MONITORING SYSTEM AND METHODS FOR A DISTRIBUTED AND RECOVERABLE DIGITAL CONTROL SYSTEM

• US 20070033195A1
• Filed: 05/04/2006
• Published: 02/08/2007
• Est. Priority Date: 08/05/2005
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Stange, Kent, Hess, Richard, Rogers, Randy, Kelley, Gerald
• Granted Patent: US 7,765,427 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G05B 19/0425 Safety, monitoring
• CPC Class Codes: G05B 23/0213 Modular or universal configuration of the monitoring system, e.g. monitoring system having modules that may be combined to build monitoring program; monitoring system that can be applied to legacy systems; adaptable monitoring system; using different communication protocols
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems

Abstract

A monitoring system and methods are provided for a distributed and recoverable digital control system. The monitoring system generally comprises two independent monitoring planes within the control system. The first monitoring plane is internal to the computing units in the control system, and the second monitoring plane is external to the computing units. The internal first monitoring plane includes two in-line monitors. The first internal monitor is a self-checking, lock-step-processing monitor with integrated rapid recovery capability. The second internal monitor includes one or more reasonableness monitors, which compare actual effector position with commanded effector position. The external second monitor plane includes two monitors. The first external monitor includes a pre-recovery computing monitor, and the second external monitor includes a post recovery computing monitor. Various methods for implementing the monitoring functions are also disclosed.

Claims

1. A monitoring system for a recoverable digital control system, the monitoring system comprising:

a first monitoring plane internal to one or more computing units in the control system, the first monitoring plane comprising;

a first internal monitor comprising a self-checking, lock-step-processing monitor with integrated rapid recovery capability; and

a second internal monitor comprising one or more reasonableness monitors that compare an actual effector position with a commanded effector position; and

a second monitoring plane external to the computing units, the second monitoring plane comprising;

a first external monitor comprising a pre-recovery computing monitor; and

a second external monitor comprising a post recovery computing monitor.

2. The monitoring system of claim 1, wherein the one or more reasonableness monitors comprise a time magnitude monitor that is configured to compare a blended command with a computed command.

3. The monitoring system of claim 1, wherein the one or more reasonableness monitors comprise a servo monitor that is configured to compare effector commands with effector positions, and isolate any fault to a servo or an actuator control unit.

4. The monitoring system of claim 3, wherein the fault comprises a soft fault.

5. The monitoring system of claim 1, wherein the one or more reasonableness monitors comprise an actuator control unit monitor that is configured to compare command computations of a computing unit with actuator control unit commands, and isolate any fault to an actuator control unit.

6. The monitoring system of claim 5, wherein the fault comprises a soft fault.

7. The monitoring system of claim 1, wherein the first external monitor is configured to independently monitor multiple effector position command computations across the computing units.

8. The monitoring system of claim 7, wherein the first external monitor is configured to sort fresh and valid input commands from the computing units by magnitude, and compute a blended command by averaging two sorted input commands closest to a median of all the input commands while discarding outlying input commands from the blended command computation.

9. The monitoring system of claim 8, wherein the first external monitor is configured to compare each input command with the blended command and trigger a rapid recovery of an errant computational element within a computing unit when the difference between the input command and the blended command is outside of a predetermined monitor window limit.

10. The monitoring system of claim 1, wherein the second external monitor is configured to monitor the integrity of a previously recovered computational element.

11. The monitoring system of claim 10, wherein the second external monitor is configured for monitoring a recovered computational element using a variable time magnitude monitor and an extended monitor window limit, wherein the extended monitor window limit narrows with time.

12. The monitoring system of claim 11, wherein the second external monitor is configured to allow the recovered computational element to return to a viable state in a blended command computation if a difference between an input command from the recovered computational element and a blended command remains within the extended monitor window limit for an allocated recovery time.

13. The monitoring system of claim 11, wherein the second external monitor is configured to discard any input command from the recovered computational element that falls outside the extended monitor window limit until a system restart or power cycle.

14. The monitoring system of claim 1, wherein the second monitoring plane is implemented in one or more actuator control units.

15. The monitoring system of claim 14, wherein the one or more actuator control units are in operative communication with one or more smart actuators.

16. The monitoring system of claim 15, wherein the one or more smart actuators are in operative communication with one or more actuator or servo devices.

17. The monitoring system of claim 16, wherein the actuator or servo devices are each operatively connected to one or more control effectors.

18. A method for independently monitoring multiple command computations across multiple redundant computing units, the method comprising:

sorting fresh and valid effector position commands from the computing units by magnitude;

computing a blended command by averaging two sorted input commands closest to a median of all the input commands;

discarding any outlying input commands from the blended command computation;

comparing each input command from a computational element of a computing unit with the blended command; and

triggering a rapid recovery of any errant computational element when a difference between the blended command and an effector position command computation is outside a predetermined window limit.

19. A method for monitoring integrity of a previously recovered computational element in a digital control system, the method comprising:

monitoring the recovered computational element using a variable time magnitude monitor in which an extended monitor window narrows with time;

allowing the recovered computational element to return to a viable state in a blended command computation if a difference between an input command from the computational element and a blended command remains within the extended monitor window for an allocated recovery time; and

discarding an input command from the recovered computational element if the input command falls outside of the extended monitor window until a system restart or power cycle.

20. A method for time magnitude monitoring comprising:

comparing a blended command output with a computed effector command;

disregarding the blended command output when deviations between the blended command output and the computed effector command exceed an established limit for a specified time;

selecting a blended command output from a plurality of blended command outputs;

comparing the selected blended command output with an effector position feedback signal; and

initiating an actuator shutdown command when deviations between the selected blended command output and the effector position feedback signal exceed an established limit for a specified time.