Distributed and adaptive smart logic with multi-communication apparatus for reliable safety system shutdown

• US 7,869,889 B2
• Filed: 07/02/2008
• Issued: 01/11/2011
• Est. Priority Date: 07/02/2008
• Status: Expired due to Fees

• Current Assignee: Saudi Arabian Oil Company (Government of Saudi Arabia)
• Original Assignee: Saudi Arabian Oil Company (Government of Saudi Arabia)
• Inventors: Flanders, Patrick S., Daraiseh, Abdelghani
• Primary Examiner(s): Patel; Ramesh B
• Application Number:
  US12/217,306
• Publication Number:
  US 20100004761A1
• Time in Patent Office: 923 Days
• Field of Search: 700/21, 700 79- 82, 702/114, 702/118, 702/184, 340540-541, 340/679
• US Class Current: 700/79
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems

Abstract

This invention relates to safety instrumented systems (“SIS”) for monitoring and controlling chemical and other industrial process field devices, and that are responsive to signals for the emergency shutdown of the process or system. The patent will significantly improve the reliability of communications within an emergency shutdown system, reduce unwanted trips, and adapt to process conditions by failing to a safe mode in dynamic conditions that are not considered by prior art logic solvers.

Claims

1. A safety instrumented system for monitoring and controlling a plurality of process field devices including sensors and final elements, the system comprising a safety logic solver, a plurality of multi-communications cards, a hardwired communications network, and a redundant wireless communications network, in which a pair of said multi-communications cards is associated with each field device, with one card of the pair being provided at the field device, and the other card of the pair being provided at the safety logic solver, in which the cards include a means for transmitting and receiving signals between the field devices and the safety logic solver over both the hardwired and wireless networks, and in which each said card located at a final element having means for performing smart logic to control the final element.

2. The system of claim 1 in which the multi-communications cards verify the operability of the wireless communications network with each of the plurality of field devices by comparing the wireless communications signal from that field device with the corresponding healthy hardwired signal from the same device.

3. The system of claim 2 which is programmed to determine the operability of the wireless system continuously and alert the safety logic solver when any device has degraded or lost wireless communications.

4. The system of claim 1 which includes memory for storing signals received over the hardwired and wireless networks during operation of the process, the signals corresponding to each of the plurality of field devices, and means for comparing each signal with a predetermined safe operating setpoint or range that has been saved in memory for the associated field device.

5. The system of claim 4 which includes means for utilizing the wireless signal input from process sensor transmitters to compare against a predetermined safe operating setpoint or range, should a failure be detected within the hardwired signal.

6. The system of claim 4 which includes means for utilizing the wireless signal output to a final element to communicate the safety demand trip signal, should a failure be detected within the hardwired signal.

7. The system of claim 4 which includes means for actuating a safety shutdown for all or a portion of the process if neither the wireless nor hardwired network signals is in a known healthy state.

8. The system of claim 4 which includes recording and display means for identifying a signal from a field device when communications errors are detected.

9. The system of claim 4, which includes both hardwired and wireless communications between a Simulator and Adaptive Safety Logic Controller and safety-related final elements.

10. The system of claim 9, in which the Simulator and Adaptive Safety Logic Controller links process data within the regulatory control system to safety-related final elements.

11. The system of claim 9, in which the Simulator and Adaptive Safety Logic Controller and the safety related final elements communicate in a packet mode, whereby the data streams comprise a destination and source address, message type, message length, message sequence number, priority, cyclical redundancy checking and message integrity bits.

12. The system of claim 9, in which the Simulator and Adaptive Safety Logic Controller provides updates to the final element smart logic process setpoints.

13. The system of claim 1 where the multi-communications cards verify the operability of wireless communications from sensors that monitor one or more of pressure, temperature, flow rate, fluid level and power consumption.

14. The system of claim 1 where the final elements include emergency isolation valves, flow rate control valves, valve actuators, pump controllers and motor starters.

15. The system of claim 1, in which the multi-communications card located at final elements will periodically or upon request broadcast the health condition and communications connectivity of the final element to a neighbor list of final elements within the same safety function.

16. The system of claim 15, in which the smart logic within the multi-communications cards located at final elements, in deciding whether to shutdown the associated final element, will consider the signal conditions of the hardwired and wireless networks, the safety integrity level for the safety process, the health condition and communications connectivity of neighboring devices, and user configuration logic for action upon degraded or lost communications.

17. The system of claim 16, in which the multi-communications cards located at final elements will use the hardwired network to send an alert signal to the safety logic solver upon loss of communications connectivity over the wireless network.

18. The system of claim 16, in which the smart logic within multi-communications cards located at final elements, upon detecting a loss of communications over both the hardwired and wireless networks, will delay for a period of time that is dependent upon the safety integrity level, after which if communications have not been restored over at least one of the networks, the smart logic will shut down the associated final element.

19. The system of claim 1, in which the smart logic within the multi-communications cards located at final elements, in deciding whether to shutdown the associated final element, will consider the signal conditions of the hardwired and wireless networks, the safety integrity level for the safety process, the health condition and communications connectivity of neighboring devices, and user configuration logic for action upon degraded or lost communications.

20. The system of claim 19, in which the multi-communications cards located at final elements will use the hardwired network to send an alert signal to the safety logic solver upon loss of communications connectivity over the wireless network.

21. The system of claim 19, in which the smart logic within multi-communications cards located at final elements, upon detecting a loss of communications over both the hardwired and wireless networks, will delay for a period of time that is dependent upon the safety integrity level, after which if communications have not been restored over at least one of the networks, the smart logic will shut down the associated final element.

22. The system of claim 1, in which the multi-communications cards located at final elements will use the hardwired network to send an alert signal to the safety logic solver upon loss of communications connectivity over the wireless network.

23. The system of claim 1, in which the smart logic within multi-communications cards located at final elements, upon detecting a loss of communications over both the hardwired and wireless networks, will delay for a period of time that is dependent upon the safety integrity level, after which if communications have not been restored over at least one of the networks, the smart logic will shut down the associated final element.

24. The system of claim 1, wherein the wireless network uses SP100, IEEE 802.11, IEEE 802.15, Wireless LAN, or Wireless Hart protocols.

25. The system of claim 1, in which the smart logic of the multi-communications cards located at final elements may be user-configured as to when to fail-safe, fail-steady, or to set a countdown timer after which to move the associated final elements to a fail-safe position.

26. A method of providing two paths of communication between a process safety logic solver and a plurality of field devices employed to monitor and control the process, the method comprising:

providing a hardwired communication network operatively connected to the safety logic solver and each of the plurality of field devices; and

providing a wireless communication network operatively connected to the safety logic solver and each of the plurality of field devices,

providing an integral smart logic capability within the multi-communications cards located at final elements, which in deciding whether to shutdown the associated final element will consider the signal conditions of the hardwired and wireless networks, the safety integrity level for the safety process, the health condition and communications connectivity of neighboring devices, and user configuration logic for action upon degraded or lost communications,

whereby signals initiated by and transmitted between the safety logic solver and the plurality of field devices are transmitted over both the hardwired and wireless networks.

27. The method of claim 26 which comprises:

checking for the communications health of the hardwired signal received from a field device;

checking for the wireless signal health from the same corresponding field device;

utilizing the healthy signal from the hardwired network for comparison against a predetermined safe operating setpoint or range in the case of a process measurement or to transmit the safety demand to a final element.

28. The method of claim 27 which includes continuing the operation of the process if the wireless signal is healthy and the hardwired signal is degraded or failed.

29. The method of claim 27 which includes the configurable use of an alternative healthy field device to provide the process measurement or required safety logic solver output action when neither the hardwired or wireless signals for the primary device is healthy.

30. The method of claim 29 which includes identifying the field device where degraded or failed communications occurred.

31. The method of claim 29 which includes activating the programmed safety shutdown when no signal has been communicated over either network for a predetermined period of time and when there is no suitable alternative healthy process field device to provide the process measurement or required safety logic solver output action.

32. The method of claim 26 which includes providing multiple user-defined communications failure states configured within memory at the multi-communications card for a field device, which will take into account whether the hardwired and/or wireless communications is degraded or lost, and the risk level and hardware configuration of the safety function involved, and then will decide whether the device should fail to a steady state, fail to a safe position, or begin a countdown after which the device will fail, absent a recovery of the communications failure.

33. A field-mounted multi-communications card that communicates with a safety logic solver via a primary hardwired communications network and via a redundant wireless communications network, in which the card can be user-configured to utilize the wireless communications path when failed or degraded communications are detected on the hardwired network.

34. The multi-communications card of claim 33, which upon failed or degraded communications on the hardwired network will use the wireless communications path to feedback parameters from an associated final element to the safety logic solver, and either allow the associated final element to remain in service, or trip it upon receiving a trip signal from the safety logic solver.

35. The multi-communications card of claim 33, which upon failed or degraded communications on the hardwired network will use the wireless communications path to feedback parameters from an associated sensor.