Abstract:
This invention relates to input channel diagnostics for an industrial process control system. The invention provides improved apparatus and methods relating to fault containment, overload protection and input channel diagnostics.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
       [0001]    This application claims priority to U.S. Provisional Application Ser. No. 61/025,508 filed on Feb. 1, 2008 and European Patent Application No. EP08165276 filed on Sep. 26, 2008, the disclosures of which are expressly incorporated herein. 
     
    
     BACKGROUND 
       [0002]    a. Field of the Invention 
         [0003]    This invention relates to Input Channel Diagnostics for an Industrial Process Control System in particular for an Industrial Process Control System Suitable for exemplary systems such as:
       Emergency Shutdown systems;   Critical process control systems;   Fire and Gas detection and protection systems;   Rotating machinery control systems;   Burner management systems;   Boiler and furnace control systems; and   Distributed monitory and control systems.       
 
         [0011]    Such control systems are applicable to many industries including oil and gas production and refining, chemical production and processing, power generation, paper and textile mills and sewage treatment plants. 
         [0012]    b. Related Art 
         [0013]    In industrial process control systems, fault tolerance is of utmost importance. Fault tolerance is the ability to continue functioning safely in the event of one or more failures within the system. Fault tolerance is usually categorised in accordance with a safety integrity level (SIL) scale where a higher SIL means a better safety performance. SILs are defined in standards IEC 61508 (Functional safety of electrical/electronic/programmable electronic safety-related systems) and specifically for the process industry in IEC 61511 (Functional safety—Safety instrumented systems for the process industry sector). 
         [0014]    Fault tolerance may be achieved by a number of different techniques, each with its specific advantages and disadvantages. 
         [0015]    An example of a system which provides redundancy is a Triple Modular Redundancy (TMR) system. Using TMR, critical circuits are triplicated and perform identical functions simultaneously and independently. The data output from each of the three circuits is voted in a majority-voting circuit, before affecting the system&#39;s outputs. If one of the triplicated circuits fails, its data output is ignored. However, the system continues to output to the process the value (voltage, current level, or discrete output state) that agrees with the majority of the functional circuits. TMR provides continuous, predictable operation of systems configured for such operation. 
         [0016]    However, TMR systems are expensive to implement if full TMR is not actually a requirement, and it is desirable to utilise an architecture which provides flexibility so that differing levels of fault tolerance can be provided depending upon specified system requirements. 
         [0017]    Another approach to fault tolerance is the use of hot-standby modules. This approach provides a level of fault tolerance whereby the standby module maintains system operation in the event of module failure. With this approach there may be some disruption to system operation during the changeover period if the modules are not themselves fault-tolerant. 
         [0018]    Fault tolerant systems ideally create a Fault Containment Region (FCR) to ensure that a fault within the FCR boundary does not propagate to the remainder of the system. This enables multiple faults to co-exist on different parts of a system without affecting operation. 
         [0019]    Fault tolerant systems generally employ dedicated hardware and software test and diagnostic regimes that provide very fast fault recognition and response times to provide a safer system. 
         [0020]    Safety control systems are generally designed to be ‘fail-operational/fail-safe’. Fail operational means that when a failure occurs, the system continues to operate: it is in a fail-operational state. The system should continue to operate in this state until the failed module is replaced and the system is returned to a fully operational state. 
         [0021]    An example of fail safe operation occurs, for example if, in a TMR system, a failed module is not replaced before a second failure in a parallel circuit occurs, the second failure should cause the TMR system to shut down to a fail-safe state. It is worth noting that a TMR system can still be considered safe, even if the second failure is not failsafe, as long as the first fault is detected and announced, and is itself failsafe. 
         [0022]    It is therefore desired to provide an Input Module for an Industrial Control Process that has Input Channel Diagnostics so that faults on any input channels are contained and do not affected the measurement of other parallel modules that are measuring the same source. It is also desirable to be able to test or check the correct functioning of an input module. Finally, if an overload condition occurs, it is also useful if the Input Module can fail safe and detect and report the condition. 
       SUMMARY OF THE INVENTION 
       [0023]    An input module according to the present invention addresses one or more of the problems discussed above. According to one aspect of the invention, there is provided an input circuit for receiving a conditioned sensor signal from a sensor signal source. The input circuit includes one or more series resistors and an operational amplifier. The series resistors have a total resistance which is at least two orders of magnitude greater than the magnitude of the resistance of the conditioned sensor signal source. 
         [0024]    Preferably, one or more series resistors comprise two resistors having a combined resistance substantially equal to 1 MΩ. Preferably, the combined resistance is approximately 1000 times a source resistance. 
         [0025]    In the preferred aspect, there is a low value capacitor in parallel with the signal source voltage downstream of the first series resistor to provide a low pass noise filter. 
         [0026]    According to another aspect of the invention, there is provided a field conditioning circuit for receiving a sensor signal and converting the signal to a desired voltage range for use by an input circuit. The field conditioning circuit includes a sense resistor, a fuse in series with the sense resistor, and an output for determining when the fuse has blown. 
         [0027]    Preferably, a Zener diode is oriented in series with the fuse and in parallel with a load resistor for providing load termination wetting current and voltage attenuation. 
         [0028]    According to a further aspect of the invention, a field conditioning circuit is provided for receiving a sensor signal and converting the signal to a desired voltage range for use by an input circuit. The field conditioning circuit includes a primary sense resistor in series with a secondary sense resistor, a primary output for detecting a first voltage across the primary sense resistor and the secondary sense resistor, and a secondary output for detecting a second voltage across the secondary sense resistor. 
         [0029]    The resistor provides attenuation and the zener diode provides an overdrive to the fuse to ensure the fuse blows in the event of an over-voltage before damaging the more sensitive sense resistors. 
         [0030]    According to another aspect of the invention, there is provided a method of fault detection in a field conditioning circuit for a safety critical system. The method includes receiving an input sense signal from a sensor, detecting a first output signal using an output from a primary sense resistor in series with a secondary sense resistor, detecting a second output signal using an output from said primary sense resistor, and sending signals dependent upon said first output signal and said second output signal to a processor for analysis. 
         [0031]    Preferably, the method also processes the first output signal with a first high impedance input circuit and an analogue to digital converter and processes the second output signal with a second high impedance input circuit and an analogue to digital converter prior to sending the signals to the processor for analysis. 
         [0032]    In the preferred aspect, the method further encodes channel specific error checking data that is sent with the signals to the processor for analysis. 
         [0033]    According to another aspect of the invention there is provided a method of internally testing an input channel for a safety critical system. The method includes adding a subliminal perturbation signal to an input signal to be applied to an input circuit. The method detects an output signal from said input circuit and determines whether the addition of said perturbation signal causes a change in said output signal. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0034]    Embodiments of the invention will now be described, by way of example only, with reference to the accompanying drawings, in which: 
           [0035]      FIG. 1  is an illustration showing the architecture of a distributed industrial process control system equipped with the apparatus and operable according to the methods of the present invention; 
           [0036]      FIG. 2  schematically illustrates a controller of the industrial process control system illustrated in  FIG. 1 ; 
           [0037]      FIG. 3  illustrates a possible configuration of the controller shown in  FIG. 2 ; 
           [0038]      FIG. 4  shows various options for an input assembly and output assembly of  FIG. 3 ; 
           [0039]      FIG. 5  shows one possible configuration of an input module system implementing a two out of three voting strategy; 
           [0040]      FIG. 6  illustrates a second possible configuration of an input module system for a two out of three voting strategy; 
           [0041]      FIG. 7  is a schematic illustration showing an input module; 
           [0042]      FIG. 8  is a circuit diagram of a digital input termination assembly according to the present invention; 
           [0043]      FIG. 9  is a circuit diagram of an analogue input termination assembly according to the present invention; 
           [0044]      FIG. 10  is a diagram of an input channel; and 
           [0045]      FIGS. 11   a  and  11   b  are circuit diagrams showing input circuits according to the present invention. 
       
    
    
     DETAILED DESCRIPTION 
       [0046]    In the Industrial Process Control System shown in  FIG. 1 , a distributed architecture is designed to be used in different SIL environments, so that if a high SIL is required it can be provided, but if a low SIL is all that is needed, the system can be reduced in complexity thereby reducing unnecessary extra costs. 
         [0047]    An exemplary Industrial Process Control System  10 , comprises a workstation  12  one or more controllers  14  and a gateway  16 . The workstation  12  communicates with the controllers  14  and the gateway  16  via Ethernet connections  18  to one or more control networks  13 . Multiple Ethernet connections  18  provide redundancy to improve fault tolerance. The workstation  12  may be connected via a conventional Ethernet connection  11  to another external network  15 . 
         [0048]    A controller  14  will now be described in more detail with reference to  FIGS. 2 and 3 . 
         [0049]      FIG. 2  illustrates a schematic diagram of the controller  14  comprising an input assembly  22 , a processor assembly  24  and an output assembly  26 . In this schematic illustration the input assembly  24  and output assembly  26  are on different I/O backplanes but they may equally well share a single backplane. 
         [0050]    Assemblies  22 ,  24 ,  26  are created from one or more communications backplane portions which have three slots to accommodate up to three modules together with termination assemblies which have one two or three slots, and which interface to field sensors and transducers. A termination assembly may straddle two contiguous backplane portions. A module comprises a plug in card with multiple connectors for plugging onto a communications backplane and a termination assembly. 
         [0051]    It will be appreciated that having three slots in a communications backplane portion is one design option and other design options with greater (or fewer) slots are possible without departing from the scope of the invention as defined in the appended claims. 
         [0052]      FIG. 3  illustrates a possible physical configuration of the controller  14 . In this embodiment of the invention, the input assembly  22 , output assembly  26  and processor assembly  24  are physically separated from one another by grouping the modules of different types onto separate communications backplanes. 
         [0053]    In the example shown, the input assembly  22  comprises two communications backplane portions,  22 ′,  22 ″. The first backplane portion  22 ′ has a triplex input termination assembly and three input modules  22   a,    22   b,    22   c,  the second backplane portion  22 ″ has a duplex input termination assembly  22 ″ and two input modules  22   d,    22   e.  The processor assembly  24  comprises a single processor backplane portion  24 ′ having three processor modules  24   a,    24   b  and  24   c.  The output assembly  26  comprises two backplane portions  26 ′,  26 ″. The first backplane portion  26 ′ has a duplex output termination assembly with two output modules  26   a,    26   b  and the second backplane portion  26 ″ has a simplex output termination assembly with a single output module  26   c.    
         [0054]    The flexibility of the input assembly  22 , will now be described, in more detail with reference to  FIG. 4 . 
         [0055]    An input assembly  22  comprises one or more backplane portions and termination assemblies  22 ′  22 ″  22 ′″ etc. For example, a triplex portion  22 ′ having three modules  22   a,    22   b,    22   c  might be used for high availability requirement, a duplex portion  22 ″ having two modules  22   d,    22   e  might be provided for fault tolerant applications and a simplex portion  22 ′″ with a single module  22   f  might be provided for failsafe applications. The termination assemblies may be provided with different types of field conditioning circuits. For example assembly  22 ′ may be provided with a 24V DC field conditioning circuit  41  assembly  22 ″ may be provided with a 120V DC field conditioning circuit  42  and assembly  22 ′″ may be provided with a 4-20 mA field conditioning circuit  43 . Similarly possible configurations are shown for an output assembly  26 . It will be appreciated that numerous configurations of backplane portions and termination assemblies with various different numbers of modules and various different types of field conditioning circuits are possible and the invention is not limited to those shown in these examples. 
         [0056]    Where an assembly provides more than one module for redundancy purposes it is possible to replace a failed module with a replacement module whilst the industrial process control system is operational which is also referred to herein as online replacement (ie replacement is possible without having to perform a system shutdown). Online replacement is not possible for a simplex assembly without interruption to the process. In this case various “hold last state” strategies may be acceptable or a sensor signal may also be routed to a different module somewhere else in the system. 
         [0057]    The processor assembly configures a replacement processor module using data from a parallel module before the replacement module becomes active. 
         [0058]    The field conditioning circuits  41 ,  42 ,  43  transform a signal received from a sensor monitoring industrial process control equipment to a desired voltage range, and distribute the signal to the input modules as required. Each field conditioning circuit  41 ,  42 ,  43  is also connected to field power and field return (or ground) which may be independently isolated on a channel by channel basis from all other grounds, depending on the configuration of the input termination assembly. Independent channel isolation is the preferred configuration because it is the most flexible. The field conditioning circuits  41 ,  42 ,  43  comprise simple non active parts and are not online replaceable. 
         [0059]      FIG. 5  and  FIG. 6  illustrate the flexibility of the architecture described herein showing different configurations for a triplex system for generating a SIL3 signal with a high availability requirement. Referring to  FIG. 5 , a three module input assembly  51  receives a signal from a sensor  50  via a field conditioning circuit in termination assembly  54 . The field conditioning circuit  54  transforms the signal to a desired voltage range and distributes the signal to three replicated input modules  53   a,    53   b,    53   c.  Each input module processes the signal and the results are sent to a two out of three voter  52  to generate a result signal in dependence thereon. 
         [0060]    Referring to  FIG. 6 , replicated sensors  60   a,    60   b,    60   c  each send a signal to a respective simplex assemblies  61   a,    61   b,    61   c  via respective field conditioning circuits in termination assemblies  64   a,    64   b,    64   c.  Each input module  63   a,    63   b,    63   c  processes the signal and sends an output to a two out of three voter  62  to generate a signal in dependence thereon. It will be appreciated that many variations and configurations are possible in addition to those illustrated here. 
         [0061]      FIG. 7  illustrates schematically an input module  70  in accordance with the present invention: 
         [0062]    An input module  70  comprises eight isolated channels  71 . Each channel  71  receives signals  72 ,  73   a,    73   b  from field conditioning circuits in a termination assembly  74 . Each channel communicates with a field programmable gate array (FPGA)  75  which interfaces to an I/O backplane (not shown) via a non-isolated backplane interface  76 . Light emitting diodes (LEDs)  77  are used to indicate status of the module via red and green indicators. 
         [0063]    It will be appreciated that having eight channels is one design option and other design options with greater (or fewer) channels are possible without departing from the scope of the invention as defined in the appended claims. 
         [0064]    The termination assembly  74 , and signals  72 ,  73   a,    73   b  will now be described in more detail with reference to  FIGS. 8 and 9 . 
         [0065]      FIG. 8  illustrates a digital input field conditioning circuit in accordance with the present invention and  FIG. 9  illustrates an analogue input field conditioning circuit in accordance with the present invention. 
         [0066]    Referring now to  FIG. 8 , a digital input field conditioning circuit for measuring high level field input voltages comprises an avalanche or Zener diode  91  connected in series with a fuse  92 . The diode  91  forces the fuse to blow when an extreme overload is applied to the input. A blown fuse signal  72  is output to the input module to allow the input module to sense and report a blown fuse condition. 
         [0067]    In a preferred embodiment of the invention a first sense resistor  93  has a resistance of 100Ω and a second sense resistor  94  has a resistance of 20Ω. The use of the fuse means that the sense resistors  93 ,  94  only need to operate to the maximum rating of the fuse, which in the preferred embodiment is 50 mA. In the preferred embodiment the Zener diode  91  is connected in parallel with a resistor  95 . The resistor  95  is used to provide a “wetting current” termination resistance for providing current to the sense resistors  93 ,  94 , in addition to providing voltage attenuation. 
         [0068]    Referring to  FIG. 9 , an analogue input field conditioning circuit for measuring field 4-20 mA analogue current loop signals comprises a fuse  101  in series with sense resistors  103 ,  104 . Again, the use of the fuse means that the sense resistors  93 ,  94  only need to operate to the maximum rating of the fuse, which in the preferred embodiment is 50 mA. Again, a blown fuse signal  72  is output to the input module to allow the input module to sense and report a blown fuse condition. The field conditioning circuits shown in  FIG. 8  and  FIG. 9  output a primary sense signal  73   a  and a secondary sense signal  73   b,  use of which by the input channel  71  will now be described in more detail with reference to  FIG. 10 . 
         [0069]    The input channel  71  comprises a blown fuse circuit  111 , a primary input circuit  113  and a secondary input circuit  112 . 
         [0070]      FIG. 10  illustrates how the secondary parallel heterogeneous measurement channel  112  is used to sense the secondary sense signal  73   b  for the purpose of determining the correct operation of the primary measurement device. The secondary channel measures the secondary sense signal  73   b  using the additional sensing resistor  94 / 104  which is in series with the resistor  93 / 103  utilized by the primary channel. 
         [0071]    Use of the secondary channel allows drift faults to be detected in either of the sense resistors, the input conditioning circuitry and the a/d converter in a field conditioning circuit to a specified level of safety accuracy. 
         [0072]    Signal  73   b  from the series combination of sense resistors  103  and  104  (or  93 ,  94 ) is connected to secondary input circuit  112 . Input circuit  112  sends an analogue output signal  109   b  to microcomputer  114  where it is converted by a ten bit resolution A/D converter  116  to a digital secondary sense signal. 
         [0073]    Similarly, signal  73   a  from sense resistor  104  (or  94 ) is connected to primary input circuit  113 . Input circuit  113  sends an analogue output signal  109   a  to microcomputer  115  where it is converted by a sixteen bit resolution A/D converter  117  to a digital primary sense signal. 
         [0074]    It will be appreciated that the precision of the A/D converters in the preferred embodiment is merely one design option and other design options with greater (or less) precision is possible without departing from the scope of the invention as defined in the appended claims. 
         [0075]    Microcomputer  115  sends the digital primary sense signal to microcomputer  114  where together with the digital secondary sense signal it is sent to the FPGA  75  ( FIG. 7 ) for onward transmission to a processor module for analysis. 
         [0076]    The processor module compares the two sense signals and reports any discrepancy to within a predetermined level of accuracy. 
         [0077]    The high resolution primary signal is inspected for changes in the least significant bits. Microcomputer  115  generates a small perturbation signal  119  which may be added to the primary analogue sense signal  73   a  if the input signal is of a static nature ie if there has been no change in the least significant bits for a predetermined time. Because of the high resolution of the A/D converter  117  it is an inherent property of the system that there should be noise registered by the least significant bits. 
         [0078]    The perturbation test signal amplitude is scaled to be of subliminal amplitude relative to the final output specified resolution, which in the preferred embodiment of the invention is twelve bits, but is adequate to ensure that the input channel is capable of registering dynamic activity ie by causing a change to the value of the least significant bits. 
         [0079]    Calibration coefficients for the input channels are stored locally in each microcomputer  114 ,  115 . When the channels are calibrated the channel number is stored with the calibration data to provide for the detection of channel independence faults. The channel number is factored into a cyclic redundancy check (CRC) code which is sent from the microprocessor  114  to the processor module so that any interference between channels will be detected by a CRC error detected by the processor module. 
         [0080]    Because two resistors in series are used in the field conditioning circuits in the termination assembly it is possible to detect safety critical drift discrepancies that occur on them. If more than one input module is installed to monitor the termination assembly voltages then the discrepancy fault may be isolated to the termination assembly, or one of the input module measurement channels. 
         [0081]    In systems employing redundancy it is important that a short circuit fault on one input circuit is prevented from influencing the measurement made by another replicated input circuit which is receiving the same signal. 
         [0082]      FIG. 11   a  illustrates an input circuit  112  comprising a low input current low offset voltage operation amplifier  81  (such as Analog Devices AD8538). The operational amplifier  81  receives an input signal  73   b  via two high value resistors  83 ,  84  connected in series with the input signal to provide an accurate voltage follower. In this embodiment, the value of each resistor  83 ,  84  is 499 KΩ thereby providing a total series resistance of approx 1 MΩ. This provides a limit on the input current in the event of a short-circuit fault (or a low impedance short-circuit type of fault). It is further envisioned that, rather than providing a static resistance threshold such as 1 MΩ as discussed above, the series resistance could be provided as a function of the resistance of the source signal. One such configuration provides a series resistance that is about 1000 times greater than the source resistance. 
         [0083]      FIG. 11   b  illustrates a similar input circuit  113  having a test path for receiving the perturbation test signal  119 . Similar components in  FIGS. 11   a  and  11   b  are labelled with similar numbers marked with prime. 
         [0084]    For those embodiments equipped with series resistance of approximately 1 MΩ, if the signal source has an input resistance of 1 KΩ, then the signal disturbance caused by such a fault will be less than 0.1% due to the fact that the series resistance is approximately three orders of magnitude greater than the resistance of the signal source. It is preferred that the combined resistance is at least two orders of magnitude greater than the signal source resistance and it is even more preferable if the combined resistance is at least three orders of magnitude greater than the signal source resistance. Preferably one or more low value capacitors are provided to provide low pass noise filtering. If the capacitor has a value of 47 pF then the cut-off frequency of the low-pass filter is 6.8 KHz. A short circuit failure of capacitor  85  would result in a 0.2% disturbance from a signal source having an input resistance of 1 KΩ. However, in the preferred embodiment of the invention, the signal source resistance is 120Ω. 
         [0085]    It will be appreciated that certain features of the invention, which are, for clarity, described in the context of separate embodiments, may also be provided in combination in a single embodiment. Conversely, various features of the invention which are, for brevity, described in the context of a single embodiment, may also be provided separately, or in any suitable combination. 
         [0086]    It is to be recognized that various alterations, modifications, and/or additions may be introduced into the constructions and arrangements of parts described above without departing from the scope of the present invention as defined in the appended claims.