Voter logic block including operational and maintenance overrides in a process control system

• US 7,130,703 B2
• Filed: 04/08/2003
• Issued: 10/31/2006
• Est. Priority Date: 04/08/2003
• Status: Active Grant

• Current Assignee: Fisher-Rosemount Systems Incorporated (Emerson Electric Company)
• Original Assignee: Fisher-Rosemount Systems Incorporated (Emerson Electric Company)
• Inventors: Law, Gary, Stevenson, Dennis, Ott, Michael G., Sherriff, Godfrey, Havekost, Robert
• Primary Examiner(s): PATEL, RAMESH B
• Application Number:
  US10/409,576
• Publication Number:
  US 20040255013A1
• Time in Patent Office: 1,302 Days
• Field of Search: 700 18- 20, 700/23, 700/21, 700/79, 700/80, 700/81, 700/82, 700/86, 700/87, 714/1, 714/100, 714/51, 714/39, 714/25, 709/221, 709/203, 709/208, 702/108, 702/188, 702/189
• US Class Current: 700/80
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems

Abstract

A voter function block, which can be integrated into a function block diagram programming environment in a process plant control or safety system, implements voter logic in conjunction with providing operational and maintenance overrides which may be set to override individual inputs to the voter function block as well as to override the output of the voter function block. The voter function block, which is easy to create, use, test, debug and document, includes one or input limit detection units which detect if a particular redundant input has reached a specified limit indicating a condition within the process plant, an override unit that may be set by a user to override the consideration of that input in the voting function, a voting logic entity that determines if a trip condition exists based on the values of the valid or non-inhibited inputs, and an inhibit block that may used to override the output of the voter logic block during, for example, a startup or other operational condition. The voter function block may be integrated into a process control or safety system by being communicatively connected to other function blocks, such as to analog or digital input function blocks, analog or digital output function blocks, control function blocks, cause and effect function blocks which implement cause and effect logic, etc. Within the process control or safety programming environment.

Claims

1. A function block entity for use in a process plant having a processor communicatively coupled to control one or more field devices, the function block entity comprising:

a computer readable medium; and

a function block stored on the computer readable medium and adapted to be executed on the processor, the function block including;

a set of inputs, each input adapted to receive an input signal from within the process plant indicating a process condition;

a limit detection unit associated with each of the set of inputs, wherein each limit detection unit produces a limit signal indicative of whether the input signal at the associated input meets a trip criterion;

an output adapted to provide a trip signal;

a voter logic block coupled between the limit detection units and the output, the voter logic block adapted to apply voter logic to the limit signals to produce the trip signal as a tripped value at the output when a particular number of the input signals meet the trip criterion and to produce the trip signal as a normal value at the output when the particular number of the inputs signals do not meet the trip criterion; and

an override block adapted to prevent the use of at least one of the set of inputs by the voter logic block or to override the trip signal developed by the voter logic block at the output.

2. The function block entity of claim 1, wherein the override block is an input inhibit block that prevents the use of one of the set of inputs by the voter logic block.

3. The function block entity of claim 2, wherein the override block includes an override time parameter that specifies a first amount of time for which use of the one of the set of inputs by the voter logic block is to be prevented.

4. The function block entity of claim 3, wherein the override block includes a reminder time parameter that specifies a second amount of time prior to the expiration of the first amount of time at which a reminder signal is to be created, the reminder signal indicating the future expiration of the first amount of time.

5. The function block entity of claim 1, wherein the override block includes an input inhibit block for each of the set of inputs, wherein each inhibit block can be set separately to prevent the use of a different one of the set of inputs by the voter logic block.

6. The function block entity of claim 1, wherein the override block comprises an operational override that can be set to prevent the tripped value of the trip signal from being delivered to the output.

7. The function block entity of claim 6, wherein the override block includes a timer that tracks the time of the operational override and that times out after a predetermined time period to allow the tripped value of the trip signal to be delivered to the output.

8. The function block entity of claim 6, wherein the override block is adapted to detect when the voter logic block develops a value for the trip signal that is stable for a predetermined amount of time and that allows the trip signal value to be delivered to the output after detection that the trip signal value has been stable for the predetermined amount of time.

9. The function block entity of claim 6, wherein the override block includes an event detection parameter and uses the event detection parameter to allow the tripped value of the trip signal to be delivered to the output when the event detection parameter indicates that an event is either one of present or absent.

10. The function block entity of claim 1, wherein the override block includes an input inhibit block for each of the set of inputs, wherein each input inhibit block can be set separately to prevent the use of one of the set of inputs by the voter logic block and further includes an operational inhibit block that can be set to override the voter logic block by setting the tripped signal at the output to the normal state.

11. The function block entity of claim 1, wherein the voter logic block includes an M out of N voter logic scheme in which N is the number of inputs being considered and M is the number of limit signals that must indicate the trip criterion is met for the voter logic block to detect the existence of a trip condition and to set the trip signal to the tripped value.

12. The function block entity of claim 11, wherein the override block is an input inhibit block that prevents the use of one of the set of inputs by the voter logic block and wherein the voter logic scheme reduces the number of inputs N being considered when the one of the set of inputs is overridden but keeps the number of limit signals M the same when the one of the set of inputs is overridden.

13. The function block entity of claim 11, wherein the override block is an input inhibit block that prevents the use of one of the-set of inputs by the voter logic block and wherein the voter logic scheme reduces both the number of inputs N and the number of limit signals M in the voter logic scheme when the one of the set of inputs is overridden.

14. The function block entity of claim 11, wherein one of the input signals includes a status parameter and a value parameter and wherein one of the limit detection units uses the status parameter to decide how to treat the value parameter of the one of the input signals.

15. The function block entity of claim 14, wherein the one of the limit detection units automatically treats the one of the input signals with a bad status parameter as an input signal that meets the trip criterion.

16. The function block entity of claim 14, wherein the one of the limit detection units treats the one of the input signals with a bad status parameter as an inhibited input signal to prevent use of the one of the input signals by the voter logic block.

17. The function block entity of claim 1, further including a pre-limit detection unit associated with each of the set of inputs, wherein each pre-limit detection unit produces a pre-trip limit signal indicative of whether the input signal at the associated input meets a pre-trip criterion that is different than the trip criterion, a pre-trip output adapted to provide a pre-trip alarm signal and a pre-trip voter logic block coupled between the pre-limit detection units and the pre-trip output, the pre-trip voter logic block adapted to apply further voter logic to the pre-trip limit signals to produce the pre-trip alarm signal as a pre-trip alarm value when a particular number of the input signals meet the pre-trip criterion.

18. The function block entity of claim 1, wherein each of the inputs is adapted to receive an analog signal as the input signal.

19. The function block entity of claim 1, wherein each of the inputs is adapted to receive a digital signal as the input signal.

20. The function block entity of claim 1, wherein the override block is adapted to create an event record signal associated with an operation to prevent the use of at least one of the set of inputs by the voter logic block or to override the trip signal developed by the voter logic block at the output.

21. The function block entity of claim 1, wherein one of the limit detection units is adapted to create an event record signal indicating a change of one of the input signals between a state that meets the trip criterion and a state that does not meet the trip criterion or vice versa.

22. A control system for use in a process plant having a plurality of field devices connected within a process , the control system comprising:

a device communicatively coupled to the plurality of field devices, the device including a process or and a computer readable medium; and

a voter block stored on the computer readable medium and adapted to be executed on the process or, the voter block including;

a set of inputs, each input adapted to receive an input signal from within the process plant indicating a process condition;

a limit detection unit associated with each of the set of inputs, wherein each limit detection unit produces a limit signal indicative of whether the input signal at the associated input meets a trip criterion;

an output adapted to provide a trip signal;

a voter logic block coupled between the limit detection units and the output, the voter logic block adapted to apply voter logic to the limit signals to produce the trip signal as a tripped value at the output when a particular number of the input signals meet the trip criterion and to produce the trip signal as a normal value at the output when the particular number of the inputs signals do not meet the trip criterion; and

an override block adapted to prevent the use of at least one of the set of inputs by the voter logic block or to override the trip signal developed by the voter logic block at the output.

23. The control system of claim 22, wherein the voter block is a function block.

24. The control system of claim 22, wherein the override block is an input inhibit block that prevents the use of one of the set of inputs by the voter logic block.

25. The control system of claim 24, wherein the override block includes an override time parameter that specifies a first amount of time for which use of the one of the set of inputs by the voter logic block is to be prevented.

26. The control system of claim 25, wherein the override block includes a reminder time parameter that specifies a second amount of time prior to an expiration of the first amount of time at which a reminder signal is to be created, the reminder signal indicating the future expiration of the first amount of time.

27. The control system of claim 22, wherein the override block comprises an operational override that can be set to prevent the tripped value of the trip signal from being delivered to the output.

28. The control system of claim 27, wherein the override block includes a timer that tracks the time of the operational override and that times out after a predetermined time period to allow the tripped value of the trip signal to be delivered to the output.

29. The control system of claim 27, wherein the override block is adapted to detect when the voter logic block develops a value for the trip signal that is stable for a predetermined amount of time and that allows the trip signal value to be delivered to the output after detection that the trip signal value has been stable for the predetermined amount of time.

30. The control system of claim 27, wherein the override block includes an event detection parameter and uses the event detection parameter to allow the tripped value of the trip signal to be delivered to the output when the event detection parameter indicates that an event is one of present or absent.

31. The control system of claim 22, wherein the override block includes an input inhibit block for each of the set of inputs, wherein each input inhibit block can be set separately to prevent the use of one of the set of inputs by the voter logic block and further includes an operational inhibit block that can be set to override the voter logic block by setting the tripped signal at the output to the normal state.

32. The control system of claim 22, wherein the override block includes an input inhibit block for each of the set of inputs, wherein each inhibit block can be set separately to prevent the use of a different one of the set of inputs by the voter logic and wherein the override block further includes an operational inhibit block that can be set to prevent the tripped value of the trip signal from being delivered to the output.

33. The control system of claim 32, wherein the voter logic block includes an M out of N voter logic scheme in which N is the number of inputs being considered and M is the number of limit signals that must indicate that the trip criterion is met for the voter logic block to detect the existence of a trip condition and to set the trip signal to the tripped value.

34. The control system of claim 33, wherein the voter logic scheme reduces the number of inputs N being considered when one of the set of inputs is overridden by one of the input inhibit blocks but keeps the number of limit signals M the same when the one of the set of inputs is overridden by the one of the input inhibit blocks.

35. The control system of claim 33, wherein the voter logic scheme reduces both the number of inputs N and the number of limit signals M in the voter logic scheme when one of the set of inputs is overridden by one of the input inhibit blocks.

36. The control system of claim 33, wherein one of the input signals includes a status parameter and a value parameter and wherein one of the limit detection units uses the status parameter to decide how to treat the value parameter of the one of the input signals.

37. The control system of claim 36, wherein the one of the limit detection units automatically treats the one of the input signals with a bad status parameter as an input signal that meets the trip criterion.

38. The control system of claim 36, wherein the one of the limit detection units treats the one of the input signals with a bad status parameter as an inhibited input signal to prevent use of the one of the input signals by the voter logic block.

39. The control system of claim 33, further including a pre-limit detection unit associated with each of the set of inputs, wherein each pre-limit detection unit produces a pre-trip limit signal indicative of whether the input signal at the associated input meets a pre-trip criterion that is different than the trip criterion, a pre-trip output adapted to provide a pre-trip alarm signal and a pre-trip voter logic block coupled between the pre-limit detection units and the pre-trip output, the pre-trip voter logic block adapted to apply further voter logic to the pre-trip limit signals to produce the pre-trip alarm signal as a pre-trip alarm value when a particular number of the input signals meet the pre-trip criterion.

40. The control system of claim 22, wherein each of the inputs is adapted to receive an analog signal as the input signal.

41. The control system of claim 22, wherein the override block is adapted to create an event record signal associated with an operation to prevent the use of at least one of the set of inputs by the voter logic block or to override the trip signal developed by the voter logic block at the output.

42. The control system claim 41, wherein one of the limit detection units is adapted to create an event record signal indicating a change of one of the input signals between a state that meets the trip criterion and a state that does not meet the trip criterion or vice versa.

43. A method of determining the existence of a trip condition within a process plant from a plurality of redundant measurements of a process variable, the method comprising:

collecting a signal indicative of each of the redundant measurements;

determining whether each of the collected signals meets a trip criterion;

using a voter logic scheme to produce a trip signal as a normal value when the particular number of the collected signals do not meet the trip criterion and to produce the trip signal as a tripped value when the particular number of the collected signals do meet the trip criterion;

receiving an inhibit signal from a further entity within the process plant; and

preventing the use of at least one of the collected signals by the voter logic scheme or preventing the trip signal from being set to the tripped value upon receipt of the inhibit signal.

44. The method of claim 43, wherein receiving the inhibit signal includes receiving an input inhibit signal associated with one of the collected signals and wherein preventing the use of at least one of the collected signals includes preventing the use of the at least one of the collected signals within the voter logic scheme for a predetermined period of time.

45. The method of claim 44, wherein preventing the use of the at least one of the collected signals includes generating a reminder notification at a preset time before expiration of the predetermined period of time.

46. The method of claim 43, wherein preventing the use of at least one of the collected signals by the voter logic scheme or preventing the trip signal from being set to the tripped value upon receipt of the inhibit signal comprises preventing the trip signal from being set to the tripped value for a predetermined period of time.

47. The method of claim 43, wherein preventing the use of at least one of the collected signals by the voter logic scheme or preventing the trip signal from being set to the tripped value upon receipt of the inhibit signal comprises preventing the trip signal from being set to the tripped value until the voter logic scheme determines that the particular number of the collected signals do not meet the trip criterion for a specified amount of time.

48. The method of claim 43, wherein preventing the use of at least one of the collected signals by the voter logic scheme or preventing the trip signal from being set to the tripped value upon receipt of the inhibit signal comprises preventing the trip signal from being set to the tripped value until an event is detected as being one of present or absent.

49. The method of claim 43, wherein preventing the use of at least one of the collected signals by the voter logic scheme or preventing the trip signal from being set to the tripped value upon receipt of the inhibit signal comprises preventing the use of at least one of the collected signals by the voter logic scheme upon receipt of a first inhibit signal and preventing the trip signal from being set to the tripped value upon receipt of a second inhibit signal.

50. The method of claim 43, wherein using the voter logic scheme to produce a trip signal includes using a voter logic scheme that includes M out of N voting logic in which N is the number of the collected signals being considered and M is the particular number of the collected signals that must meet the trip criterion to produce the trip signal as the tripped value.

51. The method of claim 50, further including reducing the number of the collected signals N considered by the voter logic scheme when one of the collected signals is overridden as a result of the inhibit signal but keeping the particular number of collected signals M that must meet the trip criterion the same when the one of the collected signals is overridden as a result of the inhibit signal.

52. The method of claim 50, further including reducing both the number of the collected signals N considered by the voter logic scheme and the particular number of collected signals M that must meet the trip criterion when the one of the collected signals is overridden as a result of the inhibit signal.

53. The method of claim 43, wherein determining whether each of the collected signals meets the trip criterion includes using a status parameter associated with each of the collected signals to determine if the collected signals meet the trip criterion.

54. The method of claim 53, wherein using the status parameter includes automatically treating a collected signal with a bad status parameter as a collected signal that meets the trip criterion.

55. The method of claim 53, wherein using the status parameter includes automatically preventing a collected signal with a bad status parameter from being used by the voter logic scheme to produce the trip signal.

56. The method of claim 43, further including determining if each of the collected signals meets a pre-limit trip criterion, using another voter logic scheme to produce a pre-trip alarm signal as a normal value when the particular number of the collected signals do not meet the pre-limit trip criterion and to produce the pre-trip alarm signal as an alarm value when the particular number of the collected signals meet the pre-limit trip criterion.

57. The method of claim 43, wherein collecting a signal indicative of each of the redundant measurements includes collecting a separate digital signal indicative of each of the redundant measurements.

58. The method of claim 43, wherein preventing the use of at least one of the collected signals by the voter logic scheme or preventing the trip signal from being set to the tripped value upon receipt of the inhibit signal includes creating an event record signal associated with preventing the use of at least one of the collected signals or preventing the trip signal from being set to the tripped value.

59. The method of claim 43, wherein determining whether each of the collected signals meets the trip criterion includes creating an event record signal when one of the collected signals changes between a state that meets the trip criterion and a state that does not meet the trip criterion or vice versa.