Voter logic block including operational and maintenance overrides in a process control system Number:7,130,703 from the United States Patent and Trademark Office (PTO) owispatent A voter function block, which can be integrated into a function block diagram programming environment in a process plant control or safety system, implements voter logic in conjunction with providing operational and maintenance overrides which may be set to override individual inputs to the voter function block as well as to override the output of the voter function block. The voter function block, which is easy to create, use, test, debug and document, includes one or input limit detection units which detect if a particular redundant input has reached a specified limit indicating a condition within the process plant, an override unit that may be set by a user to override the consideration of that input in the voting function, a voting logic entity that determines if a trip condition exists based on the values of the valid or non-inhibited inputs, and an inhibit block that may used to override the output of the voter logic block during, for example, a startup or other operational condition. The voter function block may be integrated into a process control or safety system by being communicatively connected to other function blocks, such as to analog or digital input function blocks, analog or digital output function blocks, control function blocks, cause and effect function blocks which implement cause and effect logic, etc. Within the process control or safety programming environment.<H maintenance, operational, Voter, logic, blo, 7130703.html, Patent, pto, 7130703

Title: Voter logic block including operational and maintenance overrides in a process control system

Abstract: A voter function block, which can be integrated into a function block diagram programming environment in a process plant control or safety system, implements voter logic in conjunction with providing operational and maintenance overrides which may be set to override individual inputs to the voter function block as well as to override the output of the voter function block. The voter function block, which is easy to create, use, test, debug and document, includes one or input limit detection units which detect if a particular redundant input has reached a specified limit indicating a condition within the process plant, an override unit that may be set by a user to override the consideration of that input in the voting function, a voting logic entity that determines if a trip condition exists based on the values of the valid or non-inhibited inputs, and an inhibit block that may used to override the output of the voter logic block during, for example, a startup or other operational condition. The voter function block may be integrated into a process control or safety system by being communicatively connected to other function blocks, such as to analog or digital input function blocks, analog or digital output function blocks, control function blocks, cause and effect function blocks which implement cause and effect logic, etc. Within the process control or safety programming environment.

Patent Number: 7,130,703 Issued on 10/31/2006 to Ott, et al.

Inventors: Ott; Michael G. (Austin, TX), Law; Gary (Georgetown, TX), Stevenson; Dennis (Round Rock, TX), Havekost; Robert (Austin, TX), Sherriff; Godfrey (Austin, TX)
Assignee: Fisher-Rosemount Systems, Inc. (Austin, TX)

Appl. No.: 10/409,576

Filed: April 8, 2003

Current U.S. Class: 700/80 ; 700/18; 700/19; 700/20; 700/21; 700/79; 700/86; 702/108; 702/188; 702/189; 709/203; 709/208; 709/221; 714/1; 714/100; 714/25; 714/39

Current International Class: G05B 11/01 (20060101); G05B 19/42 (20060101)

Field of Search: 700/18-20,23,21,79,80,81,82,86,87 714/1,100,51,39,25 709/221,203,208 702/108,188,189

References Cited [Referenced By]

U.S. Patent Documents


4427620	January 1984	Cook
4448033	May 1984	Briccetti
5768119	June 1998	Havekost et al.
5970430	October 1999	Burns et al.
6014612	January 2000	Larson et al.
6049578	April 2000	Senechal et al.
6155282	December 2000	Zachary et al.
6186167	February 2001	Grumstrup et al.
6292523	September 2001	Senechal et al.
6510351	January 2003	Blevins et al.
6721609	April 2004	Wojsznis et al.
6774786	August 2004	Havekost et al.
6850973	February 2005	Larson et al.
6898468	May 2005	Ott et al.
7010450	March 2006	Law et al.
2002/0052673	May 2002	Seong et al.
2002/0091451	July 2002	Summers et al.
2002/0130846	September 2002	Nixon et al.
2002/0145515	October 2002	Snowbarger et al.
2003/0062494	April 2003	Snowbarger et al.
2004/0193290	September 2004	Ott et al.
2004/0199351	October 2004	Ott et al.
2005/0097194	May 2005	Eisenbeis et al.

Foreign Patent Documents


1 091 199	Apr., 2001	EA
2 274 929	Aug., 1994	GB
WO-00/38040	Jun., 2000	WO
WO-03/098172	Nov., 2003	WO

Other References

Search Report under Section 17(5) issued in GB 0407443.1 application by the United Kingdom Patent Office on Aug. 4, 2004. cited by other .
Search Report under Section 17(5) issued in GB 0407444.9 application by the United Kingdom Patent Ofice on Aug. 9, 2004. cited by other .
Search Report under Section 17(5) issued in GB0407892.9 application by United Kingdom Patent Office on Aug. 12, 2004. cited by other .
U.S. Appl. No. 10/668,013, dated Sep. 22, 2003, "Coordination of Field Device Operations with Overrides and Bypasses Within a Process Control and Safety System.". cited by other .
Abstract of JP2000047724 A, publication dated Feb. 18, 2000. cited by othe- r .
Abstract of JP59091507 A, publication dated May 26, 1984. cited by other .
United Kingdom Examination Report for United Kingdom Patent Application No. 0407892.9 dated Dec. 21, 2005. cited by other.

Primary Examiner: Patel; Ramesh
Attorney, Agent or Firm: Marshall, Gerstein & Borun LLP

Claims

What is claimed is:

1. A function block entity for use in a process plant having a processor communicatively coupled to control one or more field devices, the function block entity comprising: a computer readable medium; and a function block stored on the computer readable medium and adapted to be executed on the processor, the function block including; a set of inputs, each input adapted to receive an input signal from within the process plant indicating a process condition; a limit detection unit associated with each of the set of inputs, wherein each limit detection unit produces a limit signal indicative of whether the input signal at the associated input meets a trip criterion; an output adapted to provide a trip signal; a voter logic block coupled between the limit detection units and the output, the voter logic block adapted to apply voter logic to the limit signals to produce the trip signal as a tripped value at the output when a particular number of the input signals meet the trip criterion and to produce the trip signal as a normal value at the output when the particular number of the inputs signals do not meet the trip criterion; and an override block adapted to prevent the use of at least one of the set of inputs by the voter logic block or to override the trip signal developed by the voter logic block at the output.

2. The function block entity of claim 1, wherein the override block is an input inhibit block that prevents the use of one of the set of inputs by the voter logic block.

3. The function block entity of claim 2, wherein the override block includes an override time parameter that specifies a first amount of time for which use of the one of the set of inputs by the voter logic block is to be prevented.

4. The function block entity of claim 3, wherein the override block includes a reminder time parameter that specifies a second amount of time prior to the expiration of the first amount of time at which a reminder signal is to be created, the reminder signal indicating the future expiration of the first amount of time.

5. The function block entity of claim 1, wherein the override block includes an input inhibit block for each of the set of inputs, wherein each inhibit block can be set separately to prevent the use of a different one of the set of inputs by the voter logic block.

6. The function block entity of claim 1, wherein the override block comprises an operational override that can be set to prevent the tripped value of the trip signal from being delivered to the output.

7. The function block entity of claim 6, wherein the override block includes a timer that tracks the time of the operational override and that times out after a predetermined time period to allow the tripped value of the trip signal to be delivered to the output.

8. The function block entity of claim 6, wherein the override block is adapted to detect when the voter logic block develops a value for the trip signal that is stable for a predetermined amount of time and that allows the trip signal value to be delivered to the output after detection that the trip signal value has been stable for the predetermined amount of time.

9. The function block entity of claim 6, wherein the override block includes an event detection parameter and uses the event detection parameter to allow the tripped value of the trip signal to be delivered to the output when the event detection parameter indicates that an event is either one of present or absent.

10. The function block entity of claim 1, wherein the override block includes an input inhibit block for each of the set of inputs, wherein each input inhibit block can be set separately to prevent the use of one of the set of inputs by the voter logic block and further includes an operational inhibit block that can be set to override the voter logic block by setting the tripped signal at the output to the normal state.

11. The function block entity of claim 1, wherein the voter logic block includes an M out of N voter logic scheme in which N is the number of inputs being considered and M is the number of limit signals that must indicate the trip criterion is met for the voter logic block to detect the existence of a trip condition and to set the trip signal to the tripped value.

12. The function block entity of claim 11, wherein the override block is an input inhibit block that prevents the use of one of the set of inputs by the voter logic block and wherein the voter logic scheme reduces the number of inputs N being considered when the one of the set of inputs is overridden but keeps the number of limit signals M the same when the one of the set of inputs is overridden.

13. The function block entity of claim 11, wherein the override block is an input inhibit block that prevents the use of one of the-set of inputs by the voter logic block and wherein the voter logic scheme reduces both the number of inputs N and the number of limit signals M in the voter logic scheme when the one of the set of inputs is overridden.

14. The function block entity of claim 11, wherein one of the input signals includes a status parameter and a value parameter and wherein one of the limit detection units uses the status parameter to decide how to treat the value parameter of the one of the input signals.

15. The function block entity of claim 14, wherein the one of the limit detection units automatically treats the one of the input signals with a bad status parameter as an input signal that meets the trip criterion.

16. The function block entity of claim 14, wherein the one of the limit detection units treats the one of the input signals with a bad status parameter as an inhibited input signal to prevent use of the one of the input signals by the voter logic block.

17. The function block entity of claim 1, further including a pre-limit detection unit associated with each of the set of inputs, wherein each pre-limit detection unit produces a pre-trip limit signal indicative of whether the input signal at the associated input meets a pre-trip criterion that is different than the trip criterion, a pre-trip output adapted to provide a pre-trip alarm signal and a pre-trip voter logic block coupled between the pre-limit detection units and the pre-trip output, the pre-trip voter logic block adapted to apply further voter logic to the pre-trip limit signals to produce the pre-trip alarm signal as a pre-trip alarm value when a particular number of the input signals meet the pre-trip criterion.

18. The function block entity of claim 1, wherein each of the inputs is adapted to receive an analog signal as the input signal.

19. The function block entity of claim 1, wherein each of the inputs is adapted to receive a digital signal as the input signal.

20. The function block entity of claim 1, wherein the override block is adapted to create an event record signal associated with an operation to prevent the use of at least one of the set of inputs by the voter logic block or to override the trip signal developed by the voter logic block at the output.

21. The function block entity of claim 1, wherein one of the limit detection units is adapted to create an event record signal indicating a change of one of the input signals between a state that meets the trip criterion and a state that does not meet the trip criterion or vice versa.

22. A control system for use in a process plant having a plurality of field devices connected within a process , the control system comprising: a device communicatively coupled to the plurality of field devices, the device including a process or and a computer readable medium; and a voter block stored on the computer readable medium and adapted to be executed on the process or, the voter block including; a set of inputs, each input adapted to receive an input signal from within the process plant indicating a process condition; a limit detection unit associated with each of the set of inputs, wherein each limit detection unit produces a limit signal indicative of whether the input signal at the associated input meets a trip criterion; an output adapted to provide a trip signal; a voter logic block coupled between the limit detection units and the output, the voter logic block adapted to apply voter logic to the limit signals to produce the trip signal as a tripped value at the output when a particular number of the input signals meet the trip criterion and to produce the trip signal as a normal value at the output when the particular number of the inputs signals do not meet the trip criterion; and an override block adapted to prevent the use of at least one of the set of inputs by the voter logic block or to override the trip signal developed by the voter logic block at the output.

23. The control system of claim 22, wherein the voter block is a function block.

24. The control system of claim 22, wherein the override block is an input inhibit block that prevents the use of one of the set of inputs by the voter logic block.

25. The control system of claim 24, wherein the override block includes an override time parameter that specifies a first amount of time for which use of the one of the set of inputs by the voter logic block is to be prevented.

26. The control system of claim 25, wherein the override block includes a reminder time parameter that specifies a second amount of time prior to an expiration of the first amount of time at which a reminder signal is to be created, the reminder signal indicating the future expiration of the first amount of time.

27. The control system of claim 22, wherein the override block comprises an operational override that can be set to prevent the tripped value of the trip signal from being delivered to the output.

28. The control system of claim 27, wherein the override block includes a timer that tracks the time of the operational override and that times out after a predetermined time period to allow the tripped value of the trip signal to be delivered to the output.

29. The control system of claim 27, wherein the override block is adapted to detect when the voter logic block develops a value for the trip signal that is stable for a predetermined amount of time and that allows the trip signal value to be delivered to the output after detection that the trip signal value has been stable for the predetermined amount of time.

30. The control system of claim 27, wherein the override block includes an event detection parameter and uses the event detection parameter to allow the tripped value of the trip signal to be delivered to the output when the event detection parameter indicates that an event is one of present or absent.

31. The control system of claim 22, wherein the override block includes an input inhibit block for each of the set of inputs, wherein each input inhibit block can be set separately to prevent the use of one of the set of inputs by the voter logic block and further includes an operational inhibit block that can be set to override the voter logic block by setting the tripped signal at the output to the normal state.

32. The control system of claim 22, wherein the override block includes an input inhibit block for each of the set of inputs, wherein each inhibit block can be set separately to prevent the use of a different one of the set of inputs by the voter logic and wherein the override block further includes an operational inhibit block that can be set to prevent the tripped value of the trip signal from being delivered to the output.

33. The control system of claim 32, wherein the voter logic block includes an M out of N voter logic scheme in which N is the number of inputs being considered and M is the number of limit signals that must indicate that the trip criterion is met for the voter logic block to detect the existence of a trip condition and to set the trip signal to the tripped value.

34. The control system of claim 33, wherein the voter logic scheme reduces the number of inputs N being considered when one of the set of inputs is overridden by one of the input inhibit blocks but keeps the number of limit signals M the same when the one of the set of inputs is overridden by the one of the input inhibit blocks.

35. The control system of claim 33, wherein the voter logic scheme reduces both the number of inputs N and the number of limit signals M in the voter logic scheme when one of the set of inputs is overridden by one of the input inhibit blocks.

36. The control system of claim 33, wherein one of the input signals includes a status parameter and a value parameter and wherein one of the limit detection units uses the status parameter to decide how to treat the value parameter of the one of the input signals.

37. The control system of claim 36, wherein the one of the limit detection units automatically treats the one of the input signals with a bad status parameter as an input signal that meets the trip criterion.

38. The control system of claim 36, wherein the one of the limit detection units treats the one of the input signals with a bad status parameter as an inhibited input signal to prevent use of the one of the input signals by the voter logic block.

39. The control system of claim 33, further including a pre-limit detection unit associated with each of the set of inputs, wherein each pre-limit detection unit produces a pre-trip limit signal indicative of whether the input signal at the associated input meets a pre-trip criterion that is different than the trip criterion, a pre-trip output adapted to provide a pre-trip alarm signal and a pre-trip voter logic block coupled between the pre-limit detection units and the pre-trip output, the pre-trip voter logic block adapted to apply further voter logic to the pre-trip limit signals to produce the pre-trip alarm signal as a pre-trip alarm value when a particular number of the input signals meet the pre-trip criterion.

40. The control system of claim 22, wherein each of the inputs is adapted to receive an analog signal as the input signal.

41. The control system of claim 22, wherein the override block is adapted to create an event record signal associated with an operation to prevent the use of at least one of the set of inputs by the voter logic block or to override the trip signal developed by the voter logic block at the output.

42. The control system claim 41, wherein one of the limit detection units is adapted to create an event record signal indicating a change of one of the input signals between a state that meets the trip criterion and a state that does not meet the trip criterion or vice versa.

43. A method of determining the existence of a trip condition within a process plant from a plurality of redundant measurements of a process variable, the method comprising: collecting a signal indicative of each of the redundant measurements; determining whether each of the collected signals meets a trip criterion; using a voter logic scheme to produce a trip signal as a normal value when the particular number of the collected signals do not meet the trip criterion and to produce the trip signal as a tripped value when the particular number of the collected signals do meet the trip criterion; receiving an inhibit signal from a further entity within the process plant; and preventing the use of at least one of the collected signals by the voter logic scheme or preventing the trip signal from being set to the tripped value upon receipt of the inhibit signal.

44. The method of claim 43, wherein receiving the inhibit signal includes receiving an input inhibit signal associated with one of the collected signals and wherein preventing the use of at least one of the collected signals includes preventing the use of the at least one of the collected signals within the voter logic scheme for a predetermined period of time.

45. The method of claim 44, wherein preventing the use of the at least one of the collected signals includes generating a reminder notification at a preset time before expiration of the predetermined period of time.

46. The method of claim 43, wherein preventing the use of at least one of the collected signals by the voter logic scheme or preventing the trip signal from being set to the tripped value upon receipt of the inhibit signal comprises preventing the trip signal from being set to the tripped value for a predetermined period of time.

47. The method of claim 43, wherein preventing the use of at least one of the collected signals by the voter logic scheme or preventing the trip signal from being set to the tripped value upon receipt of the inhibit signal comprises preventing the trip signal from being set to the tripped value until the voter logic scheme determines that the particular number of the collected signals do not meet the trip criterion for a specified amount of time.

48. The method of claim 43, wherein preventing the use of at least one of the collected signals by the voter logic scheme or preventing the trip signal from being set to the tripped value upon receipt of the inhibit signal comprises preventing the trip signal from being set to the tripped value until an event is detected as being one of present or absent.

49. The method of claim 43, wherein preventing the use of at least one of the collected signals by the voter logic scheme or preventing the trip signal from being set to the tripped value upon receipt of the inhibit signal comprises preventing the use of at least one of the collected signals by the voter logic scheme upon receipt of a first inhibit signal and preventing the trip signal from being set to the tripped value upon receipt of a second inhibit signal.

50. The method of claim 43, wherein using the voter logic scheme to produce a trip signal includes using a voter logic scheme that includes M out of N voting logic in which N is the number of the collected signals being considered and M is the particular number of the collected signals that must meet the trip criterion to produce the trip signal as the tripped value.

51. The method of claim 50, further including reducing the number of the collected signals N considered by the voter logic scheme when one of the collected signals is overridden as a result of the inhibit signal but keeping the particular number of collected signals M that must meet the trip criterion the same when the one of the collected signals is overridden as a result of the inhibit signal.

52. The method of claim 50, further including reducing both the number of the collected signals N considered by the voter logic scheme and the particular number of collected signals M that must meet the trip criterion when the one of the collected signals is overridden as a result of the inhibit signal.

53. The method of claim 43, wherein determining whether each of the collected signals meets the trip criterion includes using a status parameter associated with each of the collected signals to determine if the collected signals meet the trip criterion.

54. The method of claim 53, wherein using the status parameter includes automatically treating a collected signal with a bad status parameter as a collected signal that meets the trip criterion.

55. The method of claim 53, wherein using the status parameter includes automatically preventing a collected signal with a bad status parameter from being used by the voter logic scheme to produce the trip signal.

56. The method of claim 43, further including determining if each of the collected signals meets a pre-limit trip criterion, using another voter logic scheme to produce a pre-trip alarm signal as a normal value when the particular number of the collected signals do not meet the pre-limit trip criterion and to produce the pre-trip alarm signal as an alarm value when the particular number of the collected signals meet the pre-limit trip criterion.

57. The method of claim 43, wherein collecting a signal indicative of each of the redundant measurements includes collecting a separate digital signal indicative of each of the redundant measurements.

58. The method of claim 43, wherein preventing the use of at least one of the collected signals by the voter logic scheme or preventing the trip signal from being set to the tripped value upon receipt of the inhibit signal includes creating an event record signal associated with preventing the use of at least one of the collected signals or preventing the trip signal from being set to the tripped value.

59. The method of claim 43, wherein determining whether each of the collected signals meets the trip criterion includes creating an event record signal when one of the collected signals changes between a state that meets the trip criterion and a state that does not meet the trip criterion or vice versa.

Description

FIELD OF TECHNOLOGY

The present invention relates generally to process control and safety systems used in process plants and, more particularly, to a system having a voter logic block with operational and maintenance override functionality.

DESCRIPTION OF THE RELATED ART

Process control systems, like those used in chemical, petroleum or other processes, typically include one or more process controllers communicatively coupled to at least one host or operator work station and to one or more field devices via analog, digital or combined analog/digital buses or lines. The field devices, which may be, for example valves, valve positioners, switches and transmitters (e.g., temperature, pressure and flow rate sensors), perform functions within the process plant such as opening or closing valves and measuring process variables. The process controllers receive signals indicative of process measurements made by the field devices and/or other information pertaining to the field devices, use this information to implement control routines and then generate control signals which are sent over the buses or lines to the field devices to control the operation of the process. Information from the field devices and the controllers is typically made available to one or more applications executed by the operator work station to enable an operator to perform any desired function with respect to the process, such as configuring the process, viewing the current state of the process, modifying the operation of the process, etc.

Furthermore, in many processes, a separate safety system is provided to detect significant safety related problems within the process plant and to automatically close valves, remove power from devices, switch flows within the plant, etc. When a problem occurs which might result in or lead to a serious hazard in the plant, such as a spill of toxic chemicals, an explosion, etc. These safety systems typically have one or more separate controllers apart from the standard process control controllers, called logic solvers, which are connected to safety field devices via separate buses or communication lines installed within the process plant. The logic solvers use the safety field devices to detect process conditions associated with significant events, such as the position of certain safety switches or shutdown valves, overflows or underflows in the process, the operation of important power generation or control devices, the operation of fault detection devices, etc. to thereby detect "events" within the process plant. When an event is detected, the safety controller takes some action to limit the detrimental nature of the event, such as closing valves, turning devices off, removing power from sections of the plant, etc. Generally, these actions include switching safety devices into a tripped or"safe" mode of operation which is designed to prevent a serious or hazardous condition within the process plant.

It is common practice in safety instrumented systems to use redundant input devices such as transmitters and switches in order to detect events within the system to provide greater safety integrity or process variable measurement availability. In such systems, it is sometimes necessary to provide voting logic functionality in the shutdown logic to determine whether the process condition is acceptable or dangerous based on the redundant inputs. While such voting logic is fairly strait-forward, in that it typically needs merely to determine a majority vote of the inputs to determine if an event condition has occurred, these voting systems have no effective overrides. However, it is frequently desirable in both safety systems and in some process control systems to be able to override the output of the voting function to, for example, prevent operation of the shut down system during startup of the process control system, enable maintenance personnel to perform maintenance operations on one or more of the input devices, allow selected process conditions to be ignored temporarily, etc.

While in the past, configuration or safety engineers have sometimes manually programmed voting logic into the safety system controllers using different programming languages, this programming step unfortunately has been tedious, time consuming and fraught with errors, which can be serious because a failure of the safety system to operate properly can lead to serious injury or even death on the part of plant personnel and to the destruction of potentially millions of dollars of equipment and material within a plant. In general, some useful features which are not easily integrated into known voting logic functionality include maintenance bypass of selected inputs to the voting logic system, startup bypasses, startup and/or trip delay features, etc.

SUMMARY OF THE DISCLOSURE

A safety system within a process plant uses one or more voter function blocks that can be easily integrated into a function block diagram programming environment to implement the voting logic specified by a user along with various maintenance overrides and bypass features. Such a voter function block, which is easy to create, use, test, debug and document, includes one or input limit detection units which detect if an associated input has reached a specified limit indicating a condition within the process plant, an input bypass unit that may be set by a user to override the consideration of that input in the voting function, a voting function logic entity that determines if a trip condition exists based on the values of the valid inputs, and an inhibit block that may used to override the output of the voter logic block during, for example, a startup or other operational condition. The voter function block may be communicatively connected to other function blocks, such as to analog or digital input function blocks, analog or digital output function blocks, control function blocks, cause and effect function blocks which implement cause and effect logic, etc. to implement the voter logic as part of a larger process control or safety system strategy. In one case, the voter function block may be used to detect the presence of an event within a process safety system based on multiple measurements of a process variable made by redundant measurement or sensor devices.

The voter function block describe herein is easy to create, as, in its basic form, it only requires the configuration or safety engineer to supply an indication of the number of inputs to be analyzed, the type of voter logic to be used and the overrides or bypass features to be used to define the desired operation of the voter function block. This voter function block is also easy to integrate into a controller or logic solver which uses function block logic as the voter function block can be integrated in the same manner as any other function block, by interconnecting inputs and outputs of the voter function block to other function blocks or elements within the control strategy. As a result, this voter function block is also easy to document, test and debug. Moreover, this voter function block may provide additional functionality not normally provided in safety systems, such as providing overrides or bypass features to be used during runtime as well as during maintenance and startup procedures.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of an exemplary process plant having a safety system that is integrated with a process control system and that uses one or more configurable voter function blocks to control the system shutdown and maintenance override activities within the process plant;

FIG. 2 is block diagram of one of the configurable voter function blocks of FIG. 1;

FIG. 3 is a table of several exemplary voting schemes involving one bypassed input that can be used by the voter function block of FIG. 2;

FIG. 4 is an exemplary table indicating the manner in which a voting scheme may degrade when one of the inputs to the voter function block has a bad status; and

FIG. 5 is a state diagram illustrating a set of states potentially associated with the voter function block of FIG. 2.

DETAILED DESCRIPTION

Referring now to FIG. 1, a process plant 10 includes a process control system 12 integrated with a safety system 14 (indicated by dotted lines), which generally operates as a Safety Instrumented System (SIS) to monitor and override the control provided by the process control system 12 to maximize the likely safe operation of the process plant 10. The process plant 10 also includes one or more host workstations, computers or user interfaces 16 (which may be any type of personal computers, workstations, PDAs, etc.) which are accessible by plant personnel, such as process control operators, maintenance personnel, safety engineers, etc. In the example illustrated in FIG. 1, two user interfaces 16 are shown as being connected to two separate process control/safety control nodes 18 and 20 and to a configuration database 21 via a common communication line or bus 22. The communication network 22 may be implemented using any desired bus-based or non-bus based hardware, using any desired hardwired or wireless communication structure and using any desired or suitable communication protocol, such as an Ethernet protocol.

Generally speaking, each of the nodes 18 and 20 of the process plant 10 includes both process control system devices and safety system devices connected together via a bus structure that may be provided on a backplane into which the different devices are attached. The node 18 is illustrated in FIG. 1 as including a process controller 24 (which may be a redundant pair of controllers) as well as one or more process control system input/output (I/O) devices 28, 30 and 32 while the node 20 is illustrated as including a process controller 26 (which may be a redundant pair of controllers) as well as one or more process control system I/O devices 34 and 36. Each of the process control system I/O devices 28, 30, 32,34 and 36 is communicatively connected to a set of process control related field devices, illustrated in FIG. 1 as field devices 40 and 42. The process controllers 24 and 26, the I/O devices 28 36 and the controller field devices 40 and 42 generally make up the process control system 12 of FIG. 1.

Likewise, the node 18 includes one or more safety system logic solvers 50, 52, while the node 20 includes safety system logic solvers 54 and 56. Each of the logic solvers 50 56 is an I/O device having a processor 57 that executes safety logic modules 58 stored in a memory 79 and is communicatively connected to provide control signals to and/or receive signals from safety system field devices 60 and 62. Additionally, each of the nodes 18 and 20 includes at least one message propagation device (MPD) 70 or 72, which are communicatively coupled to each other via a ring type bus connection 74 (only part of which is illustrated in FIG. 1). The safety system logic solvers 50 56, the safety system field devices 60 and 62, the MPDs 70 and 72 and the bus 74 generally make up the safety system 14 of FIG. 1.

The process controllers 24 and 26, which may be, by way of example only, DeltaV.TM. controllers sold by Fisher-Rosemount Systems, Inc., or any other desired type of process controllers are programmed to provide process control functionality (using what are commonly referred to as control modules) using the I/O devices 28, 30 and 32 (for the controller 24), the I/O devices 34 and 36 (for the controller 26) and the field devices 40 and 42. In particular, each of the controllers 24 and 26 implements or oversees one or more process control routines stored therein or otherwise associated therewith and communicates with the field devices 40 and 42 and the workstations 14 to control the process 10 or a portion of the process 10 in any desired manner. The field devices 40 and 42 may be any desired types of field devices, such as sensors, valves, transmitters, positioners, etc., and may conform to any desired open, proprietary or other communication or programming protocol including, for example, the HART or the 4 20 ma protocol (as illustrated for the field devices 40), any fieldbus protocol such as the FOUNDATIONS.RTM. Fieldbus protocol (as illustrated for the field devices 42), or the CAN, Profibus, the AS-Interface protocols, to name but a few. Similarly, the I/O devices 28 36 may be any known types of process control I/O devices using any appropriate communication protocol(s).

The safety logic solvers 50 56 of FIG. 1 may be any desired type of safety system control devices that include a processor 57 and a memory that stores safety logic modules 58 adapted to be executed on the processor 57 to provide control functionality associated with the safety system 14 using the field devices 60 and 62. Of course, the safety field devices 60 and 62 may be any desired type of field devices conforming or using any known or desired communication protocol, such as those mentioned above. In particular, the field devices 60 and 62 may be safety-related field devices of the type that are conventionally controlled by a separate, dedicated safety-related control system. In the process plant 10 illustrated in FIG. 1, the safety field devices 60 are depicted as using a dedicated or point-to-point communication protocol, such as the HART or the 4 20 ma protocol, while the safety field devices 62 are illustrated as using a bus communication protocol, such as a Fieldbus protocol. The safety field devices 60 may perform any desired function, such as that of a shut-down valve, a shut-off switch, etc.

A common backplane 76 (indicated by a dashed line through the controllers 24, 26, the I/O devices 28 36, the safety logic solvers 50 56 and the MPDs 70 and 72) is used in each of the nodes 18 and 20 to connect the controllers 24 and 26 to the process control I/O cards 28, 30 and 32 or 34 and 36, as well as to the safety logic solvers 50, 52, 54 or 56 and to the MPDs 70 or 72. The controllers 24 and 26 are also communicatively coupled to, and operate as a bus arbitrator for the bus 22, to enable each of the I/O devices 28 36, the logic solvers 50 56 and the MPDs 70 and 72 to communicate with any of the workstations 16 via the bus 22.

As will be understood, each of the workstations 16 includes a processor 77 and a memory 78 that stores one or more configuration and/or viewing applications adapted to be executed on the processor 78. A configuration application 80 and a viewing application 82 are illustrated in an exploded view in FIG. 1 as being stored in one of the workstations 16 while a diagnostic application 84 is illustrated as being stored in the other one of the workstations 16. However, if desired, these and other applications could be stored and executed in different ones of the workstations 16 or in other computers associated with the process plant 10. Generally speaking, the configuration application 80 provides configuration information to a safety engineer and enables the safety engineer to configure some or all elements of the process plant 10 and to store that configuration in the configuration database 21. As part of the configuration activities performed by the configuration application 80, the safety engineer may create control routines or control modules for the process controllers 24 and 26, may create safety logic modules 58 for any and all of the safety logic solvers 50 56 (including creating and programming voter function blocks for use in the safety logic solvers 50 56 or even in the controllers 24 and 26) and may download these different control and safety modules to the appropriate ones of the process controllers 24 and 26 and the safety logic solvers 50 56 via the bus 22 and controllers 24 and 26. Similarly, the configuration application 80 may be used to create and download other programs and logic to the I/O devices 28 36, any of the field devices 40, 42, 60 and 62, etc.

Conversely, the viewing application 82 may be used to provide one or more displays to a user, such as to a process control operator, a safety operator, etc., which includes information about the state of the process control system 12 and the safety system 14 either in separate views or in the same view, if so desired. For example, the viewing application 82 may be an alarm display application that receives and displays indications of alarms to an operator. If desired, such an alarm viewing application may take the form as disclosed in U.S. Pat. No. 5,768,119 entitled "Process Control System Including Alarm Priority Adjustment" and U.S. patent application Ser. No. 09/707,580 entitled "Integrated Alarm Display in a Process Control Network," both of which are assigned to the assignee of this patent and are hereby expressly incorporated by reference herein. It will be understood, however, that the alarm display or alarm banner of these patents may receive and display alarms from both the process control system 12 and the safety system 14 in an integrated alarm display as the alarms from both systems 12 and 14 will be sent to the operator work station 14 executing the alarm display application and will be recognizable as alarms from different devices. Likewise, an operator may deal with safety alarms displayed in an alarm banner in the same manner as process control alarms. For example, the operator or user may acknowledge safety alarms, turn off safety alarms, etc. using the alarm display, which will send messages to the appropriate process controller 24, 26 within the safety system 14 using communications over the bus 22 and the backplane 76 to take the corresponding action with respect to the safety alarm. In a similar manner, other viewing applications may display information or data from both the process control system 12 and the safety system 14 as these systems may use the same types and kinds of parameters, security and referencing so that any data from one of the systems 12 and 14 can be integrated into a display or view traditionally provided for a process control system.

The diagnostic application 84 may be used to implement diagnostics or maintenance programs within the process control and safety system of the plant 10. Such diagnostic applications, which may perform any desired types of diagnostics or maintenance procedures, such as running process and valve tests, startup procedures, etc., may provide overrides to one or more voter function blocks (described below) used within the process plant 10 to prevent operation of the safety system based on inputs from one or more devices effected by the diagnostic procedures.

In any event, the applications 80, 82 and 84, as well as any other applications may send separate configuration and other signals to and may receive data from each of the process controllers 24 and 26 as well as from each of the safety system logic solvers 50 56. These signals may include process-level messages related to controlling the operational parameters of the process field devices 40 and 42, and may include safety-level messages related to controlling the operational parameters of the safety-related field devices 60 and 62. While the safety logic solvers 50 56 may be programmed to recognize both the process-level messages and the safety-level messages, the safety logic solvers 50 56 are capable of distinguishing between the two types of messages and will not be capable of being programmed or effected by process-level configuration signals. In one example, the programming messages sent to the process control system devices may include certain fields or addresses which are recognized by the safety system devices and which prevent those signals from being used to program the safety system devices.

If desired, the safety logic solvers 50 56 may employ the same or a different hardware or software design as compared to the hardware and software design used for the process control I/O cards 28 36. The use of alternate technologies for the devices within the process control system 12 and devices within the safety system 14 may minimize or eliminate common cause hardware or software failures. Furthermore, the safety system devices, including the logic solvers 50 56 may employ any desired isolation and security techniques to reduce or eliminate the chances of unauthorized changes being made to the safety-related functions implemented thereby. For example, the safety logic solvers 50 56 and the configuration application 80 may require a person with a particular authority level or a person located at a particular work station to make changes to the safety modules within the logic solvers 50 56, with this authority level or location being different from the authority or access level or location needed to make changes to the process control functions performed by the controllers 24 and 26 and the I/O devices 28 36. In this case, only those persons designated within the safety software or located at workstations authorized to make changes to the safety system 14 have authorization to alter safety-related functions, which minimizes the chances of corruption to the operation of the safety system 14. As will be understood, to implement such security, the processors within the safety logic solvers 50 56 assess the incoming messages for proper form and security and operate as gatekeepers on changes being made to the safety-level control modules 58 executed within the safety logic solvers 50 56.

As will be understood, the use of the backplane 76 in each of the nodes 18 and 20 enables the safety logic solvers 50 and 52 and the safety logic solvers 54 and 56 to communicate locally with one another to coordinate safety functions implemented by each of these devices, to communicate data to one another, or to perform other integrated functions. On the other hand, the MPDs 70 and 72 operate to enable portions of the safety system 14 that are disposed at vastly different locations of the plant 10 to still communicate with one another to provide coordinated safety operation at different nodes of the process plant 10. In particular, the MPDs 70 and 72 in conjunction with the bus 74 enable the safety logic solvers associated with different nodes 18 and 20 of the process plant 10 to be communicatively cascaded together to allow for the cascading of safety-related functions within the process plant 10 according to an assigned priority. Alternatively, two or more safety-related functions at different locations within the process plant 10 may be interlocked or interconnected without having to run a dedicated line to individual safety field devices within the separate areas or nodes of the plant 10. In other words, the use of the MPDs 70 and 72 and the bus 74 enables a safety engineer to design and configure a safety system 14 that is distributed in nature throughout the process plant 10 but that has different components thereof communicatively interconnected to enable the disparate safety related hardware to communicate with each other as required. This feature also provides scalability of the safety system 14 in that it enables additional safety logic solvers to be added to the safety system 14 as they are needed or as new process control nodes are added to the process plant 10.

It will be understood that the logic solvers 50 56 may be programmed to perform control activities with respect to the safety devices 60 and 62, using a function block programming paradigm. In particular, as illustrated in an expanded view of one of the safety control modules 58a (stored in the memory 79) of the logic solver 54, a safety control module may include a set of communicatively interconnected function blocks that can be created and downloaded to the logic solver 54 for implementation during operation of the process 10. As illustrated in FIG. 1, the control module 58a includes two voter function blocks 92 and 94 having inputs communicatively interconnected with other function blocks 90, which may be, for example, analog input (AI), digital input (DI) function blocks, or other function blocks designed to provide signals to the voter function blocks 92. The voter function blocks 92 and 94 have at least one output connected to one or more other function blocks 91 which may be analog output (AO), digital output (DO), cause and effect function blocks which implement cause and effect logic, control and diagnostic function blocks which may receive output signals from the voter function blocks 92 and 94 to control the operation of the safety devices 60 and 62, etc. Of course, the safety control module 58a may be programmed in any desired manner to include any types of function blocks along with one or more voter function blocks configured in any desired or useful manner to perform any desired functionality.

While the expanded view of the safety control module 58a of FIG. 1 includes a digital voter function block 92 having five digital inputs and an analog voter function block 94 having three analog inputs, it will be understood that any number of different safety logic modules 58 can be created for and used within each of the different logic solvers 50 56 and each of these modules can include any number of voter function blocks having any desired number of inputs communicatively connected to other function blocks in any desired manner. Likewise, if used in, for example, a Fieldbus network, the voter function blocks 92 and 94, which may be any fieldbus type function blocks, or any of the other function blocks connected thereto could be located and implemented in other devices, such as in the field devices 62. If used outside of a safety system, the voter function blocks 92 and 94 could be implemented in the process controllers 24, 26, the I/O devices 28 36, the field devices 42, etc. As will be generally understood, the voter function blocks 92 and 94 receive typically redundant inputs provided by redundant sensors or transmitters within the safety system 14 and apply a voting scheme to those inputs to determine if, based on all of those inputs, a safety system trip condition exists.

FIG. 2 is a block diagram illustrating the components of the example voter function block 94 of FIG. 1 which is an analog voter function block in that it processes analog input signals delivered via, for example, analog input (AI) function blocks 90. In general, the voter function block 94 includes three inputs labeled IN1, IN2 and IN3 which are adapted to receive analog input signals from, for example, redundant sensors or other redundant elements within the process plant 10 such as from the field devices 60 and 62 of FIG. 1. Each of the inputs IN1 IN2 and IN3 is-provided to one of a trip limit check block 95a, 95b or 95c and to a pre-limit check block 96a, 96b or 96c. The trip limit check blocks 95 compare the input delivered thereto to a preset limit to determine if the input signal has reached a value (which may be a high value, a low value or a value within a predetermined range) associated with a trip condition. In a similar manner, the pre-limit check blocks 96 compare the input delivered thereto to a preset pre-limit to determine if the input signal has reached a value (which may be a high value, a low value or a value within a predetermined range) associated with an alarm or a warning that indicates that a trip condition, while not yet existing, is close to existing. In effect, the pre-limit check blocks 96 enable an alarm or event signal to be created that indicates that a hazardous or otherwise undesirable condition is close to existing, even though it does not yet exist.

The outputs of the trip limit check blocks 95 and the pre-limit check blocks 96 (which may be, for example, digital signals that are set to a high valve when the limits or the pre-limits are met in the blocks 95 and 96) are each delivered to one of a set of input bypass inhibit blocks 98a, 98b and 98c. The input bypass inhibit blocks 98 perform input inhibits on the individual inputs IN1, IN2 and IN3 so that one or more of these inputs may be inhibited, that is, not used within the voter function block 94 to determine if a trip condition exists or if a pre-trip alarm condition exists. Each of the input bypass inhibit blocks 98 provides an output for the associated trip limit condition to a trip voter logic block 100a and provides an output for the associated pre-limit condition to a pre-trip voter logic block 100b. The voter logic blocks 100a and 100b perform voter logic as described in more detail below to determine if, based on the inputs thereto, a trip condition or a pre-trip alarm condition exists.

The trip voter logic block 100a and the pre-trip voter logic block 100b provide a trip signal and a pre-trip alarm signal (when these conditions are determined to exist), respectively, to a startup inhibit block 102 which may inhibit the voter function block 94 from providing any trip signal or pre-trip alarm signal output during, for example, a startup or other performance or run-time procedure in which it is desirable to inhibit the operation of the voter function block 94. The startup inhibit block 102 develops a trip output signal (labeled Out) determined as a result of the operation of the trip voter logic block 100a and the startup inhibit block logic and additionally develops a Pre_out signal determined as a result of the operation of the pre-trip voter logic block 100b and the startup inhibit block logic. The Out signal may be used to drive the operation of a shutdown procedure within the safety system 14 of FIG. 1, while the Pre_out signal may be used to provide alarming to indicate the fact that a trip condition is close to existing within the process plant 10. Of course, the Out and the Pre_out signals may be used for other purposes if so desired.

The voter function block 94 may include a set of parameters, some of which are indicated in FIG. 2 above or below the blocks in which they are used, which are set during, for example, configuration of the voter function block 94 to effect or specify the operation of the voter function block 94. In particular, a trip limit (Trip_Lim) and a pre-trip limit (Pre_Trip_Lim) parameter are used to set or establish the trip limits used in the trip limit blocks 95 and to set the pre-trip limits used in the pre-limit check blocks 96. The trip limit and/or the pre-trip limit parameters may be the same for each of the different blocks 95 and 96 or may be set individually for each of the block 95 and 96. Similarly, a trip hysteresis (Trip_Hys) and a pre-trip hysteresis (Pre_Trip_Hys) parameter are used to set the hysteresis that the blocks 95 and 96 must travel through between Successive trips. That is, once one of the blocks 95 or 96 detects one of the input signals being above (or below) a limit, the hysteresis value of the type hysteresis parameter (for the blocks 95) and the hysteresis value of the pre-trip hysteresis parameter (for the blocks 96) determine how far below (or above) the limit the input signal must travel before the trip signal (or pre-trip signal) is turned off or before enabling a second trip signal (or pre-trip signal) to be set by that block.

The voter function block 94 also has an internal trip type configuration parameter named Trip_Type which defines the normal and tripped state values associated with the inputs and/or outputs of the voter function block 94. For e