Abstract:
This invention relates to an apparatus and method for output current control in an Industrial Process Control System. The output module comprises two management units each of which calculates the current demand for the module independently from one another. One management unit controls an output current controller whilst the other unit monitors the current produced by the output current controller against an independently calculated demand. The output module has multiple output modules. However rather than one module providing a backup for the other modules, or alternating between use of each module, in normal operation, each module provides a portion of the required output current, the total output current being equal to the sum of the currents output by each module. In the event of failure on one of the modules, the other module or modules switch to providing the total current required.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application claims priority to U.S. Provisional Application No. 61/561,089, filed on Nov. 17, 2011, and to European Patent Application No. EP12153386.3, filed on Jan. 31, 2012, the contents of each of which are hereby incorporated by reference. 
     
    
     BACKGROUND 
       [0002]    a. Field of the Invention 
         [0003]    This invention relates to an apparatus and method for output current control in an Industrial Process Control System, in particular for an Industrial Process Control System suitable for:
       Emergency Shutdown systems   Critical process control systems   Fire and Gas detection and protection systems   Rotating machinery control systems   Burner management systems   Boiler and furnace control systems   Distributed monitoring and control systems       
 
         [0011]    Such control systems are applicable to many industries including oil and gas production and refining, chemical production and processing, power generation, paper and textile mills and sewage treatment plants. 
         [0012]    In industrial process control systems, fault tolerance is of utmost importance. Fault tolerance is the ability to continue functioning safely in the event of one or more failures within the system. 
         [0013]    Industrial process control systems are usually specified to have a particular Safety Integrity Level. Safety Integrity Level (SIL) is defined as a relative level of risk reduction provided by a safety function, or to specify a target level of risk reduction. In simple terms, SIL is a measurement of performance required for a Safety Instrumented Function. 
         [0014]    Within European Functional Safety standards four SILs are defined, with SIL 4 being the most dependable and SIL 1 being the least. A SIL is determined based on a number of quantitative factors in combination with qualitative factors such as development process and safety life cycle management. 
         [0015]    b. Related Art 
         [0016]    Fault tolerant systems are expensive to implement, and it is desirable to utilize an architecture which provides flexibility so that differing levels of fault tolerance can be provided depending upon the specified SIL. 
         [0017]    Fault tolerance may be achieved by a number of different techniques, each with specific advantages and disadvantages. 
         [0018]    One way in which fault tolerance may be achieved is by providing “redundancy.” Critical circuits are replicated and perform identical functions simultaneously and independently. The data outputs from replicated circuits are compared, and action taken depending upon the results. For example in a triplicated system a two out of three voting system may be implemented where if any two of the outputs agree then those values are assumed to be correct. Such solutions, whilst effective, are complex and costly to implement. 
         [0019]    Another approach to fault tolerance is the use of hot-standby modules. This approach provides a level of fault tolerance whereby a standby module maintains system operation in the event of module failure. With this approach there may be some disruption to system operation during the changeover period. 
         [0020]    Fault tolerant systems ideally create a Fault Containment Region (FCR) to ensure that a fault within the FCR boundary does not propagate to the remainder of the system. This enables multiple faults to co-exist on different parts of a system without affecting operation. 
         [0021]    Fault tolerant systems may also employ dedicated hardware and software test and diagnostic regimes that provide very fast fault recognition and response times to provide a safer system. 
         [0022]    Safety control systems are generally designed to be “fail-operational/fail-safe.” Fail operational means that when a failure occurs, the system continues to operate: it is in a fail-operational state. The system will continue to operate in this state until the failed module is replaced and the system is returned to a fully operational state. 
         [0023]    There are several problems associated with the use of hot standby modules. A fault must be accurately detected, the faulty module needs to be isolated quickly, and the standby module needs o be deployed quickly. Furthermore, it is necessary to have a system which ensures that the standby module is in working correctly itself order to take control. 
         [0024]    It is difficult to achieve fault tolerant output modules for a current source due to the need for coordinating the sharing of current between replicated elements of a fault tolerant design to maintain the correct demanded current in the event of a failure. This invention provides an improved output module providing a current source, for use in fault tolerant industrial process control systems which overcomes some of the problems associated with the use of hot standby modules. 
       SUMMARY OF THE INVENTION 
       [0025]    The output module comprises two management units each of which calculates the current demand for the module independently from one another. One management unit controls an output current controller whilst the other unit monitors the current produced by the output current controller against an independently calculated demand. 
         [0026]    In one embodiment of the invention the output module has multiple output modules. However rather than one module providing a backup for the other modules, or alternating between use of each module, in normal operation, each module provides a portion of the required output current, the total output current being equal to the sum of the currents output by each module. In the event of failure on one of the modules, the other module or modules switches to providing the total current required and the failed module is switched to a fail safe mode by using an isolation circuit to switch off the output current from that module. 
         [0027]    The output module also provides improved fail safe protection by providing an improved isolation circuit and an improved method of continually testing that the isolation circuit will operate correctly in the event that it is required to switch a module to a fail safe mode 
         [0028]    Having multiple modules providing a proportion of the commanded current and having the current provided by each module monitored by an independent unit, means that each module is constantly checked and a failure in either module is detected very quickly. 
         [0029]    These and other objects, advantages and aspects of the invention will become apparent from the following description. The particular objects and advantages described herein may apply to only some embodiments falling within the claims and thus do not define the scope of the invention. In the description, reference is made to the accompanying drawings which form a part hereof, and in which there is shown a preferred embodiment of the invention. Such embodiment does not necessarily represent the full scope of the invention and reference is made, therefore, to the claims herein for interpreting the scope of the invention. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0030]    Embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings, in which: 
           [0031]      FIG. 1  illustrates schematically a controller for an industrial process control system; 
           [0032]      FIG. 2  is a block diagram illustrating an analogue output module; 
           [0033]      FIG. 3  is a diagram illustrating schematically connections between an analogue output channel driving a field termination assembly and a partner analogue output channel; 
           [0034]      FIG. 4  is a block diagram illustrating an availability management unit; 
           [0035]      FIG. 5  is a diagram illustrating schematically the signals that pass between the various modules of the analogue output channel; 
           [0036]      FIG. 6  is a block diagram showing the channel output drive; 
           [0037]      FIG. 7  is an alternative illustration of signals passing between the various modules of the analogue output drive; and 
           [0038]      FIG. 8  illustrates the possible state of each of the availability management unit and the safety management unit. 
       
    
    
     DETAILED DESCRIPTION 
       [0039]    One or more specific embodiments of the present invention will be described below. It is specifically intended that the present invention not be limited to the embodiments and illustrations contained herein, but include modified forms of those embodiments including portions of the embodiments and combinations of elements of different embodiments as come within the scope of the following claims. It should be appreciated that in the development of any such actual implementation, as in any engineering or design project, numerous implementation-specific decisions must be made to achieve the developers&#39; specific goals, such as compliance with system-related and business related constraints, which may vary from one implementation to another. Moreover, it should be appreciated that such a development effort might be complex and time consuming, but would nevertheless be a routine undertaking of design, fabrication, and manufacture for those of ordinary skill having the benefit of this disclosure. Nothing in this application is considered critical or essential to the present invention unless explicitly indicated as being “critical” or “essential.” 
         [0040]    An example industrial process controller  14  which may use an output module according to the present invention will now be described with reference to  FIG. 1 . 
         [0041]    A controller  14  for monitoring and controlling industrial process control equipment generally comprises an input assembly  22  comprising one or more input modules  27 , a processor assembly  24  comprising one or more processing modules  23  and an output assembly  26  comprising one or more output modules  25 . 
         [0042]    It will be appreciated that various different configurations using different numbers of modules will provide different SILs. 
         [0043]    Where an assembly provides more than one module for redundancy purposes it may be possible to replace a failed module with a replacement module whilst the industrial process control system is operational (i.e. online replacement is possible without having to perform a system shutdown). Online replacement is not possible for a simplex assembly without interruption to the process. 
         [0044]    Input assembly  22  receives signals from sensors monitoring industrial process control equipment via a field conditioning circuit  41  which transforms the signal to a desired voltage range and distributes the signal to the input module(s) as required. 
         [0045]    The input module reads the signal and then passes resulting data to the processor assembly  24  for analysis. After analysing the received input data the processor assembly sends command data to the output assembly  26  which generates drive signals to control the industrial process control equipment. 
         [0046]    The input sensor signals and output drive signals are sent over separate analogue current loops. 
         [0047]    Analogue current loops are used where a field device is to be monitored or controlled remotely over a pair of conductors. Only one current level can be present at any one time. The output module of the present invention uses a 4-20 mA (four to twenty milliamp current loop) which is an analogue electrical transmission standard for industrial instrumentation and communication. The signal is provided via a current loop where 4 mA represents zero percent signal and 20 mA represents the one hundred percent signal. Use of a 4 mA signal to represent zero allows an open circuit condition to be detected. 
         [0048]    The output module of the present invention also uses the Highway Addressable Remote Transducer (HART) Communications Protocol which is a digital industrial automation protocol which can communicate over legacy 4-20 mA analogue instrumentation wiring, sharing the pair of wires used by the older system. 
         [0049]    The HART protocol makes use of the Bell  202  compatible Frequency Shift Keying (FSK) to superimpose digital communication signals at a low level on top of the 4-20 mA. Bell  202  compatible systems use 1,200 Hz for the mark tone (a “1”) and 2,200 Hz for the space tone (a “0”). 
         [0050]    This enables two-way field communication to take place and makes it possible for additional information beyond just the normal process variable to be communicated to/from a smart field instrument. The HART protocol communicates at 1200 bps without interrupting the 4-20 mA signal and allows a host application to obtain two or more digital updates per second from a field device. As the digital FSK signal is phase continuous, there is no interference with the 4-20 mA signal. 
         [0051]    An embodiment of an analogue output module  25  will now be described with reference to  FIG. 2 . 
         [0052]    The analogue output module  25  comprises an I/O bus interface in the form of a field programmable gate array (FPGA)  12  which receives a command signal  10  from a processing module  23  and send a response signals  11  to a processing module  23 . The FPGA  12  communicates with an availability management unit  14  and a safety management unit  13  in an output channel  17 . The output channel  17  further comprises a channel output drive  21 , to drive the 4-20 mA loop signal  22 ,  23 , the channel output drive  21  comprising an output current controller  15  and cutoff switches  16 . 
         [0053]    The availability management unit  14  and the safety management unit  13  residing on an output module  25  communicate with corresponding units of a partner analogue output channel  17 ′ residing on a partner output module  25 ′ via signal buses  132  and  142 . 
         [0054]      FIG. 3  is a diagram illustrating schematically connections between an analogue output channel  17  driving a field termination assembly  30  and a partner analogue output channel  17 ′. Communication messages between the analogue output channel  17  and the partner analogue output channel  17 ′ will be described in more detail later. 
         [0055]      FIG. 4  is a diagram illustrating the availability management unit (AMU)  14  in more detail. The availability management unit receives loop voltage input signal(s)  19  comprising a first positive voltage monitor signal  191  and a second negative voltage monitor signal  192 . The AMU receives a voltage reference signal  42  and a AOUT drive signal  49  from the current output controller  15  and generates a current control drive signal  43  in dependence on the input signals to drive the output current controller  15 . The AMU  14  comprises a microcomputer  47 , a HART filter  45  to filter the HART element of the input voltage signal(s)  19  and generate HART filtered signal(s)  44 . The microcomputer  47  generates a square wave signal  50  to drive a HART Compliance Filter  46  to create a HART compliant signal  48  to be superimposed on the 4-20 mA loop output signal. The availability management unit communicates with a partner AMU within the partner analogue output channel  17 ′ via signal bus  142 , with I/O bus interface  12  via signal bus  141  and with the safety management unit (SMU)  13  via signal bus  143 . 
         [0056]      FIG. 5  is a diagram illustrating schematically the signals that pass between the various modules of the analogue output channel  17 . 
         [0057]    The safety management unit  13  receives and validates safety commands via a communications bus  131  from the FPGA  12  and monitors the output current via a pair of current monitor signals  18  received from the channel output drive  21 . The safety management unit also receives the following voltage signals from the channel output drive  21 : voltage monitor signals  19  comprising the first voltage monitor signal  191 , the second voltage monitor signal  192  and a third voltage monitor signal  193 , and the output reference voltage  42 . 
         [0058]    The safety management unit comprises a microprocessor which controls cutoff switches  16  in the channel output drive by means of a pair of gate drive signals  20 . 
         [0059]    In the event that the monitored current deviates from an expected value, i.e., the value that has been commanded by the I/O bus interface  12 , the safety management unit  13  will cause the output channel  17  to enter a failsafe mode by causing the gate drive signals  20  to disable the current output using the cutoff switches  16 . 
         [0060]    The safety management unit  13  periodically tests parallel shutdown paths within the cutoff switches  16 . The safety management unit  13  also provides detection and recovery for open circuit conditions in the output channel  17 . 
         [0061]    The channel output drive will now be described in more detail with reference to  FIGS. 6 and 7 . 
         [0062]    The channel output drive  21  comprises output current controller  60 ,  61  and cutoff switches  16 . The output current controller comprises a digital to analogue converter circuit  60  and a gate circuit  61 . The digital to analogue converter circuit  60  receives the current control drive signal  43  and returns a voltage reference signal  42 . The digital to analogue converter circuit  60  also receives the HART compliant signal  48  and adds that to the converted current control drive signal to generate drive signal  49  to drive the gate circuit  61 . Cutoff switches  16  comprise cutoff switch  1  and cutoff switch  2  connected in parallel such that both cutoff switches need to be disabled in order to disable the 4-20 mA current signals  22 ,  23  and effectively disable the output module, putting it into a failsafe state. Cutoff switch  62  is driven by gate drive signal  202 , cutoff switch  63  is driven by gate drive signal  201 . Current monitor signals  181  and  182  are used to monitor the current flowing through each cutoff switch respectively. Voltage monitor signal  191 ,  192  and  193  are returned to both the availability management unit  14  and the safety management unit  13 . 
         [0063]    The operation of the various modules will now be described in more detail. 
         [0064]    Command and response messages sent over signal busses  131 ,  132 ,  141 ,  142 ,  143  comprise packets of data containing a command/response byte and a data field. The content and permitted value of the data field depends upon the particular command/response being sent. The command byte informs the receiving entity the command to be performed for example the I/O bus interface  12  may request data relating to the monitored voltages or currents, may send commands to set or reset various parameters to be used by the availability management unit  14  or the safety management unit  13  or may send commands instructing the availability management unit  14  or the safety management unit  13  to change state. 
         [0065]    The availability and safety management units  14 ,  13  have three modes of operation as illustrated in  FIG. 8 . Offline mode  80  allows calibration constants and safety thresholds to be set and saved to memory. Program mode  81  allows code in the relevant microprocessor to be updated. 
         [0066]    In online mode  82  there are four status modes. Shutdown  83 , Active  84 , Standby  85  and Fail-safe  86 . The unit will change status in response to received commands from the I/O bus interface  12  and in response to changes in Analogue Output Module (AOM)/Partner AOM or AMU-SMU Link channel status variables. 
         [0067]    The availability management unit  14  and safety managements unit  13  receive and validate command messages from the I/O bus interface  12  and generate response signals to the I/O bus interface  12 . 
         [0068]    Furthermore, the safety management unit  13  and the availability management unit exchange status data with their corresponding partner unit  13 ′  14 ′ and with each other. 
         [0069]    The availability management unit  14  and the safety management unit determine a current demand independently from one another both on the basis of command signals received from the I/O bus interface  12  and on determined values of current channel status variables relating to the Analogue Output Module (AOM) channel status, Partner AOM channel status and AMU-SMU Link status. As well as the status values mentioned above (Shutdown, Active, Standby and Failsafe) status values may also be set to “Fault” or “Unknown.” 
         [0070]    The AMU  14  communicates with the partner AMU  14 ′ in order to communicate the respective present channel status to one another. 
         [0071]    The AMU  14  and partner AMU  14 ′ communicate using full-duplex serial universal asynchronous receiver/transmitter (UART) links. The messages contain data relating to the “AOM Ch State” as well as acknowledging the presently determined “Partner AOM Ch State.” Messages are sent every 0.5 ms. Failure to receive a new message within 2 ms results in “Partner AOM Ch State” being set to “Unknown” and “Partner AOM Link Fault” being set to TRUE. 
         [0072]    The AMU  14  and SMU  13  communicate with one another via a Serial Peripheral Interface (SPI) Bus. The AMU is the SRI master and the SMU is the SPI slave. The AMU monitors the SPI link and if no data has been received from the SMU after an interval of 2 ms “AMU-SMU Link Fault” is set to TRUE. The AMU sends data to the SMU every 1 ms regarding the “AOM Ch State” and the “Partner AOM Ch State” amongst other things. 
         [0073]    The SMU  13  and partner SMU  13 ′ communicate using full-duplex serial universal asynchronous receiver/transmitter (UART) links. The messages contain data relating to the “AOM Ch State” as well as acknowledging the presently determined “Partner AOM Ch State.” Messages are sent every 0.5 ms. Failure to receive a new message within 2 ms results in “Partner AOM Ch State” being set to “Unknown” and “Partner AOM Link Fault” being set to TRUE. 
         [0074]    The present statuses are made available to the current demand control process on the AMU  14  to determine a required current demand to be translated into a suitable drive value for the current control drive signal  43 . 
         [0075]    A parallel SMU current demand control process operates on the SMU  13  the output of which is used by a signal monitor process which will be described in more detail later. 
         [0076]    The basic algorithm can be quite simple: 
         [0077]    In receipt of a commanded current message from the I/O driver: 
         [0000]    
       
         
               
               
               
             
           
               
                   
                   
               
             
             
               
                   
                   
                  If the AOM channel is Active then 
               
               
                   
                   
                   If Partner AOM channel is Active then 
               
               
                   
                   
                   set current demand = 0.5 * commanded current 
               
               
                   
                   
                  else 
               
               
                   
                   
                   set current demand = commanded current 
               
               
                   
                   
               
             
          
         
       
     
         [0078]    For illustrative purposes a simple embodiment where each of two modules provides 50% of the commanded current is described. 
         [0079]    It will be appreciated that more complex algorithms may be used, whereby a different proportion of the current could be provided by each output module as long as the sum of the current demands from each module remains equal to the commanded current. 
         [0080]    Furthermore it will be appreciated that more than two analogue output modules could be employed each providing a proportion of the output current as long as the sum of the current demands from all of the modules remains equal to the commanded current. 
         [0081]    The availability management unit  14  also manages the Manage HART I/O and transmits data to the SMU  13  relating to the current status of the HART I/O link. However the details of the HART I/O implementation are not relevant to the present invention. 
         [0082]    The SMU  13  has a fail safe guard band (FSGB) monitor and a gate drive controller which operate as follows. 
         [0083]    The FSGB monitor monitors the loop voltage via loop voltage signals  19 . If the loop voltage is less than a predetermined safety threshold (3V in the present invention) then a fault status variable indicating a line fault is set to TRUE. The fault status variable is used by the gate drive controller as will be described in due course. 
         [0084]    In the event of a line fault then no further monitoring of the current is performed by the FSGB monitor process. 
         [0085]    Assuming no line fault is detected then the FSGB monitor uses the current demand determined by the SMU&#39;s own independently generated current demand control process together with the input current signals  18  to determine whether the correct loop current is being generated by the AMU  14 . 
         [0086]    The loop current driven by the AMU  14  is the total of the current  181  flowing through the first cutoff switch  62  and the current  182  flowing through the second cutoff switch  63 . 
         [0087]    Although not relevant to the present invention, the monitored current signals  18  are filtered over a number of samples to remove the effect of any superimposed HART I/O signal  48 . 
         [0088]    The SMU compares the independently generated current demand (the expected current) with the total loop current (the driven current) and in the event that the difference is greater than a predetermined threshold for a predetermined period of time then a “guard band” fault status, indicating a guard band fault is set to TRUE. 
         [0089]    A guard band fault status of TRUE causes the AOM CH State to be set to “Failsafe” which in turn will cause the gate drive controller to switch off both cutoff switches. 
         [0090]    The guard band process uses a first threshold and a first predetermined period of time as well as a second threshold and a second predetermined period of time, the first threshold is greater than the second threshold (in the preferred embodiment of the invention it is 2× the second threshold) and the first predetermined period of time is shorter than the second predetermined period of time. This means a guard band fault can be set if the expected current varies widely from the driven current for a shorter period or if the expected current varies by a smaller amount from the driven current for a longer period. The thresholds can be “hard wired” into the control process or they may be set by commands received via the I/O bus interface  12 . 
         [0091]    The operation of the gate drive controller will now be described. 
         [0092]    The gate drives are turned off when the AOM Ch State indicates “Ch Failsafe” OR (AOM Ch State indicates “Ch shutdown” and the Shutdown Mode is “Shutdown Off”). 
         [0093]    Otherwise the controller cycles around a sequence of gate drive control signals that alternately switch either gate off and the controller establishes that:
   a) The gate commanded off is passing less than 100 uA,   b) The gate remaining on is conducting.   
 
         [0096]    If one or the other of these tests fails the gate is deemed faulty. The gate drive controller provides an improvement on presently available cutoff or isolation switches because the gates are constantly tested whilst operating under live conditions so a faulty gate is very quickly identified and isolated. 
         [0097]    Because a gate may take up to 20 ms to turn off, the tests are performed immediately prior turning the gate back on again. 
         [0098]    The gates do not need to be tested at any particular intervals. However, they are preferably tested at an interval less than the mean time to detect a fault appropriate to a low demand system. It is preferred to alternate between the cutoff switches between every 100 ms and 30 s. 
         [0099]    No change in gate state is permitted while HART I/O is in progress unless this should cause a delay in gate testing that exceeds 30 seconds. 
         [0100]    It will be appreciated that certain features of the invention, which are, for clarity, described in the context of separate embodiments, may also be provided in combination in a single embodiment. Conversely, various features of the invention which are, for brevity, described in the context of a single embodiment, may also be provided separately, or in any suitable combination. 
         [0101]    Certain terminology is used herein for purposes of reference only, and thus is not intended to be limiting. For example, terms such as “upper,” “lower,” “above,” and “below” refer to directions in the drawings to which reference is made. Terms such as “front,” “back,” “rear,” “bottom,” “side,” “left” and “right” describe the orientation of portions of the component within a consistent but arbitrary frame of reference which is made clear by reference to the text and the associated drawings describing the component under discussion. Such terminology may include the words specifically mentioned above, derivatives thereof, and words of similar import. Similarly, the terms “first,” “second” and other such numerical terms referring to structures do not imply a sequence or order unless clearly indicated by the context. 
         [0102]    When introducing elements or features of the present disclosure and the exemplary embodiments, the articles “a,” “an,” “the” and “said” are intended to mean that there are one or more of such elements or features. The terms “comprising,” “including” and “having” are intended to be inclusive and mean that there may be additional elements or features other than those specifically noted. It is further to be understood that the method steps, processes, and operations described herein are not to be construed as necessarily requiring their performance in the particular order discussed or illustrated, unless specifically identified as an order of performance. It is also to be understood that additional or alternative steps may be employed. 
         [0103]    References to “a microprocessor” and “a processor” or “the microprocessor” and “the processor” can be understood to include one or more microprocessors that can communicate in a stand-alone and/or a distributed environment(s), and can thus be configured to communicate via wired or wireless communications with other processors, where such one or more processor can be configured to operate on one or more processor-controlled devices that can be similar or different devices. Furthermore, references to memory, unless otherwise specified, can include one or more processor-readable and accessible memory elements and/or components that can be internal to the processor-controlled device, external to the processor-controlled device, and can be accessed via a wired or wireless network. 
         [0104]    It is specifically intended that the present invention not be limited to the embodiments and illustrations contained herein and the claims should be understood to include modified forms of those embodiments including portions of the embodiments and combinations of elements of different embodiments as coming within the scope of the following claims. All of the publications described herein including patents and non-patent publications are hereby incorporated herein by reference in their entireties. 
         [0105]    The present invention may be part of a “safety system” used to protect human life and limb in a field, warehouse, factory or industrial, environment. Nevertheless, the term “safety,” “safely” or “safe” as used herein is not a representation that the present invention will make the environment safe or that other systems will produce unsafe operation. Safety in an industrial process depends on a wide variety of factors outside of the scope of the present invention including: design of the safety system, installation and maintenance of the components of the safety system, and the cooperation and training of individuals using the safety system. Although the present invention is intended to be highly reliable, all physical systems are susceptible to failure and provision must be made for such failure.