant computers through a set of output circuits associated with each of said output channels, each output circuits associated with each of said output channels, each of said output circuits having abort means for preventing the transmission of a field output value signal from one of said redundant computers to a process control device connected to said output circuits, wherein each of said redundant computers transmits an output signal value to one of said abort circuits in said set of abort circuits for each of said output channels, and each of said redundant computers also transmits a individual abort signal value to any remaining abort circuits in said set of abort circuits for each of said output channels.

11. The invention according to claim 10, including dedicated neighbor to neighbor communication means between each of said redundant computers for enabling any two of said redundant computers to hold the remaining redundant computer in a reset condition.

12. The invention according to claim 10, wherein each of said redundant computers includes a computer processor and serial input circuit means for enabling said computer processor to receive serial input signals from a plurality of analog and digital signal sources over a single conductor, including individual neighbor communication signals from each of the other of said redundant computers.

13. The invention according to claim 10, wherein each of said output circuits includes an individual abort circuit for each of said output channels, output conductors for each of said individual abort circuits for a particular output channel being connected together so that a set of at least three individual abort circuits are provided for each process control device.

14. The invention according to claim 10, wherein said arbitration means includes a plurality of software selectable default input and output conditions.

15. The invention according to claim 10, further including at least one analog output circuit interposed between each of said redundant computers and one of said abort circuits, each of said analog output circuits having self-regulating means for causing an arbitrated analog output signal to reach a desired output level commanded by the redundant computer for said analog output circuit in a manner which is independently determined by said self-regulating means.

16. The invention according to claim 10, further including at least one analog input circuit for each of said redundant computers, each of said analog input circuits having selectable mode means for reporting a plurality of different input pulse signals over a predetermined time period, said selectable mode means including a first mode for reporting a pulse count and a second mode for reporting an average frequency value.

17. The invention according to claim 10, wherein each of said output circuits includes means for permitting said redundant computers to perform non-intrusive testing of said output circuits.

18. A method of controlling an analog device from a field computer system having at least three redundant computers, comprising the steps of:

providing an analog output circuit for each of said redundant computers whose output signals are coupled to a common control input of said analog device;

independently determining at each of said analog output circuits whether a summed output of said analog output circuits sent to said analog device deviates from an analog level of their control input to said analog device by a predetermined limit;

any of said analog output circuits finding such a deviation independently forcing their analog outputs to a level which does not enable it to contribute to the analog level supplied to the control input to said analog device;

determining if more than one of said analog output circuits have forced their analog output signals to said non-contribution level; and

if more than one of said analog output circuits have forced their analog output signals to said non-contribution level, then restoring the analog output signals of such analog output circuits to the level commanded by their respective redundant computers, and forcing the analog output signal of a remaining analog output circuit to said non-contribution level.

19. The invention according to claim 18, wherein said non-contribution level is a substantially zero output level.

20. The invention according to claim 18, wherein each of said analog output circuits independently makes said determination of whether it is generating an analog output signal whose level deviates beyond said predetermined limit.

21. The method according to claim 20, wherein each of said analog output circuits periodically performs a non-intrusive testing procedure which includes the step of:

forcing its analog output to at least one testing level which does not enable the analog output circuit to materially contribute to the analog level of the control input to said analog device;

determining if its analog output signal has achieved said testing level; and

restoring its analog output signal back to the level commanded by its redundant computer.

22. A method of controlling a physical process with substantial tolerance to faults, comprising the steps of:

receiving a plurality of raw analog and digital signal inputs from sensors associated with said physical process at a field unit, said field unit having a set of at least three redundant field computers for converting at least some of raw said input signals into arbitrated input value signals at predetermined times,

concurrently transmitting at least some of said arbitrated input value signals to a set of redundant process computers over a plurality of bi-directional communication channels,

concurrently transmitting output value signals from at least two of said redundant process computers to said field unit over said plurality of communication channels,

independently arbitrating said output value signals at each of said redundant field computers such that each of said redundant field computers generates an individual arbitrated output signal for each of said output value signals received by said field unit,

processing said arbitrated output signals through an output enforcement arrangement which allows each of said arbitrated output signals to drive a common process control device unless the transmission of at least one of said arbitrated output signals to said process control device is specifically inhibited.

23. The method according to claim 22, wherein each of said redundant field computers includes an analog output circuit which compares its arbitrated analog output signals with the analog output signals actually transmitted to each process control device, and if a deviation beyond a predetermined limit is detected by one of said analog output circuits, then said analog output circuit will force its arbitrated analog output signal to a non-contribution level.

24. The method according to claim 22, wherein any two neighboring redundant field computers are capable of inhibiting the transmission of the arbitrated output signals of a third of said redundant field computers.

25. The method according to claim 24, wherein said output enforcement arrangement includes a set of abort switches for each arbitrated output signal of a redundant field computer, each of said abort switches being controlled by a neighboring redundant field computer, such that a combined opening of said abort switches for a specific output channel operates to inhibit the transmission of the arbitrated output signal for that output channel.

26. The method according to claim 25, including a step of opening the abort switches for any output channel which has an arbitrated output value of zero.

27. The method according to claim 25, wherein any of said redundant field computers is capable of requesting that its neighboring redundant field computers open their abort switches for at least one of said output channels.

28. A method of processing input and output signals in a field computer unit having at least three redundant computers, comprising the steps of:

arbitrating a plurality of corresponding input data signals independently at each of said redundant computers by majority voting and employing one of a plurality of predetermined software selectable input value conditions in the event that a majority agreement cannot be reached among corresponding input signals; and

arbitrating a plurality of corresponding output data signals independently at each of said redundant computers by majority voting and employing one of a plurality of predetermined software selectable output value conditions in the event that a majority agreement cannot be reached among corresponding output signals.

29. The method according to claim 28, including steps of validating said input and output data signals, and permitting only valid data signals to be arbitrated.

30. The method according to claim 28, wherein said software selectable input value conditions include a Select-High condition and a Select-Low condition.

31. The method according to claim 28, wherein said software selectable output value conditions include a Fail-Safe condition and a Fail-Last condition.

32. The method according to claim 28, wherein said software selectable input and output value conditions may be changed with each process control cycle.

33. The method according to claim 28, including the steps of subjecting pairs of corresponding analog input data signals to at least one tolerance test, and permitting the arbitration of only those analog input data signals which pass said tolerance test.

34. The method according to claim 33, wherein pairs of corresponding analog input data signals are subjected to both a wide and narrow tolerance test, passing of said narrow tolerance test being required to qualify corresponding analog input data signals for arbitration during an initial process control cycle, and passing of said wide tolerance test being required to continue qualifying corresponding analog input data signals for arbitration during a subsequent process control cycle.

35. The method according to claim 28, wherein a difference value is determined between each of the corresponding analog input signals, and corresponding difference value for an immediately preceding process control cycle is summed to the arbitrated analog input value for the current process control cycle.

36. The method according to claim 31, wherein the analog output value closest to a last arbitrated analog output value will be selected during a Fail-Last condition.

37. The method according to claim 28, wherein a signal indicative of a specific disagreement between both corresponding input and output data signals will be generated.