Abstract:
A means of controlling a process with a multiplicity of measurements dependent on one process parameter, so that only the most constraining of the measurements manipulates the process in such a way that the performance of each individual controller selected is equivalent to the performance if there were a single controller controlling only one measurement, the most constraining variable. The means of controlling also manipulates the process to prevent a measurement, that is within a process constraint limit, from excessively exceeding that process constraint limit when it is projected that it would do so without the corrective manipulation.

Description:
FIELD OF THE INVENTION 
     This invention is directed to a method for controlling a process having a plurality of measured variables each affected by and dependent upon a single process parameter with each measurement being controlled through adjustment of the process parameter. The method utilizes a preemptive constraint control system which automatically optimizes performance of a process unit by continuously monitoring selected operating variables associated with the operation of the unit. 
     BACKGROUND OF THE INVENTION 
     The success of many process operations depends on the ability to monitor, to regulate and to control process conditions such as pressure, temperature, velocity, density, flow, weight, inventory among other measured or calculated conditions. These conditions are controlled through feedback of a signal, representing the measured or calculated condition, to a controller that manipulates the process based upon the difference between the signal and a desired value or control setpoint. A typical controller uses proportional integral and derivative (PID) control algorithms. The process is adjusted by manipulating process equipment to effect the flow of energy or material, such as, for example, by adjustment of a valve that impedes or otherwise restricts fluid flow. 
     Control of process conditions is important because process conditions affect product quality and production rate, both of which have a major effect on process plant operating profit. Controlling plant conditions at optimal values helps to maximize profit while deviation of conditions from optimal values reduces profit. Thus, it is economically important to reduce deviation. 
     Optimum conditions are frequently determined by processing and equipment limitations. In a distillation separation process, for example, quality specifications will limit the product impurity content. However, if the impurity is of little value, it is, nevertheless, profitable to sell as much impurity with the product as the quality specification permits. Thus, controlling the product composition as close to specification as possible without violating the specification limit, for example, without introducing too much impurity, is economically advantageous. 
     The amount of energy flowing through a distillation column determines the extent of separation, thus, the amount of product recovery. The amount of energy flowing through the column can be limited by reboiler or condenser heat transfer or by column flooding. Column flooding and heat transfer conditions can be calculated from measurements and used to establish operating limits. Maximum recovery is achieved by controlling column energy flow as close to the limits as possible. This control is implemented by maximizing column energy flow until restricted by a constraint controller with setpoints established at each of the limiting values. 
     In another example, the heating capacity of a furnace or boiler may be limited by some maximum temperature above which structural materials begin to lose integrity. Maximum production is frequently determined by such utility limits. Optimum operation is obtained by maximizing furnace load until temperatures increase to just within maximum limits. 
     Boilers, for example, can be controlled so that they can operate up to but not above their maximum capacity. Pressure is usually the control measurement that determines fuel flow to a boiler. The temperature of a metal boiler tube, a monitored variable, is measured, and this measurement is used as a feedback signal for an override controller that overrides the pressure controller, thus reducing fuel flow when tube temperature exceeds the override controller temperature setpoint. Other limiting measurements can be added to the control scheme to form a constraint control system. 
     The override temperature setpoint is set to a soft limit value below the boiler tube metal failure temperature which is the hard limit. Temperatures above the soft target are said to be in the limit violation direction from the soft target. 
     Fuel flow is adjusted to control either boiler pressure or maximum tube temperature and is the common process parameter. Either pressure or tube temperature can be controlled at an instant of time, but not both. A constraint controller provides a means of combining a pressure controller and a maximum tube metal temperature controller. 
     The control function of temperature overriding pressure control can be implemented through a constraint controller that adjusts the setpoint of a fuel flow controller. In a digital control system, the constraint controller selects the appropriate adjustment from an array of adjustments formed from the outputs of the pressure controller, temperature controller and any other controller included in the constraint controller. The array of adjustments represents the results of the control algorithms operating on the setpoint and monitored variable&#39;s measured value at an instant of time for each of the individual controllers constituting the constraint controller. These instantaneous values are stored in a digital control system for calculation and access. 
     Many process conditions are interrelated so that process adjustments, made to control one condition, affect other conditions. Constraint control systems regulate a selected group of process conditions (monitored variables) at optimal values and within processing and equipment limitations. 
     A constraint controller manipulates a single process adjustment in response to a multiplicity of process conditions or measurements. The constraint controller controls only one process condition at an instant of time. The constraint controller controls at some primary optimal condition or at the most limiting condition. 
     One primary optimal measurement in distillation, for example, is the concentration of product in a recycle stream. The optimal composition setpoint is calculated by balancing recovery energy costs against value of the recovered product. 
     The most limiting condition is the condition whose limit would first be violated in attempting to adjust the process to operate at the primary optimal condition. The mechanisms of associating process adjustments with constrained process conditions and the switching of control to respond to different varying conditions, is the subject of this invention. 
     A constraint controller is a combination of override controllers each interrelated with another and having the ability to override another and to operate in order to maintain the process conditions at an optimum value or at a constraint setpoint that is near, but within, a process limitation. The individual override controllers each develop an output signal value that will regulate the process so as to control the measurement at the setpoint. Only one of the individual override controllers can be successful at controlling its measurement at setpoint because a constraint controller has one output that adjusts one degree of process freedom. Accordingly, some rational must be used to select the individual controller output signal that is to be used to adjust the process. 
     The standard implementation of constraint controller has been to select as the output of the constraint controller either the highest or lowest of the individual controller output signals (adjustment array). Either a high or a low &#34;select&#34; is used depending on which action will move process conditions safely away from the limits. The nonselected controller output signals must track the constraint controller output so that they will promptly assume control when their measurement moves toward the limit violation side of setpoint. Herein lies a problem. 
     Output tracking, applied continuously to the nonselected individual controllers, causes each controller to be poised and ready to assume control. This would appear to be a good control objective, but the practical result is an unresponsive system. Measurement variations cause frequent selection switching among the controllers. Outputs in only one direction are passed through the selector resulting in an excessive distorted gain. The magnitude of the gain increases with increasing frequency of the measurement variation. As a consequence, the individual controllers must be &#34;detuned&#34; for constraint controller stability, which detuning produces poor control response when measurements are such that one controller remains selected, over some extended period. 
     Consider, for example, use of high selection of the output of two velocity mode digital controllers. If both outputs are increasing, the greater change in output is selected at each control execution. If the outputs vary, so that the selected output switches between the two controllers, then the sum of the selected change in outputs is greater than the change in output of either controller over the summation period. The effective gain of the constraint control is greater than the gain of either controller. 
     Consider a second example wherein both outputs are increasing on the average over some period and one of the outputs has an oscillation imposed on it so that it may increase or decrease between executions. In this example, then the constraint controller effective gain can be much greater than in the first example. The contribution to the summed output of the oscillating controller can be a factor greater than one times the net change in oscillating controller output. This occurs because all of the increases and none of the decreases are summed. The effective gain is thus a function of the control disturbance frequency. 
     Any controller tuned unintentionally by a process disturbances will cause problems. This explains why, in practice, it is found that override and constraint controllers are detuned relative to single loop controllers. If the control of a single constraint variable is tuned as a single loop controller, it probably will be unstable in constraint control. The insidious feature is that it may not go unstable until constraints are reached or an oscillating disturbance is encountered. 
     The preemptive constraint control of this invention, solves this problem providing responsive control independent of process disturbance frequency. The preemptive feature of the control takes control action prior to exceeding a limit setpoint, when it is projected that the limit variable would otherwise exceed the limit. Deviations above soft limit setpoints are thereby reduced, enabling soft limits established closer to &#34;hard&#34; constraints. The preemptive constraint control of this invention increases profit by operating closer to constraints. 
     SUMMARY OF THE INVENTION 
     Multiple controllers are combined operatively in a preemptive constraint control system so as to provide responsive regulation of interrelated process conditions keeping all of the conditions within process and equipment limitations and, where possible, at or very near optimal values. The constraint controller generates one output signal that may be split, modified or used directly to adjust the process so as to effect the interrelated process conditions. This adjustment generally is directed to manipulate one degree of freedom in the process, to which the constraint controller process conditions are considered to be dependent variables. 
     This invention is not restricted to a single constraint controller, as described immediately preceding, but also includes interconnection of multiple constraint controllers in a cascade control structure or connection of constraint controllers to other control modules or control technology, utilizing the methodology described herein. In the cascade control structure, the output adjustment from one constraint controller adjusts the setpoint of one of the individual proportional integral derivative (PID) controllers in a second constraint controller. Alternately, the output of the first constraint controller is treated as though it were the output of a PID controller in the second constraint controller. 
     A second degree of freedom for process manipulation may exist that affects process conditions certain of which may be the same process conditions affected by the first degree of freedom. A second constraint controller can be established to manipulate the second degree of freedom. According to this invention, the process interactions between the two constraint controllers are coordinated through the proper structuring of individual controllers in each constraint controller so as to regulate interrelated conditions expressed as limits. These limits can be ratios or other combinations of measured conditions that account for and accommodate measurement interrelationships and process requirements. Other degrees of freedom may be coupled in a like manner. 
     In the present invention, a series of individual controllers, each providing proportional, integral, derivative and other individual control actions, is combined to form a preemptive constraint controller to control interrelated variables. Either the highest or the lowest of the individual controller outputs is selected as the preemptive constraint controller output. Either high or low is chosen based on which action will cause the measurements to move away from limit violation (opposite to the limit violation direction). 
     An infeasible control situation can occur in a cascade control structure containing both a minimum select constraint controller and a maximum select constraint controller. The infeasibility occurs when measured values of monitored variables exceed setpoints in the limit violation direction in both constraint controllers at the same time. Opposing adjustments are required to satisfy both constraint controllers, thus, the infeasibility. This invention handles the infeasibility by inhibiting adjustment and activating an alarm to alert operating personnel to the infeasibility. 
     Constraint controllers, single (PID) controllers and simple ratio controllers as well as other controllers are incorporated into a cascade control structure according to control application requirements. 
     A single controller is used in a cascade structure to regulate a process to desired value. The output adjustment developed by the single controller is cascaded to constraint controllers. The setpoint of a single controller is set to a desired value rather than a limit value. There is no limit violation direction for the single controller. The constraint controller can override single controller output adjustments, in either direction in order to reduce constraint control limit violation without causing control infeasibility. 
     One aspect of this invention is in the use of output selection of multiple individual controller outputs, calculated as described herein, the effect of which causing the output to be selected only when necessary to control the most constraining process condition. Either the highest or the lowest of the output values is selected. A second less constraining condition, with its measurement on the limit violation side of setpoint, will not be selected, even if the measurement oscillates, because the relationship between the measurement and the output that produced the measurement, is maintained. Output tracking destroys this relationship. The relativity is maintained because the proportional term changes the output for changes in measurement and the reset term relates the output to a previous time that the individual controller was selected. This technique avoids the excessive manipulation of the process for every measurement variation in the direction of the limit, as described previously. 
     The setpoints of the PID controller constituting a constraint controller are set to soft target values some distance from and on the non-limit violation side of the hard target. The soft target is established so that it is statistically improbable that the hard target will be violated by setting the distance between hard and soft target at a factor times the measurement&#39;s standard deviation during a representative recent period. 
     This invention provides a means of comparing the severity of constraint violation of measurements with different ranges and units. 
     Output tracking is necessary in conventional constraint and override controllers to prevent reset windup. This invention prevents reset wind-up by disabling error integration, for unselected controllers, except when the measurement is on the limit violation side of setpoint. A nonselected reset term integrates error (deviation of monitored variable from setpoint) on the limit violation side of setpoint. In this way, the constraint may eventually be selected if the limit violation persists too long. Once begun, the integration continues, when the measurement is not on the limit violation side, until the nonselected reset term reaches or passes through zero. This prevents reset windup of the nonselected reset term. 
     As in the standard positional control algorithm, error is integrated in a reset term when the individual controller is selected and outputting. In this invention, integration stops when the controller is no longer selected and the reset term is back calculated from the current output upon initialization, when the constraint controller is first switched on. 
     Premature selection is prevented through calculation of an output &#34;pseudo measurement&#34; for the unselected individual controller. The pseudo measurement is the unselected measurement required to produce the current constraint controller output. This pseudo measurement is back calculated from the constraint control output and the individual controller control equations. Whenever the current measurement is on the limit violation side of setpoint, the difference between the pseudo measurement and actual measurement at last execution is subtracted from the current measurement and the result is used in place of the measured value to calculate the current individual unselected controller output. This prevents the individual nonselected controller from being selected until its measurement violates the limit by more that the pseudo measurement. Thus, the nonselected controller does not take control when output by the selected controller should be adequate to eliminate the nonselected controller error. The pseudo measurement thus maintains a relationship between the constraint controller output, the individual controller output and the individual controller measurement that prevents unnecessary switching of selected controllers while the selected controller is responsively controlling at the most constraining setpoint. 
     In the following description, the controllers are described as positional mode digital controllers; however, the invention applies equally well with, for example, velocity mode control systems. The main difference, between the two modes, is that in velocity mode, reset integration occurs in the setpoint receiving the output. In positional mode, the reset integration is summed and stored in a term used in the positional control calculation. This stored sum is utilized to effect the desired control result of this invention. Output adjustments, measured values, pseudo measurements and setpoints are stored in a digital system. The proportion mode constraint control of this invention is applicable to a velocity mode system since the velocity mode system retains positional values for setpoints. The positional mode preemptive constraint controller is made transparent to a velocity system through proper interfacing. 
     The preemptive feature of this invention develops constraint control output, to prevent limit violation, in two ways when there is an increased probability of a limit being violated. In one way, the rate of change of the measurement (a derivative type control response) is calculated and the absolute value compared to a threshold value. If the threshold value is exceeded the derivative term is included in the individual controller output. This derivative action may optionally be taken only if the eventual resting value is beyond the limit, or, optionally, if the measurement is within some minimum approach to the limit or beyond the normal distribution of the measurement. The described derivative action makes adjustments to the process to prevent limit violations when the measurement is far from the limit and setpoint, in the unlimited direction, and when the measurement is rapidly approaching the limit. The threshold value can be set to minimize the effect of high frequency, low amplitude variations that are particularly troublesome in sample data digital systems preventing the controlled process from reaching acquiescent steady state. Setting the threshold value to slightly more than three times the current standard deviation prevents response to normal variation so that the control can identify and respond to excursions that will probably violate the setpoint. Control response is achieved by adding the output change, generated by derivative action to the last constraint controller output. This added chance is the rate portion of the total output due to rate of approach to a limit. The derivative term will not be added if this individual controller was selected during the last execution. 
     A standard variation range is established by both adding and subtracting a factor times the standard deviation to the measurement mean. Measurement variation beyond the standard deviation is used to indicate process transition requiring special control action. 
     The second preemptive action results through prediction of unrealized change in measurement from past changes in constraint controller output. This unrealized change in measurement, when added to the current measurement, predicts the measurement eventual resting value with no further disturbance. If this resting value exceeds the limit then the correction in output required to prevent limit violation is developed for the individual controller, using the process gain, a tuneable projection gain and a projection reset time. The difference between the resting value and setpoint is used as error in a control algorithm calculation to modify adjustments of the common process parameter. The unrealized change in measurement is calculated from previous constraint controller outputs stored in an array of adjustments implemented during a period of at least two time constants plus dead time into the past. 
     Step test response data is used to develop an array of fractions or factors , one fraction for each output over the calculation period. The fraction represents the current unrealized measurement for the output at the corresponding fixed time into the past. Recent outputs will have fractions near 1, while the fraction for one time constant plus dead time should be near 0.368. The unrealized measurement is sum of the measurement and fraction products divided by the process gain. The fractional values (factors) may be adjusted to more accurately represent the expected response. 
     Factors near current time may be negative to accommodate initial inverse response. The factors affect control, and therefore, can be further changed to produce a desired dynamic response. 
     The preemptive control has an optional self-adjusting feature that correlates deviation of the measured values beyond the eventual resting value in the limit violation directions. The eventual resting value factors are updated through an adjustable filter so as to reduce deviation from eventual resting value. Factors are updated only when statistically significant deviation is present as determined by the measurement varying beyond its standard variation range. 
     A preemptive integral output is calculated from the difference between the resting value and the setpoint, using the process gain and a projection integral time tuning constant. The integral output is added to the constraint controller output by summing into a special constraint controller reset term which is initialized to a value of zero, or &#34;zeroed,&#34; at each constraint switching. This &#34;integral-only&#34; control is best because the resting value represents full response of previous outputs and projects control offset. Configuration options determine whether the integral output is summed in the individual controller reset term, in the constraint controller reset term, or in both. The preemptive integral output of a selected individual controller may optionally be added to the individual controller reset term (but not the constraint controller reset term). The total integral action of the selected individual controller will thus contain one part due to actual measurement and one part from the unrealized measurement. 
     Optionally the unrealized measurement can be calculated based on the difference between the constraint controller and individual controller outputs in place of the summation of past outputs. 
     The primary objective of this invention is to provide a means of controlling a process with a multiplicity of measurements dependent on one process parameter, so that only the most constraining of the measurements manipulates the process in such a way that the performance of each individual controller selected is equivalent to the performance if there were a single controller controlling only one measurement, the most constraining variable. A secondary objective is to manipulate the process to prevent a measurement, that is within a process constraint limit, from excessively exceeding that process constraint limit when it is projected that it would do so without the corrective manipulation. 
     The invention as presented can be translated into rules and implemented in a rule based &#34;fuzzy logic&#34; control system. 
    
    
     DESCRIPTION OF THE DRAWINGS 
     FIG. 1 is a flow chart showing certain velocity mode control expressions, in accordance with the preemptive constraint control of the present invention. 
     FIG. 2 is a diagrammatic representation of application of the invention in control of combustion in a steam boiler. 
    
    
     DESCRIPTION OF THE PREFERRED EMBODIMENT 
     The method of preemptive constraint control can be implemented in a computer based control system by executing a series of steps, calculations and logic. The executions reoccur on a schedule to develop process adjustments that affect process conditions so as to control the conditions. The adjustments are applied to adjustable process parameters. The conditions are measured and the measurements are used in a control equation to develop a control output that is a process parameter adjustment. 
     FIG. 1 presents the steps, calculations and logic used to develop changes in output (dO), for each individual controller in a preemptive constraint controller. The control equation is the bottom line of Block 14 and can be viewed as the sum of three outputs, one (G * Kp * dE) for proportional control, one (dOr) for integral control and one (dOd) for derivative control. The proportional output is computed from &#34;G&#34; the control gain, &#34;Kp&#34; the process gain, and dE, the change in control error. 
     Terms may take on different characteristics depending on the usage. A process condition can be considered as a positional measurement M or as a change in measurement dM. The lower case &#34;d&#34; preceding a variable indicates that the term is the change in a value since the first preceding execution. A lower case &#34;s&#34; preceding a variable indicates that it is a sum of values computed in previous executions. A lower case &#34;i&#34; denotes integers representing previous executions in time. The functional designators &#34;d&#34;, &#34;s&#34; and &#34;c&#34; denote different characteristics of a process value. 
     A constraint controller is a combination of individual controllers, each individual controller responding to one measurement and using a number of control characteristics to develop a process parameter adjustment that controls the measurement, bringing the measured condition to a setpoint. The controllers are combined by selecting either the maximum or the minimum of all the adjustments developed by the individual controllers. The selected adjustment is used as the constraint control adjustment for this execution. The controller developing the selected measurement is the selected controller. All other controllers in the constraint controller are not selected. 
     Block 10 shows calculation of the unselected individual controller measurement change (dMRO) necessary for the controller to produce an adjustment equal to the first preceding process adjustment (dOsp). 
     Block 11 defines values used in the control equation where: 
     M is the current measurement, 
     Mi is the previous execution measurement, 
     SP is the current setpoint, 
     SPi is the previous execution measurement, 
     E is the control error, 
     dE is the change in error since last execution and may include or exclude the effects of changing setpoint, 
     R is an integral tuning constant, 
     G is the control gain, 
     |G|/G is the control action 
     +1 is direct action when increasing measurement requires increasing output, 
     -1 is reverse action when increasing measurement requires decreasing output, 
     Kp is the process gain, 
     dM/dT is the measurement rate of change with time, 
     dOr is the change in output resulting from integral control, and 
     dOd is the change in output resulting from derivative control. 
     Block 12 shows the expected change in measurement (MPO) required to reach the measurement eventual resting value at steady state, based on past process adjustments where: 
     (Gp)i is an i array of factors, each factor representing the current unrealized effect of the process adjustment at the i past execution, i varying from first preceding for a suitable number of past time elements, 
     (dOsp)i is an i array of past process adjustments corresponding to the period defined above, and 
     Kp is the process gain. 
     Block 13 identifies whether an individual controller was selected at the conclusion of the first preceding execution. If the individual controller was selected, the steps of Block 14 are executed. 
     Block 14 shows that an integral measurement summation term (sMr), developed to promote selection of an unselected controller because of measurement offset, is zeroed for initialization. The sum of the change in measurements resulting from output (sMRO), developed in Block 10, is also initialized. A process output adjustment (dO) is developed for the individual controller. Each of the &#34;END&#34; blocks after blocks 14, 27 and 28 denotes completion of the calculations for an individual controller for a given execution. 
     The steps of Block 20 are executed if the individual controller was not selected when the first preceding execution concluded. An indicator (IOr) is developed that is positive when the measurement is on the limit-violating side of setpoint. MINMAXsign is an indicator set to -1 if the constraint controller selects the minimum adjustment and +1 if the constraint controller selects maximum adjustments. If IOr is positive, the logic path flows through Block 21 to Block 22 to integrate the measurement offset from setpoint. 
     The path is through Block 30 when the measurement is sufficiently on the nonlimit violation side of setpoint. Block 31 shows that if there is a residual in the measurement offset sum (sMr), the path is to Block 22, where the residual may be moved toward zero. If sMr passes through zero, the path is to block 32 on the following execution wherein sMr is set equal to zero. 
     Block 23 is a common path from Blocks 22 and 32. Block 23 judges whether controller selection should be encouraged or inhibited based on the relative values of &#34;E&#34;, &#34;sMr&#34; and &#34;sMRO&#34;. True false evaluation of the first expression in Block 24 determines the path. If the statement is greater than 0, i.e. true, the previous outputs are not more than enough to compensate for the current error and the path is through Block 24. Selection is encouraged by developing an output adjustment (dO) as shown on the bottom line of Block 24. This individual controller adjustment is developed for possible selection by the constraint controller. 
     If the measurement is adequately far from the setpoint on the nonlimit violation side, that is, the previous outputs are more then enough to compensate for the current error, then the path is through Block 33 and selection is inhibited. 
     Block 25 performs the summation of changes in measurements resulting from previous outputs (sMRO) and determines whether the measurement and projected measurements, or pseudo measurements, are on the nonlimit violation side of setpoint. If so, the individual controller processing is complete as indicated by the path through Block 28. 
     Block 28 presents the steps performed when the measurement is on the nonlimit violation side of setpoint but recent process adjustments are projected to cause the measurement to move to the limit violation side of setpoint. This is the situation if the first two logic expressions in Block 26 are both found to be true. The offset (M+MPO-SP) of the projected measurement from setpoint is sued to develop an integral adjustment (Opi). The expected resting value is (M+MPO) where MPO is a characteristic of the expected resting value. The constraint controller selects from all individual controller adjustments developed through the current execution and &#34;Opi&#34; is added to the constraint controller selected adjustment, the result being the constraint controller output adjustment to the process. 
     The calculation of MPO is shown in Block 12, before the separation of the logic path and is not used in every path. The calculation of other terms is shown in particular blocks for clarity of presentation but may be calculated in other blocks. 
     Blocks 26 and 27 are shown positioned after block 25 for clarity of presentation, but require the term Osp, an adjustment characteristic selected from individual controller adjustments. All of the individual adjustments must be available for proper functioning of Blocks 26 and 27. 
     Block 27 adds a derivative based output to the final output adjustment if the measurement is projected to move to the limit violation side of setpoint and is rapidly moving in the limit violation direction. The judgement as to rapid motion is made relative to a standard variation (3 * SD+) defined as three times the standard deviation of the output+a small factor. The outputs thusly added are summed so that any residual sum that exists when the derivative crosses zero is used to change the output. This assures that the net effect on the output is zero, when the measurement is no longer moving rapidly. 
     The preferred embodiment is discussed hereinafter in terms of control of a steam boiler. However, the preemptive constraint control of the present invention may be utilized for control of other processes as well. 
     Regulation of the combustion process, such as in a furnace or boiler, in an efficient and safe manner, requires proper adjustment of both fuel and air flow to the combustion zone. The fuel and air flow are two independent manipulated variables. Adjustment of fuel and air must be made to maintain the combustion process, prevent accumulation of explosive volumes of unburnt fuel, avoid implosion due to low internal pressure from sudden reduction in gas inventory, limit equipment temperatures to prevent loss of structural integrity, respond to load changes, avoid combustion that produces pollution and maximize utilizable heat per unit of fuel consumed. These requirements represent numerous limits and constraints to adjustment of fuel and air flow to the combustor. 
     FIG. 2 depicts a steam boiler and the control system embodiment of this invention, the control system is used, for example, for boiler combustion control. Fuel and air are mixed in burner 17 and enter the fire box of the boiler where the mixture ignites to form a flame emanating from burner 17. The products of combustion exit the boiler from exhaust stack 28. Steam drum 27 is partially filled with water which circulates through tubes 37 arranged in the boiler to absorb radiant heat from the flame and convective heat from the combustion gases. The heated water boils and steam and water circulate back to the steam drum where the steam is separated from the water. Steam exits the drum at a flow rate determined by the total demand of various users. Steam drum pressure meter 9 indicates the imbalance between steam supply and demand by increasing when supply exceeds demand and decreasingly when supply is less than demand. 
     In FIG. 2, flow controllers 8 and 14 are depicted measuring flow and manipulating a fuel valve 15 and air damper 19 to control the fuel and air flow to a burner 17. The valve 15 and damper 19 are modulated to regulate the measured fuel flow and air flow to flow setpoint values. A boiler steam drum 27 pressure controller 9 is shown that senses changes in boiler demand and adjusts boiler firing, through the constraint control system of this invention, so as to provide safe efficient operation of the boiler. Carbon monoxide 30 and oxygen 29 measurements of the exhaust gas in the boiler stack 28 are provided as measurement signals to carbon monoxide controller 1, the minimum excess oxygen controller 2, and maximum excess oxygen controller 3 in the preemptive constraint control system. Also shown are controller interconnections and individual controllers that cause the boiler to operate very close to the most constraining limits and within all limits of maximum boiler tube temperature 20, minimum fire box pressure 18, maximum fuel to air ratio 22, minimum air to fuel ratio 25, maximum fuel valve 15 position and minimum air damper 19 position. 
     The combustion process in practice is never perfectly efficient. Complete combustion of the fuel is not achieved with the addition of air containing stoichiometric quantities of oxygen. Air in excess of the stoichiometric amount must be provided for complete combustion otherwise unburnt fuel and carbon monoxide (CO) will exit in the exhaust gases. Excess oxygen, ranging from 6% to 1% or lower, may be provided for complete combustion, depending on furnace design and operating load. 
     Addition of too much excess air decreases efficiency since the excess air exits at a higher temperature than it enters wasting heat. Too little excess air causes incomplete combustion and smoke. The optimum excess air varies with furnace loading decreasing with increasing load due to improved air fuel mixing at maximum design loading. Exhaust carbon monoxide (CO) concentration provides a good measure of combustion efficiency independent of loading. Maximum combustion efficiency is realized at a concentration range of 150 to 300 parts per million of CO. At fixed load, the change in CO concentration with excess air is very nonlinear. The CO concentration goes up very rapidly as excess air approaches zero and goes down very slowly as excess air increases beyond the optimum. This nonlinearity makes optimum control of excess air, based on control of CO concentration, very difficult. The optimum concentration of oxygen in the exhaust gas varies with load so oxygen concentration is not a good optimum control measure. 
     This invention provides optimum efficiency control by adjusting excess air in response to the natural logarithm of carbon monoxide measure provided automatically by known measurement devices. 
     The natural log of carbon monoxide (1 n CO) computed from the CO measurement is controlled to an optimal setpoint of about 5 which corresponds to about 150 PPM carbon monoxide in the exhaust. Control of 1 n CO is achieved through this invention by manipulating dampers, air feed or exhaust blowers or other furnace adjustments that affect air flow to the combustion zone. The calculated 1 n CO is provided as the measurement for individual controller 1 in the constraint controller 31. Setpoint 33 is set to the optimum 1 n Co. 
     Under increasing load conditions, air flow must increase at least as rapidly as fuel to prevent accumulation of uncombusted fuel. If the excess air is to deviate from the optimal value, due to the dynamics of the change, it is prudent to deviate in the direction of excess air rather than too little air to prevent smoking or potential explosive accumulation of unburnt fuel. Too much air is preferred since the only negative effect is loss of efficiency. The control problem that this presents is that the carbon monoxide concentration drops to values too low for accurate measure. This invention provides a control transition to a second individual controller with minimum deviation from optimum combustion and without discontinuity when carbon monoxide drops to an immeasurable value. The second controller is a minimum exhaust oxygen controller. 
     The second controller controls an automatic measurement 29 of exhaust oxygen concentration to a minimum allowed oxygen soft setpoint 34. A decreasing carbon monoxide concentration will cause controller 1 output to decrease air flow. Controller 2 prevents the air flow reduction from reducing exhaust oxygen below the minimum allowed value. The maximum of the outputs from controllers 1 and 2 is selected for output to further constraint control processing. Controller 2 serves to limit both the rate and extent of air reduction and, through the preemptive feature, may take control before the minimum allowed value is reached. The expected resting value factors are adjusted based on furnace control response dynamics. 
     A low oxygen &#34;soft&#34; target is established relative to a low oxygen &#34;hard&#34; limit. The hard limit is the value that should not be violated while the soft target is the second controller setpoint 34. Normal control response will cause oxygen concentrations on either side of the soft limit. The soft setpoint is manually chosen to be comfortably within the minimum oxygen hard limit, or optionally automatically set at slightly more than three standard deviations within the minimum oxygen hard limit. This provides automatic control adaptability to changing process variability. 
     The safe low oxygen hard limit varies with furnace load. Furnace testing or design data defines the relationship of the hard limit value with load. Equations 35 for this relationship are used to calculate the hard limit based on measured or projected load. Load is inferred from a measurement that relates to the amount of combustion such as steam flow from a steam boiler. This hard limit is used, as described above, to calculate soft limit setpoints 34 and 36 for constraint control. 
     The output of the unselected controller does not track the selected output. Error integration for the unselected controller, is limited so that it effects control only for a persisting violation of a limit. 
     When the constraint controller is turned on, initializes and carbon monoxide control is selected, a change in oxygen concentration is calculated that would be required to produce the selected carbon monoxide controller output. This change in output is back calculated through the control equations of minimum excess oxygen controller 2 to obtain the pseudo change in oxygen. The change in oxygen is calculated for each change outputted by the constraint controller 31 and 32 to the air flow and the changes are integrated in controller 2 pseudo oxygen summation term (POST2). 
     POST2 is subtracted from the oxygen measurement used in the control equations of minimum excess oxygen controller 2. This prevents minimum excess oxygen controller 2 from calculating an output that would be selected until after the oxygen analysis 29 moves toward constraint violation enough to equal the output already applied by the carbon monoxide controller 1. Thus, compounding of outputs by the two controllers is prevented. Previous output by the carbon monoxide controller 1, that will aid in reducing violation of the low oxygen limit soft setpoint, is recognized by minimum excess oxygen controller 2. 
     While the carbon monoxide controller 1 is selected and controlling, minimum excess oxygen controller 2 selectively integrates deviation of oxygen below the soft limit. Output generated by the carbon monoxide controller 1 may produce a value of POST2 that permits an oxygen measurement 29 below the soft target without selection of excess oxygen controller 2. This deviation of oxygen below soft target is integrated. The oxygen deviation integral is included with the oxygen measurement for the control output calculation of minimum excess oxygen controller 2. In this way, prolonged deviation of oxygen below the soft limit will eventually cause selection of minimum excess oxygen second controller 2. If the oxygen measurement increases to above the soft limit 34 before controller 2 selection, integration continues until the absolute value of the integral reaches zero. When zero is reached, integration of oxygen above the soft limit ceases. 
     The distance between the point of air entry to the furnace or boiler and the carbon monoxide and oxygen measurement point, causes a transport lag dead time between air manipulation and measurement of the resultant change in composition. This dead time plus the mixing of combustion products with the inventory of gas in the furnace or boiler, causes a gradual change in measured composition for a step change in air flow. This gradual change or response curve can be characterized by a process gain (eventual change in measurement per change in air flow) and a series of fractions representing portions of the change in measurement realized at respective time intervals from the change in air flow. This invention saves the most recent series of changes in air flow for a period of at least two process response periods plus dead time and lag. Summing the product of the fractional series times the change in air flow series yields a projected ultimate resting value of oxygen measurement due to past changes in air flow. A second fraction series similarly characterizes the carbon monoxide ultimate resting value. 
     The preemptive constraint control feature of this invention predicts eventual resting values of oxygen concentration below the soft limit due to decreases in air flow caused by control action response to low carbon monoxide concentration. This invention changes air flow based on the oxygen predicted resting value. The changes in air flow can be calculated based on standard proportional, integral and derivative control response to the predicted eventual resting value. A special feature of this invention is the simplicity afforded by using integral only control for this part of the preemptive feature. The eventual resting value represents oxygen control offset and as such is controlled perfectly by integral only control. 
     A preemptive optional feature sets POST2 equal to zero when the predicted oxygen eventual resting value drops below the soft limit. This serves to allow the minimum excess oxygen controller 2 to assume control of the air flow when oxygen excursions below the soft limit are predicted. 
     There are two problems associated with the application of derivative control action, one related to measurement noise and the other to switching between controllers using derivative. When the carbon monoxide begins to decrease derivative control action causes a reduction in air flow. If the carbon monoxide were to stop decreasing and remain at a new low value, the air flow would be increased, due to derivative action, by exactly the same amount that it had previously been reduced. If, however, minimum excess oxygen controller 2 assumes control before the carbon monoxide stops decreasing, the previous carbon monoxide derivative air flow reduction is not canceled by a carbon monoxide controller 1 derivative increase. This invention resolves this problem, on transition, by increasing air flow to zero the carbon monoxide derivative sum and implementing a derivative move for the oxygen controller as if the oxygen concentration was constant at the last previous execution. 
     Measurements may vary rapidly about a mean value due either to noise or actual process variation. Air leakage, down stream of combustion, combined with turbulent flow can cause the oxygen measurement to vary about a mean, while the concentration leaving the combustion zone is constant at the mean. Since limited amplitude fluctuations about the mean is of no consequence, a control system that ignores the fluctuations is of value. This invention provides such a system. 
     The oxygen concentration standard deviation, for a representative preceding interval, provides the criteria for distinguishing between inconsequential variation and a measurement change requiring derivative control action. Derivative control action is inhibited when the measurement is within a factor of the standard deviation. The factor is adjustable and standardly set somewhat greater than a value of three. When oxygen concentration varies from the running mean of a preceding interval, by more than the factor of standard deviation, a contribution to output is calculated from the derivative portion of the control equation and a summation of the derivative control output is begun. When the oxygen is again within the factor of the running mean, derivative control output and summation continues until the sign of the derivative reverses while the measurement is within the factor of the running mean. At sign reversal a final derivative output is developed to zero the derivative summation term, and for following execution, derivative output is inhibited as before. Derivative control action is similarly provided optionally for carbon monoxide control and other controllers in the preemptive constraint control system. The derivative control action is optionally based only on changes in measurement rather than on changes in error to avoid responding to changes of setpoint. 
     Proportional and integral control action can be similarly inhibited in order to allow the process to reach a quiescent steady state. 
     This invention selects the maximum change in output, developed by the first and second controllers 1 and 2, respectively, for further constraint control processing. Selecting the maximum change, enables the carbon monoxide controller 1 to regulate excess air addition at the optimum value except when this regulation would violate the minimum oxygen limit. Selecting the maximum outputs developed as described above, enables override of carbon monoxide controller 1 by the minimum oxygen controller 2, to prevent low excess oxygen in the furnace or boiler. The selected maximum output of controllers one and two, is further processed by the constraint control of this invention to limit exhaust excess oxygen to a maximum concentration 36. 
     Further constraint control processing may result in selection of a controller different from the ones discussed above. When this occurs, information is passed back up the cascade control structure so that the actual, final output can be used in the calculations for all unselected controllers. 
     Changes in furnace load or fuel composition can cause unnecessarily high increases in air flow in response to high carbon monoxide measurements. Excessively high air flow reduces efficiency and can impair furnace capacity. A third controller is employed in the constraint control of this invention to limit unnecessarily large increases in air flow by controlling the exhaust maximum oxygen concentration 29. A maximum acceptable oxygen limit is calculated 35 for the current furnace load from design and operating information. This maximum acceptable oxygen limit is automatically entered as the third controller setpoint 36 and automatically changes with furnace loading. The preemptive constraint control individual controller technology described previously is applied to the maximum excess oxygen controller 3. The minimum output of controller 3 and the previously selected maximum of the outputs of controllers 1 and 2, is selected for further constraint control processing. 
     Selection of both minimum excess oxygen controller 2 and maximum excess oxygen controller 3 indicates a conflict of oxygen limit setpoints 34 and 36 if neither output was the result of preemptive control action. If the oxygen concentration is beyond the soft limit of only one of controllers 2 and 3, the output of the limit violation controller is used. If the limit setpoints conflict, the condition is alarmed and no change in output is implemented. 
     The selected output of controllers 1, 2 and 3 is supplied as the setpoint to simple ratio 4. The air to heating load is the ratio controlled. The air flow output of this ratio controller is passed on to further constraint control processing. The ratio controller develops an output by multiplying the setpoint by the current BTU heating load. This provides feed forward control. The current BTU heating load is calculated from the current fuel flow target and an inferred or direct measure of fuel BTU value. The output of controller 4 is the air flow target. 
     The simple ratio function of controller 4 can optionally be implemented as an integral only controller. The air flow target, the fuel flow target and the inferred or measured fuel BTU value are used to calculate an air to heating load ratio as the measurement for the integral only controller. The integral time is set equal to the execution frequency. The integral controller gain is set equal to the heating load to air ratio, the inverse of the calculation. 
     Changes to the air flow target are considered with the respective outputs from controllers 5, 6 and 7 for maximum selection in constraint controller 26. The setpoint of the fifth controller is the minimum air flow allowed for the current fuel flow. The measurement for controller 5 is the air flow controller setpoint. The setpoint of controller 5 is calculated by multiplying the minimum allowed ratio 24 of air to fuel by the current fuel flow 14. The measured fuel flow is used or optionally the fuel flow setpoint if the fuel measurement is a &#34;noisy&#34; signal. Reduction of air flow is thus prevented from dropping below the amount required for proper combustion of the current fuel flow. A fuel flow controller deviation alarm interlock is provided, when fuel flow target is used for the fifth controller 5, to prevent decreasing air flow when fuel flow controller 14 is not controlling. 
     The setpoint of controller 6 is the minimum furnace pressure. Controller 6 prevents implosion due to a reduction in forced draft drive or dampers. 
     The setpoint of controller 7 is the minimum position of the air flow manipulator. The manipulator position is feed back as the measurement of controller 7 to prevent air flow controller 8, wind up. 
     Steam drum pressure controller 9, is used in steam generating boilers to sense steam demand. The output of the steam pressure controller adjusts BTU heating load controller 10. The measurement for this integral only heating load controller is calculated from the fuel flow target and the measured or inferred fuel BTU heating value. Feed forward is thus provided for changes in fuel heating value. The output of heating load controller 10 is the fuel flow target. 
     Changes to the fuel flow target are considered with the outputs from controllers 11, 12 and 13 for minimum selection. The setpoint of controller 11 is the maximum fuel flow allowed for the current air flow. The measurement for controller 11 is the setpoint of fuel controller 14. The setpoint of controller 11 is calculated by multiplying the maximum allowed ratio 23 of fuel to air by the current air flow 8. The current air flow is a measured value or optionally the air flow setpoint if the air measurement is a &#34;noisy&#34; signal. Fuel flow increases are thus prevented from increasing beyond the supply of air required for safe combustion. An air flow controller deviation alarm interlock is provided, when air flow target is used as the controller 11 measurement, to prevent increasing fuel flow when the air flow controller 8 is not controlling. 
     The setpoint of controller 12 is a maximum boiler tube temperature. The measurement is a measured boiler tube temperature 20 or the maximum of a series of boiler metal temperatures. Controller 12 prevents firing over loads. 
     The setpoint of controller 13 is the maximum position of fuel valve 15 with the measurement being the actual position of valve 15. 
     The foregoing description is of the preferred embodiment of the invention and is presented for information and illustration and is not intended to limit the scope of the invention. The invention can also be applied in petroleum refining and chemical processes or any process that has measurements and limiting values for said measurements that when the limiting values are exceeded, require adjustments to the process to return all measurements to within their limiting values.