Abstract:
A system, apparatus and method are provided for testing a secondary servo control circuit in a redundant control configuration. A first circuit is configured to receive a control signal and to control an attribute of an actuator based on the control signal using a first control input of the actuator. A second circuit is configured to test operation of an actuator circuit using a test signal. The actuator circuit includes at least part of the second circuit and a second control input of the actuator. The test signal is selected to avoid causing independent motion of the actuator. The actuator could be a dual coil servo valve, and the test signal could be a current (such as a DC current, an AC current, or a pulsed current) having a magnitude less than a bias current of the actuator.

Description:
TECHNICAL FIELD 
     This disclosure relates generally to process control systems. More specifically, this disclosure relates to a system, apparatus, and method for testing a secondary servo control circuit in a redundant control configuration. 
     BACKGROUND 
     Processing facilities are often managed using process control systems. Example processing facilities include (but are not limited to) manufacturing plants, chemical plants, crude oil refineries, ore processing plants, and paper or pulp manufacturing and processing plants. Among other operations, process control systems typically manage the use of motors, valves, and other industrial equipment in the processing facilities. 
     In conventional process control systems, process controllers are often used to control the operation of the industrial equipment in the processing facilities. The process controllers could, for example, monitor the operation of the industrial equipment, provide control signals to the industrial equipment, and generate alarms and notifications when malfunctions are detected. As an example, a process control system may provide redundant servo controllers to ensure continued control of critical, high availability subsystems in the case of a failure in a servo system. Failures may include malfunctioning servo coils, field cables, drive circuits, or other servo control components. 
     When a failure occurs, the process control system may sense the failure in one of the two circuits providing redundant control of the servo system, isolate the failed circuit, and switch control of the servo system to the other control circuit of the redundant pair automatically. Central process controllers and/or local process controllers may provide the failure sensing and control switchover/failover functionality. 
     SUMMARY 
     This disclosure provides a system, apparatus, and method for testing (or monitoring) a secondary servo control circuit in a redundant control configuration. 
     In a first embodiment, a method includes, in a primary control circuit, receiving a control signal and controlling an attribute of an actuator based on the control signal using a first control input of the actuator. The method further includes, in a secondary control circuit, testing operation of an actuator circuit using a test signal. The actuator circuit includes at least part of the secondary control circuit and a second control input of the actuator. The test signal is selected to avoid causing independent motion of the actuator. 
     In a second embodiment, an apparatus includes a first circuit and a second circuit. The first circuit is configured to receive a control signal and to control an attribute of an actuator based on the control signal using a first control input of the actuator. The second circuit is configured to test operation of an actuator circuit using a test signal. The actuator circuit includes at least part of the second circuit and a second control input of the actuator. The test signal is selected to avoid causing independent motion of the actuator. 
     In a third embodiment, a system includes an actuator, a first circuit, and a second circuit. The actuator comprises first and second control inputs. The first circuit is configured to receive a control signal and control an attribute of the actuator based on the control signal using the first control input of the actuator. The second circuit is configured to test operation of an actuator circuit using a test signal. The actuator circuit includes at least part of the second circuit and the second control input of the actuator. The test signal is selected to avoid causing independent motion of the actuator. 
     Other technical features may be readily apparent to one skilled in the art from the following figures, descriptions, and claims. 
    
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
       For a more complete understanding of this disclosure, reference is now made to the following description, taken in conjunction with the accompanying drawings, in which: 
         FIG. 1  illustrates an example portion of a process control system according to this disclosure; 
         FIG. 2  illustrates an example dual coil servo valve control system according to this disclosure; 
         FIG. 3  illustrates an example graph of coil current versus time during changeover from a primary controller to a secondary controller according to this disclosure; and 
         FIG. 4  illustrates an example process for testing a secondary servo control circuit in a redundant control configuration according to this disclosure. 
     
    
    
     DETAILED DESCRIPTION 
       FIGS. 1 through 4 , discussed below, and the various embodiments used to describe the principles of the present invention in this patent document are by way of illustration only and should not be construed in any way to limit the scope of the invention. Those skilled in the art will understand that the principles of the invention may be implemented in any type of suitably arranged device or system. 
       FIG. 1  illustrates an example portion of a process control system  100  according to this disclosure. The embodiment of the system  100  shown in  FIG. 1  is for illustration only. Other embodiments of the system  100  may be used without departing from the scope of this disclosure. 
     The portion of the process control system  100  shown in  FIG. 1  includes a turbine  102  and a valve  104 . The valve  104  may control a supply of fuel, cooling fluid, or some other fluid or gas used for operation of the turbine  102 . The valve  104  receives a supply of the gas or fluid via an input  106  and provides a controlled amount of the gas or fluid to the turbine  102  via an output  108 . 
     Valve control circuits (VCCs)  110   a  and  110   b , which control the valve  104  via control links (or cables)  112   a  and  112   b , respectively, provide redundant control of the valve  104 . The valve  104  is a dual coil servo valve. Either coil is capable of controlling the position of the valve  104  on its own, or the coils are operable to control the position of the valve  104  cooperatively. By providing redundant VCCs  110   a  and  110   b , redundant control links  112   a  and  112   b , and a dual coil servo valve  104 , the system  100  reduces or eliminates the possibility of loss of proper control of the valve  104  due to failure of a single component, which could result in damage to or shutdown of the turbine  102 . 
     The VCCs  110   a  and  110   b  receive control signals from a process control system (PCS)  114  via a communication link  116 . To reduce or eliminate the possibility of a single point of failure, the communication link  116  comprises a redundant pair of links between the PCS  114  and the VCCs  110   a  and  110   b . In other embodiments, the communication link  116  may comprise single separate links between the PCS  114  and each of the VCCs  110   a  and  110   b . In still other embodiments, the communication link  116  may be a bus, network, or other communication link. 
     The VCCs  110   a  and  110   b  also communicate with each other via a communication link  118 . As will be explained in more detail with reference to  FIG. 2 , the VCCs  110   a  and  110   b  may exchange signals via the communication link  118 . This can be done to cause a control changeover in the event of a failure in the primary control circuit. It can also be done to allow one control circuit to inhibit the other control circuit from controlling the valve  104 . 
     In some systems, the PCS  114  sends a desired setpoint for the valve  104  to both VCC  110   a  and VCC  110   b . Each VCC drives half of the current (or another specified share of full current). A failure in either set of circuits, cables, or coils may result in the remaining, properly operating circuit providing full control current to the valve  104 . In this system, proper operation of both sets of circuits, cables, and coils may be monitored during normal operation because current may always be provided by each set of control circuits, cables, and coils. 
     In other systems, one VCC drives the full current required to position the valve  104  at a position commanded by the PCS  114 , while the other VCC provides no current to the valve  104  or otherwise remains in standby or inhibit mode. In these systems, a failure in the control circuit, cable, or coil of the active VCC results in the other VCC assuming control of the valve  104 . However, while the backup VCC is in standby, determining a functional status of the backup control circuit, cable, and coil may be difficult. 
     As described in more detail with reference to  FIG. 3 , the process control system  100  provides control of the valve  104  from, for example, the VCC  110   a , while the VCC  110   b  generates a diagnostic current or other test signal to test its control circuit, cable, and coil without significantly affecting control of the valve  104  by the VCC  110   a . In this way, a functional status of the backup control circuit, cable, and coil of the VCC  110   b  may be determined. 
     While the valve  104  is shown in  FIG. 1  as a control element for a turbine  102 , in other embodiments a control system may be employed to control a process control actuator for use with a furnace, mixing system, or other process component requiring highly reliable control of a manipulated variable. Further, while the valve  104  in this example is a dual coil servo valve, in other embodiments a control system may use any other process control actuator having two or more control inputs. In addition, while the system  100  in this example controls a position of the valve  104 , a control system may be used to control other attributes of an actuator, such as rotational velocity of a motor. 
       FIG. 2  illustrates an example dual coil servo valve control system  200  according to this disclosure. The embodiment of the valve control system  200  shown in  FIG. 2  is for illustration only. Other embodiments of the valve control system  200  may be used without departing from the scope of this disclosure. 
     In this example, a dual coil servo valve  204  includes a coil  220   a  and a coil  220   b , which can be operated together or separately to control a position of a valve element  205 . The valve element  205  regulates an amount of a fluid or gas passing from an input  206  of the valve  204  to an output  208  of the valve  204 . 
     A valve control circuit (VCC)  210   a  controls the coil  220   a  via a control link  212   a . Similarly, a VCC  210   b  controls the coil  220   b  via a control link  212   b . The VCC  210   a  includes a kernel board  224   a  and an application board  246   a . Similarly, the VCC  210   b  includes a kernel board  224   b  and an application board  246   b . In some embodiments, the kernel boards  224   a  and  224   b  include primarily digital circuitry and the application boards  246   a  and  246   b  include primarily analog circuitry. In other embodiments, the kernel boards  224   a  and  224   b  and the application boards  246   a  and  246   b  may include other proportions of digital and analog circuitry. 
     The VCC  210   a  and VCC  210   b  are controlled via a communication link  216  by a process control system (PCS)  214 . The kernel boards  224   a  and  224   b  receive commands and provide responses to the PCS  214  using a communication protocol appropriate to the communication link  216 . The kernel boards  224   a  and  224   b  respectively provide control signals for the coils  220   a  and  220   b  on control links  242   a  and  242   b . The kernel boards  224   a  and  224   b  include servo disable logic circuits  234   a  and  234   b , respectively, which provide disable signals for the coils  220   a  and  220   b  on control links  244   a  and  244   b.    
     The kernel boards  224   a  and  224   b  also communicate directly with each other using a communication link  218 . The communication link  218  includes a backup request link  238  and an inhibit command link  240 . The backup request link  238  can transport two unidirectional signals, one from each of the VCCs  210   a  and  210   b  to the other. Using the backup request link  238 , if VCC  210   a  (for example) is acting as a primary controller, it is operable to signal the VCC  210   b  to take over as primary controller. In some circumstances, the VCC  210   a  might send the backup request signal upon internally sensing a failure in its circuits or program execution. In other circumstances, the VCC  210   a  might send the backup request signal in response to a command from the PCS  214 , where the PCS  214  has identified a failure in the operation of the VCC  210   a  or has received an indication from a service technician that service is to be performed on the VCC  210   a.    
     The inhibit command link  240  can also transport two unidirectional signals, one from each of the VCCs  210   a  and  210   b  to the other. Either VCC may command the other VCC to inhibit (or disable) its servo control output to the valve  204 . The VCCs  210   a  and  210   b  disable their servo outputs by disconnecting their circuits from their associated respective coils  220   a  and  220   b  in the valve  204 . Additionally or alternatively, a VCC may inhibit its circuit in response to a command from the PCS  214 . The VCCs  210   a  and  210   b  include servo disable logic  234   a  and  234   b , respectively, which operate to inhibit servo control by the application boards  246   a  and  246   b  via the control links  244   a  and  244   b , respectively. 
     The kernel board  224   a  can generate a control signal for the coil  220   a  on the control link  242   a  based upon commands received from the PCS  214  and logic circuits internal to the kernel board  224   a . The application board  246   a  includes a digital-to-analog converter  226  that receives a control signal from the kernel board  224   a  and converts the control signal to an analog control voltage. The analog control voltage is input to a current source  228   a , which provides to the coil  220   a  a control current that is based upon the analog control voltage. The control current passes through an inhibit switch  230   a , the control link  212   a , the coil  220   a , and a sense resistance  232   a  to ground. A similar circuit is provided in the application board  246   b  with like-numbered elements to pass a control current through the coil  220   b.    
     In one aspect of operation, the PCS  214  can command the VCC  210   a  to operate as a primary control circuit for the valve  204  and the VCC  210   b  to operate as a secondary (or backup) control circuit for the valve  204 . Subsequently, the PCS  214  can issue a command to position the valve  204  at a specified setting. However, only the VCC  210   a  may perform the command by producing a current for the coil  220   a  to move a position of the valve element  205 , thereby achieving a desired setting. The VCC  210   b  can store the command for use if the VCC  210   b  is requested to assume primary control of the valve  204 . 
     While the VCC  210   a  is acting as the primary controller for the valve  204 , the VCC  210   b  produces a diagnostic current or other test (or monitor) signal from the current source  228   b . The test signal passes through circuit elements of the application board  246   b , the control link  212   b , the coil  220   b , and the sense resistance  232   b  (collectively, the “coil circuit” or the “actuator circuit”). The application board  246   b  makes two measurements to monitor the coil circuit for failure. 
     First, the application board  246   b  senses a voltage produced across the sense resistance  232   b  by the test signal. If no voltage or an incorrect voltage is produced across the sense resistance  232   b , the application board  246   b  can determine that a failure has occurred in one or more elements of the coil circuit. Additionally, the application board  246   b  senses a voltage produced across the coil  220   b , control link  212   b  and sense resistance  232   b  by the test signal. If no voltage or an incorrect voltage is produced across the coil  220   b , control link  212   b  and sense resistance  232   b , the application board  246   b  can determine that a failure has occurred in one or more elements of the coil circuit. In some embodiments, one or the other of these two measurements may be made by the application board  246   b . If either of the measurements indicates a failure in the coil circuit, the VCC  210   b  can then report this failure condition to the PCS  214 . 
     While the voltages measured by the application board  246   b  indicate that the coil circuit is operating properly, the VCC  210   b  is operable to receive a command to assume primary control of the valve  204 . The command may come from the VCC  210   a  via the backup request link  238  or from the PCS  214  via the communication link  216 . If the command comes from the VCC  210   a  and indicates a failure in the VCC  210   a , the VCC  210   b  may send an inhibit signal on the inhibit command link  240  to disable the output of the VCC  210   a.    
     By operating the secondary VCC to generate a test signal, proper operation of the secondary controller coil circuit may be confirmed. Furthermore, electrical stress on the coil circuit of the secondary VCC is reduced, relative to a system in which both VCCs operate together to drive the coils  220   a  and  220   b  to position the valve  204 . The PCS  214  may periodically switch primary control of the valve  204  from the VCC  210   a  to the VCC  210   b  and back again in order to equalize electrical stress on the coil circuits of the VCC  210   a  and the VCC  210   b , which may result in better long term reliability of the coil circuits. 
     The magnitude of the diagnostic current generated by the current source  228   b  is selected to be less than a bias current required by the coil  220   b  so that the diagnostic current does not produce movement in the valve element  205 . However, the magnitude of the diagnostic current is also selected to be greater than a noise level of current in the coil circuit so that the diagnostic current may be reliably sensed above the noise level. Typically, the magnitude of the diagnostic current is selected to be as small as possible while being large enough to be reliably detected above any noise present in the coil circuit. In some embodiments, the VCC performs a calibration procedure at configuration, power-up or upon command from the PCS  214  to select a diagnostic current magnitude that is appropriate to the operating conditions of the coil circuit. 
     The diagnostic current may be a DC current, an AC current, a pulse current, or any other appropriate continuous or varying current. The diagnostic current through the coil  220   b , while not producing movement of the valve  204  on its own, may act to augment or counteract forces applied to the valve element  205  by the coil  220   a . Any such force may be corrected for as a disturbance variable by a proportional-integral-derivative or other feedback control mechanism employed by the VCC  210   a  in driving the valve  204  to the setting commanded by the PCS  214 . 
     Where a continuous diagnostic current is used to detect a failure in the coil circuit, the VCC  210   b  may change the diagnostic current to a pulsed current once a failure has been detected. This change may be made where a continuous diagnostic current applied to a failed coil circuit would generate a voltage build-up in the coil circuit across the failed circuit element. The voltage build-up may cause damage to other circuit elements or may be dangerous to service technicians or other operations personnel. 
       FIG. 3  illustrates an example graph  300  of coil current versus time during changeover from a primary controller to a secondary controller according to this disclosure. For clarity, the graph  300  is described with reference to the dual coil servo valve control system  200  and the example scenario in which the VCC  210   a  operates as a primary controller and the VCC  210   b  operates as a secondary controller. 
     A first trace  302  shows a current from the primary controller VCC  210   a  for controlling a position of the valve  204 . At time  308 , the VCC  210   a  fails, and the current supplied to the coil  220   a  drops to zero. Prior to the time  308 , the secondary controller VCC  210   b  generates a diagnostic current through the coil  220   b  shown by a second trace  304 . A third trace  306  shows a combined current through the coils  220   a  and  220   b , which results in a commanded position of the valve  204 . As may be seen from the graph  300 , because of the effect of the diagnostic current  304  through the coil  220   b , the VCC  210   a  generates a lower current through the coil  220   a  than would otherwise be required to position the valve  204  at the commanded position. 
     When the failure of the VCC  210   a  is sensed at time  308 , a process to changeover primary control of the valve  204  to the VCC  210   b  is commenced. By time  310 , the changeover of control is complete. During the changeover, the VCC  210   b  increases the current through the coil  220   b  to the level of the combined current  306  prior to time  308  to drive the valve  204  to the commanded position. Between time  308  and time  310  (after the current from the VCC  210   a  falls off and while the current from the VCC  210   b  is rising to the appropriate level), the combined current  306  decreases before returning to the appropriate level at time  310 . In a properly designed system, this transient deviation in the combined current  306  does not adversely affect operation of the turbine  102  or other process component with which the valve  204  is associated. 
       FIG. 4  illustrates an example process  400  for testing a secondary servo control circuit in a redundant control configuration according to this disclosure. For ease of explanation, the process  400  is described with reference to the system  200  of  FIG. 2 . The same or similar process  400  could be used with other systems, such as the system  100  of  FIG. 1 . 
     In step  402 , the VCCs  210   a  and  210   b  perform a calibration procedure at configuration, power-up or upon command from the PCS  214  to select diagnostic current magnitudes appropriate to the operating conditions of their respective actuator circuits. The VCC  210   a  may select a magnitude that is below a bias current of the coil  220   a  while also being above a noise level of the actuator circuit formed by the application board  246   a , the control link  212   a , the coil  220   a , and the sense resistance  232   a.    
     In step  404 , the VCCs  210   a  and  210   b  receive one or more configuration commands from the PCS  214 . The commands may instruct the VCC  210   a  to act as a primary control circuit for the valve  204  and the VCC  210   b  to act as a secondary control circuit for the valve  204 . Based upon the commands, the VCC  210   b  may begin testing its actuator circuit using techniques such as those described above, and the VCC  210   a  may begin performing servo control of a position of the valve  204 . 
     In step  406 , the VCC  210   a  receives a control signal from the PCS  214  and controls a position of the valve element  205  based on the control signal. Concurrently, in step  408 , the VCC  210   b  is testing operation of its actuator circuit using a test signal (such as a diagnostic current) with a magnitude as selected in step  402 . The test signal may be a DC current, an AC current, a pulsed current, or other suitable signal. 
     If the VCC  210   b  detects a failure in its actuator circuit in step  408 , the VCC  210   b  may optionally resume testing the failed circuit using a second test signal at step  410 , where the second test signal is different from the test signal used in step  408 . In an actuator circuit that has failed as an open circuit, applying a continuous current to the failed circuit could cause a voltage to build up across the two branches of the open circuit. Where the test signal used in step  408  is a continuous current, in step  410  the VCC  210   b  may use a test signal such as a pulsed current. This can allow voltage built up during the pulsed current to dissipate during periods when the diagnostic current is off. 
     In some embodiments, some or all of the VCCs  110   a  and  110   b , the kernel boards  224   a  and  224   b , and the application boards  246   a  and  246   b  may be implemented using a processing device and a memory that includes program code. In other embodiments, some or all of the VCCs  110   a  and  110   b , the kernel boards  224   a  and  224   b , and the application boards  246   a  and  246   b  may be implemented with fixed or programmable logic configured to perform the methods described above. Kernel board  224   a  and application board  246   a  (and similarly kernel board  224   b  and application board  246   b ) may be implemented as single printed circuit board (PCB) or as two separate PCBs. 
     In some embodiments, various functions described above are implemented or supported by a computer program that is formed from computer readable program code and that is embodied in a computer readable medium. The phrase “computer readable program code” includes any type of computer code, including source code, object code, and executable code. The phrase “computer readable medium” includes any type of medium capable of being accessed by a computer, such as read only memory (ROM), random access memory (RAM), a hard disk drive, a compact disc (CD), a digital video disc (DVD), or any other type of memory. 
     It may be advantageous to set forth definitions of certain words and phrases used throughout this patent document. Terms like “receive” and “communicate,” as well as derivatives thereof, encompass both direct and indirect communication. The terms “include” and “comprise,” as well as derivatives thereof, mean inclusion without limitation. The term “or” is inclusive, meaning and/or. The phrases “associated with” and “associated therewith,” as well as derivatives thereof, may mean to include, be included within, interconnect with, contain, be contained within, connect to or with, couple to or with, be communicable with, cooperate with, interleave, juxtapose, be proximate to, be bound to or with, have, have a property of, have a relationship to or with, or the like. 
     While this disclosure has described certain embodiments and generally associated methods, alterations and permutations of these embodiments and methods will be apparent to those skilled in the art. Accordingly, the above description of example embodiments does not define or constrain this disclosure. Other changes, substitutions, and alterations are also possible without departing from the spirit and scope of this disclosure, as defined by the following claims.