Patent Description:
<CIT> discloses making diagnosis and prognosis of the status of complex systems. <CIT> discloses an electronic device integrity monitor. <CIT> discloses a logic system. <CIT> discloses monitoring and controlling dynamic environments. <CIT> discloses a safety industrial controller.

Given these risks, it can be common to employ protection monitoring systems to monitor one or more processes performed by a machine. The combination of a machine and corresponding protection monitoring system can be referred to as a safety instrumented system (SIS). The protection monitoring system can measure selected parameters of the monitored process, such as operational parameters of one or more machine components performing the monitored process. Analysis of the measured operating parameters can be further performed to identify faults (e.g., one or more operating parameters that fall outside of predetermined tolerances) that can lead to unacceptable or dangerous conditions. Upon identification of a fault, a corresponding alarm can be annunciated to trigger control of the machine to place the monitored process in a safe state where adverse consequences to worker safety, environmental health, and/or machine damage can be avoided. The various operations performed by hardware and/or software to monitor a process (e.g., parameter measurement, fault detection, alarm issuance, etc.) can be collectively referred to as a safety function for the monitored process.

Standards have been developed to provide a relative evaluation of how well or poorly a given safety function responds when acting in response to an emergency event. Examples of standards include International Electrotechnical Commission (IEC) <NUM> and <NUM> standards. These standards specify Safety Integrity Levels (SILs) that quantify the relative level of risk reduction provided by a safety function. That is, these standards require identification of potential hazards and demonstration that hardware and/or software does not violate relevant safety goals. Specifically, four discrete SIL ratings are defined, with a SIL rating of <NUM> representing the highest safety integrity and a SIL rating of <NUM> representing the lowest safety integrity.

A safety instrumented system can include <NUM> to N safety functions, where each safety function is associated with a corresponding process performed by an asset (e.g., a machine). In one embodiment, a safety function can monitor selected operations (e.g., one or more selected operations, up to all operations) performed by hardware and/or software (e.g., measurement and input of sensor data, analysis of the received sensor data, fault detection, alarm annunciation, and machine control subsequent to alarm annunciation). The SIL rating of a safety function can reflect, in part, the risk of undetected errors occurring in the hardware and software performing the safety function. For this reason, each part of the safety function itself can also require a minimum amount of diagnostic coverage to reduce the likelihood of dangerous undetected errors to a level sufficient to achieve a desired SIL rating. That is, respective safety functions can also be monitored to ensure that they function properly.

One existing approach for achieving diagnostic coverage of a safety function can rely upon analysis of every electrical and/or electronic element of an asset, down to the executed lines of code and the bytes of memory, and applying a diagnostic on each element. For simple parts of the safety function, such as the sensor data input, this approach can be practical and achievable. However, for very complex parts of the safety function, there can be many hundreds of thousands of lines of code and bytes of memory that would require a diagnostic. Thus, the cost to implement a diagnostic on every potential point of failure (e.g., every electrical and/or electronic element) can become impractical.

Another existing approach for achieving diagnostic coverage of a safety function is referred to as full redundancy. In full redundancy, the hardware and software performing the safety function in the safety instrumented system is duplicated. The output of the original and duplicate safety functions are determined and compared to ensure that they return the same value(s). Under circumstances where the output of the original and duplicate safety functions are not the same, a fault is detected. However, implementing full redundancy can be impractical from a cost perspective. Notably, full redundancy cuts the available processing power of the safety instrumented system in half, which doubles the cost-per-point for safety functions.

Accordingly, there exists an ongoing need for improved systems and methods for achieving diagnostic coverage of safety functions.

In an embodiment, a diagnostic system according to claim <NUM> is provided.

In another embodiment, the output condition can be a first condition when the safety function output differs from its corresponding shadow function output by greater than a predetermined fault tolerance. The first condition can represent an error in determining at least one of the first status estimate and the second status estimate.

In another embodiment, the output condition can be a second condition when the safety function output and the shadow function output are approximately equivalent.

In another embodiment, the second condition can indicate no asset fault is detected.

In another embodiment, the second condition can indicate that an asset fault is detected.

In another embodiment, the first processor can be configured to execute a plurality of safety functions. The executed shadow function can be further configured to perform a variety of operations. The operations can include determining a first shadow function output corresponding to a first safety function of the plurality of safety functions only during a first portion of the diagnostic interval. The operations can also include determining a second shadow function output corresponding to a second safety function of the plurality of safety functions only during a second portion of the diagnostic interval. The second portion of the diagnostic interval can follow immediately after the first portion of the diagnostic interval.

In another embodiment, the diagnostic interval can be a maximum time duration permitted to validate each sensor measurement of the safety function by the shadow function.

In another embodiment, the first processor can be configured to execute a first safety function during a first diagnostic interval and a second safety function during a second diagnostic interval. The first safety function can be configured to perform a variety of operations. The operations can include determining one or more first sensor measurements from the received data. The operations can also include comparing selected ones of the first sensor measurements to respective predetermined alarm set points. The operations can also include determining a safety function output for the selected first sensor measurements based upon the first sensor measurement comparison. The second safety function can be configured to perform a variety of operations. The operations can include determining one or more second sensor measurements from the received data. The operations can also include comparing selected ones of the second sensor measurements to respective predetermined alarm set points. The operations can further include determining a safety function output for the selected second sensor measurements based upon the second sensor measurement comparison.

In another embodiment, the shadow function is further configured to determine first shadow function outputs corresponding to the selected first sensor measurements during different respective portions of a first diagnostic interval. The shadow function can also determine second shadow function outputs corresponding to the selected second sensor measurements during different respective portions of a second diagnostic interval immediately following the first diagnostic interval. The first and second shadow function outputs can be determined approximately concurrently.

In an embodiment, a diagnostic method according to claim <NUM> is provided.

In another embodiment, a plurality of safety functions can be executed by the first processor. The executed shadow function can be configured to perform a variety of operations. The operations can include determining a first shadow function output corresponding to a first safety function of the plurality of safety functions only during a first portion of the diagnostic interval, The operations can also include determining a second shadow function output corresponding to a second safety function of the plurality of safety functions only during a second portion of the diagnostic interval. The second portion of the diagnostic interval can follow immediately after the first portion of the diagnostic interval.

In another embodiment, a first safety function can be executed by the first processor during a first diagnostic interval and a second safety function can be executed by the first processor during a second diagnostic interval. The first safety function can be configured to perform a variety of operations. The operations can include determining one or more first sensor measurements from the received data. The operations can also include comparing selected ones of the first sensor measurements to respective predetermined alarm set points. The operations can also include determining a safety function output for the selected first sensor measurements based upon the first sensor measurement comparison. The second safety function can be configured to perform a variety of operations. The operations can include determining one or more second sensor measurements from the received data. The operations can also include comparing selected ones of the second sensor measurements to respective predetermined alarm set points. The operations can further include determining a safety function output for the selected second sensor measurements based upon the second sensor measurement comparison.

Complex systems can potentially have points of failure that can require diagnostic monitoring to ensure proper operation. Diagnostic monitoring can include acquiring a measurement of an operating parameter of an asset (e.g., a single machine, a component of a machine, a machine system including two or more machines, etc.), comparing the operating parameter to a range of acceptable values, and triggering an alarm if the operating parameter is outside of the acceptable range, referred to as a safety function. To reduce the likelihood that an alarm is triggered due to an error in the safety function, rather than an actual error in the operation of the system, that is a false positive, it is common to redundantly perform each safety function, referred to as full redundancy. In this approach, an alarm is triggered only when a discrepancy between the results of multiple safety functions. However, the cost to implement full redundancy can be cost-prohibitive because it requires significantly more computing resources. Additionally, safety issues still remain, despite the use of existing diagnostic monitoring systems, due to finite likelihood of missing real errors (e.g., false negatives) that should otherwise cause an alarm to be triggered. Accordingly, improved diagnostic monitoring systems and methods are provided which address this deficiency. A shadow function diagnostic is employed as an alternative to full redundancy. The shadow function is employed to replicate the output of a safety function during limited time windows, rather than continuously. This reduces the computing resources and attendant cost needed to diagnostically monitor safety functions.

Embodiments of safety instrumented systems and corresponding methods for diagnostic coverage of a safety function using a shadow function are discussed herein. Embodiments of the shadow function and safety function are discussed in the context of safety instrumented functions of a turbomachine (e.g., a gas turbine system). However, embodiments of the disclosure can be employed in combination with any safety instrumented functions without limit.

To facilitate understanding of the shadow function, an operating environment including an embodiment of a safety instrumented system in the form of an industrial system <NUM> is illustrated in <FIG>. As shown, the industrial system <NUM> can include a monitored machine or machine system <NUM> (e.g., a gas turbine system <NUM>), a monitoring and control system <NUM>, and a fuel supply system <NUM>. The gas turbine system <NUM> may include a compressor <NUM>, combustion systems <NUM>, fuel nozzles <NUM>, a turbine <NUM>, and an exhaust section <NUM>. During operation, the gas turbine system <NUM> may pull air <NUM> into the compressor <NUM>, which may then compress the air <NUM> and move the air <NUM> to the combustion system <NUM> (e.g., which may include a number of combustors). In the combustion system <NUM>, the fuel nozzle <NUM> (or a number of fuel nozzles <NUM>) may inject fuel that mixes with the compressed air <NUM> to create, for example, an air-fuel mixture.

The air-fuel mixture may combust in the combustion system <NUM> to generate hot combustion gases, which flow downstream into the turbine <NUM> to drive one or more turbine <NUM> stages. For example, the combustion gases move through the turbine <NUM> to drive one or more stages of turbine <NUM> blades, which may in turn drive rotation of a shaft <NUM>. The shaft <NUM> may connect to a load <NUM>, such as a generator that uses the torque of the shaft <NUM> to produce electricity. After passing through the turbine <NUM>, the hot combustion gases may vent as exhaust gases <NUM> into the environment by way of the exhaust section <NUM>. The exhaust gas <NUM> may include gases such as carbon dioxide (CO<NUM>), carbon monoxide (CO), nitrogen oxides (NOx), and so forth.

It can be appreciated that the industrial system <NUM> can adopt other forms, without limit. Examples can include steam turbine systems, a hydraulic turbine systems, one or more compressor systems (e.g., aeroderivative compressors, reciprocating compressors, centrifugal compressors, axial compressors, screw compressors, and so forth), one or more electric motor systems. Other industrial systems can also include fans, extruders, blowers, centrifugal pumps, or any of various other industrial machinery that may be included in an industrial plant or other industrial facility. As will be further appreciated, the techniques discussed herein may be used to monitor and protect any of the aforementioned industrial machinery, or any combination of the industrial machinery.

In certain embodiments, the system <NUM> can also include a protection monitoring system <NUM>, a control system <NUM>, a number of sensors <NUM>, and a human machine interface (HMI) operator interface <NUM>. The protection monitoring system <NUM> can receive data from the sensors <NUM>. The machinery protection monitoring system <NUM> can energize one or more relay contacts <NUM>, <NUM>, <NUM> based on the sensor data to generate an alarm signal indicative of, for example, operational condition of the fuel system <NUM>, the compressor <NUM>, the turbine <NUM>, the combustion system <NUM>, the exhaust section <NUM>, or other components of the industrial system <NUM>, alone or in combination.

In certain embodiments, the HMI operator interface <NUM> may be executable by one or more computer systems (although not illustrated), which may be used by a plant operator to interface with the industrial system <NUM> via an HMI operator interface <NUM>. Accordingly, the HMI operator interface <NUM> may include various input and output devices (e.g., mouse, keyboard, monitor, touch screen, or other suitable input and/or output device) such that a plant operator may provide commands (e.g., control and/or operational commands) to the machinery protection monitoring system <NUM> or the control system <NUM> and to receive operational information from the machinery protection monitoring system <NUM>, the control system <NUM>, or directly from the sensors <NUM>. Similarly, the control system <NUM> may be responsible for controlling one or more final control elements coupled to the components (e.g., the compressor <NUM>, the turbine <NUM>, the combustors <NUM>, the load <NUM>, and so forth) of the industrial system <NUM> such as, for example, one or more actuators, valves, transducers, and so forth.

In certain embodiments, the sensors <NUM> can be any of various sensors useful in acquiring operational data regarding one or more components of the industrial system <NUM> and transmitting the operational data to the machinery protection monitoring system <NUM>. Examples of the operational data can include pressure and temperature of the compressor <NUM>, speed and temperature of the turbine <NUM>, vibration of the compressor <NUM> and the turbine <NUM>, CO<NUM> levels in the exhaust gas <NUM>, carbon content in the fuel <NUM>, temperature of the fuel <NUM>, temperature, pressure, clearance of the compressor <NUM> and the turbine <NUM> (e.g., distance between the compressor <NUM> and the turbine <NUM> and/or between other stationary and/or rotating components that may be included within the industrial system <NUM>), flame temperature or intensity, vibration, combustion dynamics (e.g., fluctuations in pressure, flame intensity, and so forth), load data from load <NUM>, and so forth.

<FIG> illustrates an exemplary embodiment of the machinery protection monitoring system <NUM>. As generally discussed above, the machinery protection monitoring system <NUM> can include any device useful in providing continuous, online monitoring and protection of the compressor <NUM>, the turbine <NUM>, the combustors <NUM>, or other components of the industrial system <NUM>. In one embodiment, the machinery protection monitoring system <NUM> may be enclosed inside, for example, a finished cabinet, such that the machinery protection monitoring system <NUM> may be panel mounted (e.g., near the compressor <NUM>, the turbine <NUM>, or other machinery that may be monitored by the monitoring system <NUM>) or retrofitted as a standalone and/or integrated system.

The machinery protection monitoring system <NUM> can include an electronic board <NUM>. The electronic board <NUM> can further include one or more processors <NUM> that are operatively coupled to a memory <NUM> to execute instructions for carrying out one or more safety functions. In general, a safety function can determine a plurality of sensor measurement (e.g., position, speed, acceleration, vibrational amplitude, etc.) from raw data received from the sensors <NUM> (e.g., voltage, current, etc.) As an example, the processor <NUM> can receive the sensor <NUM> data (e.g., pressure and temperature of the compressor <NUM>, speed and temperature of the turbine <NUM>, vibration of the compressor <NUM> and the turbine <NUM>, CO<NUM> levels in the exhaust gas <NUM>, carbon content in the fuel <NUM>, temperature of the fuel <NUM>, temperature, pressure, clearance of the compressor <NUM> and the turbine <NUM>, flame temperature or intensity, vibration, and combustion dynamics of the combustion system <NUM>, load data from load <NUM>, and so forth).

The safety function can be further configured to compare each sensor measurement to a predetermined alarm set point. As an example, the electronic board <NUM> of the machinery protection monitoring system <NUM> may include a number of respective monitors for monitoring respective operating inputs and/or outputs. The respective monitors may each occupy respective slots in a rack of the protection monitoring system <NUM>. The processor <NUM> may provide user-adjustable alarm set points for each of a number of input and/or output channels of the protection monitoring system <NUM>.

In certain embodiments, the protection monitoring system <NUM> may be programmed or configurable (e.g., performed via the processor <NUM> and the memory <NUM>) to be responsive to a number of detected operating conditions of the industrial system <NUM>. A safety function can be implemented for each sensor measurement and provide an output based upon a comparison of the sensor measurement(s) and one or more predetermined set points. In one embodiment, the output can be a status determined by programmed logic. However, in other embodiments, discussed in greater detail below, the output can be a numerical value.

Under circumstances where the one or more sensor measurements of the safety function fall outside of the predetermined alarm set points, it is desirable for the safety function output to annunciate detection of a fault or other adverse operating condition of one or more components (e.g., the compressor <NUM>, the turbine <NUM>, the combustors <NUM>, the load <NUM>, and so forth) of the industrial system <NUM>. With annunciation of a fault, the industrial system <NUM> can be placed in a safe state where adverse consequences to worker safety, environmental health, and/or machine damage can be avoided. As an example, the safety function generates and transmits alarm signals to one or more relays <NUM>, <NUM>, and <NUM>. The alarm signals may also be passed to one or more front-panel indicators <NUM>, <NUM>, and <NUM> (e.g., light-emitting diodes (LEDs)), facilitating, for example, plant operator or technician observation. Based on these outputs, the control system <NUM> may provide outputs to transducers or other final control elements (e.g., valves, actuators, etc.).

However, if a fault is erroneously identified (e.g., due to errors in one or more of hardware and/or software performing the safety function) or an accident occurs because a fault is not identified, undesirable delays and associated costs can be incurred, as well as harm to workers, environmental health and/or machine damage. Accordingly, embodiments of the machinery protection monitoring system <NUM> also include a shadow function diagnostic. The shadow function diagnostic receives the same data from the sensors <NUM> as the safety function and determines a shadow function output corresponding to each safety function output. That is, the shadow function diagnostic determines a shadow function output for each measurement of the safety function. This process of determining a shadow function output for a safety function can be referred to herein as shadowing.

As an example, the output of each of the shadow function and the safety function can be an estimated status of the monitored asset (e.g., sensors, instrumentation, machines, etc.) In one embodiment, the asset status can be a "fault present" status, representing detection of one or more predetermined deviations from normal operation that constitute an asset fault. In another embodiment, the asset status can be "no fault present," representing no detection of deviations from normal operation that constitute an asset fault. As discussed below, recognizing that respective asset status estimates determined by the safety function and the shadow function are merely provisional and unconfirmed when considered independently from one another, the safety function output and corresponding shadow function output can be compared to one another in order to verify whether or not the status estimates are correct.

When the asset status estimates represented by the shadow function output and the safety function output agree with one another (e.g., are approximately equivalent or equal within a predetermined tolerance), this result can indicate that the asset status estimates are correct.

After an asset fault status is determined to be correct, the asset fault status can be annunciated (e.g., via HMI operator interface <NUM> or other mechanism (e.g., front panel indicators <NUM>, <NUM>, <NUM>). For example, a first annunciation can represent the "asset fault present" status, while a second annunciation can represent the "no asset fault" status.

When the asset fault status represented by the shadow function output and safety function output are different and do not agree with one another, this result can indicate that at least one of the safety function output or the shadow function output is incorrect. That is, one of the safety function or the shadow function is not operating correctly, constituting a "diagnostic fault" status. Accordingly, under this circumstances, an alarm can be annunciated in a third annunciation, different from the first and second annunciations, to communicate detection of the diagnostic fault status.

It can be understood that, when the diagnostic fault condition is detected, the industrial machine <NUM> can be unprotected because it is not clear whether an asset fault is present or not. Therefore, to be conservative, annunciation of either the "asset fault present" status the "diagnostic fault" status can trigger control of the industrial machine <NUM> to adopt the safe state.

As further discussed below, in contrast with existing diagnostics, the shadow function diagnostic does not determine a shadow function output continuously for each safety function measurement. Instead, the shadow function is time-division multiplexed across all safety function measurements. As an example, during a first time period, a first safety function measurement is shadowed, during a second time period immediately following the first time period, a second safety function measurement is shadowed, etc. Shadowing is continued in succession by the shadow function until all safety function measurements have been shadowed. In general, a maximum diagnostic interval can be specified to shadow a given safety function or set of two or more safety functions. In other words, the maximum diagnostic interval specifies the maximum amount of time for the shadow function to shadow each safety function. However, under circumstances where the shadow function can shadow each safety function in less time than the maximum diagnostic interval, the shadow function can repeat shadowing of one or more safety functions, provided that the maximum diagnostic interval is not exceeded.

<FIG> illustrates an embodiment of the electronics board <NUM> including a first processor <NUM>, a second processor <NUM>, and a third processor <NUM>. As discussed in detail below, the first processor <NUM> is configured to execute one or more safety functions <NUM> and transmit a safety function output <NUM>. Similarly, the second processor <NUM> is configured to execute one or more shadow functions <NUM> and transmit a shadow function output <NUM> corresponding to a respective safety functions <NUM>. The third processor <NUM> is configured to receive the safety function output <NUM> and the shadow function output <NUM> as inputs and validate or verify the safety function output <NUM> by a comparison between the two. The third processor <NUM> can be further configured to determine a condition <NUM> based upon this validation comparison.

As shown, sensor data <NUM> is received by the electronics board <NUM> from the sensors <NUM> and directed to the first processor <NUM> and the second processor <NUM>. In certain embodiments, the sensor data <NUM> can be raw sensor data output by the sensors <NUM>, such as voltage or current. In certain embodiments, not shown, the sensor data <NUM> can optionally be pre-processed prior to transmission to the first processor <NUM> and the second processor <NUM>. As an example, preprocessing can include decimation of raw sample rate.

The first processor <NUM> can be configured to convert the sensor data <NUM> to a measurement. The measurement(s) can be compared (e.g., processing <NUM>) with corresponding alarm set point <NUM>. Subsequently, the safety function output <NUM> (e.g., a first estimate of the asset status) can be generated and transmitted to the third processor <NUM>.

The second processor <NUM> can be configured to convert the sensor data <NUM> to a measurement. The measurements is compared (e.g., processing <NUM>) with corresponding alarm set points <NUM>. Subsequently, the safety function output <NUM> (e.g., a second estimate of the asset status) is generated and transmitted to the third processor <NUM>.

The third processor <NUM> is configured to compare the received shadow function output <NUM> to the safety function output <NUM>, to determine a condition based upon the comparison, and to transmit the determined condition to one or more of the relays <NUM>, <NUM>, <NUM>. In certain embodiments, the relays <NUM>, <NUM>, <NUM> can correspond to different predetermined conditions (e.g., "fault present," "no fault present," "diagnostic fault," respectively. Thus, when one of the relays <NUM>, <NUM>, <NUM> receives its corresponding condition, the relay contact (e.g., <NUM>, <NUM>, <NUM>, respectively) actuates and transmits a condition signal representing the determined condition for annunciation (e.g., to HMI operator interface <NUM> and/or another annunciation mechanism such as front panel indicators <NUM>, <NUM>, <NUM>).

Under circumstances where the output shadow function output <NUM> and the safety function output <NUM> are equivalent, the condition determined by the third processor <NUM> can be designated as correct. Receipt of the "fault present" condition by the corresponding relay (e.g., relay <NUM>) can trigger actuation of its relay contact (e.g., relay contact <NUM>) and this condition can be annunciated by the HMI operator interface <NUM> and/or a corresponding front panel indicator (e.g., front panel indicator <NUM>). Receipt of the "no fault present" condition by the corresponding relay (e.g., relay <NUM>) can trigger actuation of its relay contact (e.g., relay contact <NUM>) and this condition can be annunciated by the HMI operator interface <NUM> and/or a corresponding front panel indicator (e.g., front panel indicator <NUM>). In alternative embodiments, annunciation of the "no asset fault" condition can be omitted, as this condition represents normal operation.

Under circumstances where the shadow function output <NUM> and the safety function output <NUM> are not equivalent, the condition determined by the third processor <NUM> can be designated as a "diagnostic fault" condition. Receipt of the "diagnostic fault" condition by the corresponding relay (e.g., relay <NUM>) can trigger actuation of its relay contact (e.g., relay contact <NUM>) and this condition can be annunciated by the HMI operator interface <NUM> and/or a corresponding front panel indicator (e.g., front panel indicator <NUM>).

Under circumstances where either the "fault present" condition or the "diagnostic fault" condition are determined, actuation of the corresponding relay contacts (e.g. relay contacts <NUM>, <NUM>, respectively), commands to the control system <NUM> (e.g., control and/or operational commands) that are operative to suspend normal operation of the industrial system <NUM> and place the operations of the selected components of the gas turbine system <NUM> corresponding to the asset fault condition or diagnostic fault condition in a safe state. In alternative embodiments, annunciation of any fault can be suppressed by an operator (e.g., via the HMI operator interface <NUM>), at their discretion, to permit normal operation of the industrial system <NUM> to continue.

In general, the shadow function <NUM> is configured to perform a black box style of diagnostic. That is, when shadowing a given measurement of the safety function <NUM>, for the same input as the safety function <NUM>, the shadow function output <NUM> is configured replicate the safety function output <NUM>, assuming no errors are present in the hardware and/or software used to generate the safety function output <NUM> (e.g., the first processor <NUM> and software executed thereby) and the shadow function output <NUM> (e.g., the second processor <NUM> and software executed thereby).

The algorithms performed by the shadow function <NUM> to determine the shadow function output <NUM> can be different than those employed by the safety function <NUM> to determine the safety function output <NUM>. Beneficially, under circumstances where there is an error in hardware and/or software executing algorithms to determine the safety function output <NUM>, replication of such an error can be avoided by the shadow function <NUM> when determining the shadow function output <NUM>. Likewise, under circumstances where there is an error in the hardware and/or software executing algorithms to determine the safety function output <NUM>, replication of such an error can be avoided by the safety function <NUM> when determining the shadow function status <NUM>. This can also be referred to as disparate processing.

A difference between the implementation of the shadow function <NUM> and simple redundancy is that there is a single shadow function <NUM>, or a two or more shadow functions <NUM>, and that the shadow function(s) <NUM> time-division multiplex their processing and alarm diagnostics across all safety functions <NUM> and safety function measurements (e.g., acquisition and transmission of sensor data <NUM>).

As shown in <FIG>, three independent safety functions, first safety function <NUM>-<NUM>, second safety function <NUM>-<NUM>, and third safety function <NUM>-<NUM> are shadowed by a respective portions of a single shadow function, first safety function shadow <NUM>-<NUM>, second safety function shadow <NUM>-<NUM>, third safety function shadow <NUM>-<NUM>. In alternative embodiments, not shown, three independent shadow functions can be performed for a single safety function. During each shadowing phase, respective safety function shadows <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> are given the same inputs as the one of the safety function shadows <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> that it is shadowing (e.g., first safety function shadow <NUM>-<NUM> shadows first safety function <NUM>-<NUM>, second safety function shadow <NUM>-<NUM> shadows second safety function <NUM>-<NUM>, third safety function shadow <NUM>-<NUM> shadows third safety function <NUM>-<NUM>). The respective safety function shadows <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> can shadow their corresponding safety function <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> for an amount of time that is sufficient to determine whether the outputs of the safety function shadows <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> transmitted by the second processor <NUM> are identical to the corresponding outputs of safety function <NUM>-<NUM>, <NUM>-<NUM>, <NUM>-<NUM> transmitted by the first processor <NUM>.

In certain embodiments, the output of the shadow function <NUM> and the safety function <NUM> can be a numerical value, rather than a status. As an example, the safety function output <NUM> and shadow function output <NUM> can be an operational parameter measurement, rather than a status resulting from comparison of the operational parameter measurement with the corresponding alarm set point <NUM>, <NUM>. Accordingly, the shadow function output <NUM> and the safety function output <NUM> in this context can be considered to be identical when the respective numerical values are within a predetermined tolerance of one another. For given processors and/or cores, the accuracy of a given output (e.g., decimal point precision) can vary. Accordingly, the predetermined tolerance can be assigned with such differences in mind.

As further shown in <FIG>, a minimum supported diagnostic interval <NUM> for the shadow function <NUM> is the amount of time required for the shadow function <NUM> to shadow every safety function <NUM> (e.g., every safety function measurement of every safety function <NUM>). This can influence potential deployments in high demand systems that require a very short diagnostic interval. As discussed above, in the context of <FIG>, the safety functions <NUM> are the first safety function <NUM>-<NUM>, the second safety function <NUM>-<NUM>, and the third safety function <NUM>-<NUM>. The first safety function <NUM>-<NUM> is monitored by the first safety function shadow <NUM>-<NUM> during a first portion di of the diagnostic interval <NUM>. The second safety function <NUM>-<NUM> is monitored by the second safety function shadow <NUM>-<NUM> during a second portion d<NUM> of the diagnostic interval <NUM>. The third safety function <NUM>-<NUM> is monitored by the third safety function shadow <NUM>-<NUM> during a third portion ds of the diagnostic interval <NUM>. In further embodiments, in order to improve the diagnostic interval, multiple shadow functions can be executed in parallel, each shadowing a different safety function.

Because each safety function <NUM> is only shadowed by the shadow function <NUM> during a portion of the diagnostic interval <NUM>, there is a possibility of transitory failure causing an error during a time when respective ones of the safety function <NUM> is not shadowed and then the error disappears when the shadow function <NUM> subsequently shadows the respective safety functions <NUM> again. In order to handle this aspect of safety certification, it can be desirable to employ temporal redundancy to provide resistance to single faults. As an example, the first processor <NUM> and the second processor <NUM> can be configured to require that the "fault present" status is identified multiple times by the safety function <NUM> or the shadow function <NUM>, respectively, before such a fault status is transmitted to the third processor <NUM> for verification.

In certain embodiments, the first processor and the second processor can be the same. As an example, the safety function and the shadow function can be executed on the same core of a single processor.

In one alternative embodiment, the safety function <NUM> and the shadow function <NUM> can be executed on different cores (of the same core architecture or different core architectures) on the same multi-core processor. Beneficially, under circumstances where there is an error in determination of the safety function output <NUM> due to errors in the processor core, repetition of such an error can be avoided by the shadow function <NUM> when determining the shadow function output <NUM>.

Common cause failures can be reduced by executing the safety function <NUM> and the shadow function <NUM> on different cores of the same processor, as compared to such execution on the exact same core. However, it can be appreciated that such an approach can miss certain common cause failures. Examples of common cause failures can include, but are not limited to, a common power supply, cache, or other memory shared by multiple cores, etc. Accordingly, in a further embodiment, the safety function and the shadow function can be executed on different cores of different multi-core processors. In one aspect, the first and second processors can be physically different but of the same architecture (single core) or core architecture (multi-core). In another aspect, the first and second processors can be physically different with different architecture (single core) or core architecture (multi-core) architectures. Since the cores of the first and second processors are physically and/or architecturally different, the number of common cause failures related to hardware can be significantly reduced. This further results in a decrease of the work needed for diagnostics on common cause failures. Accordingly, this approach has the additional cost benefit of allowing the second processor implementing the shadow function to be smaller and cheaper as compared to the first processor implementing the safety function.

In a further embodiment, the shadow function can be implemented on a different core of a different type than the safety function. The core implementing the shadow function can have a much higher reliability than can be found on many SIL certifiable processor architectures. Such cores can have built-in diagnostic coverage, failure tolerance, and additional measures to ensure that the diagnostic coverage on the safety function measurements is maximized.

This concept can be thought of as the Golden Rule idea, where the shadow function has a very high degree of confidence in accuracy and can be used in such a fashion. Ordinarily, when comparing the output of two redundant functions, the only thing that can be determined is whether a fault is present. It is unknown if the fault is in the safety function <NUM> or the shadow function <NUM> itself. In contrast, in embodiments where the shadow function <NUM> is implemented on a high reliability processor, the statistical likelihood that the shadow function <NUM> is the cause of error is relatively low. Furthermore, there are certain behaviors that can be done to improve availability, such as having the shadow function <NUM> temporarily take over implementation of a safety function <NUM> exhibiting error while that safety function <NUM> is being corrected.

Building from the high-reliability concept of the shadow function <NUM> discussed above, even though the statistical likelihood of the Golden Rule shadow function exhibiting failure is low, it is still non-negligible. To further reduce this likelihood, the shadow function <NUM> can be redundantly implemented on even higher reliability processor architecture, such as lock-step cores. Employing such an approach, the statistical likelihood of the shadow function <NUM> exhibiting a failure is approaching negligible. This improves availability that the shadow function <NUM> can then be used to take over the safety function <NUM> temporarily while the original safety function is repaired.

An exemplary embodiment of a diagnostic method <NUM> employing the machinery protection monitoring system <NUM> (e.g., the electronics board <NUM>) is illustrated in <FIG>. As shown, the method <NUM> includes operations <NUM>-<NUM>. It can be understood, however, that alternative embodiments of the method can include greater or fewer operations and the operations of the method can be performed in an order different than that illustrated in <FIG>, as necessary.

In operation <NUM>, sensor data 42a acquired by the sensors <NUM> can be received by selected ones of a plurality of processors. As an example, the plurality of processors can include the first processor <NUM>, the second processor <NUM>, and the third processor <NUM>. The sensor data 42a can be received by the first processor <NUM> and the second processor <NUM>.

In operation <NUM>, the first processor <NUM> can execute the safety function <NUM>. The safety function <NUM> can be configured to perform a variety of operations. As an example, in operation 504a, the safety function <NUM> can be configured to determine one or more sensor measurements representing an operating parameter of a monitored asset from the sensor data 42a. In operation 504b, the safety function <NUM> can be further configured to compare selected ones of the sensor measurements to respective predetermined alarm set points. In operation 504c, the safety function <NUM> can also be configured to determine the safety function output <NUM> for of the selected sensor measurements. The safety function output <NUM> can represent a first status estimate for the monitored asset.

In operation <NUM>, the first processor <NUM> can transmit the safety function output <NUM>. As discussed below, the safety function output <NUM> can be received by the third processor <NUM> for processing.

In operation <NUM>, the second processor <NUM> can execute the shadow function <NUM>. The shadow function <NUM> can be configured to perform a variety of operations. As an example, the operations can include operation 510a, where the shadow function <NUM> determines a shadow function output <NUM> corresponding to each safety function output <NUM> during different respective portions of the diagnostic interval <NUM>. The shadow function output <NUM> can represent a second status estimate for the monitored asset and it can also be configured to replicate the safety function output <NUM> under conditions where the safety function output <NUM> and the shadow function output <NUM> are free from error.

In operation <NUM>, the second processor <NUM> can transmit the shadow function output <NUM>. As discussed below, the shadow function output <NUM> can be received by the third processor <NUM> for processing.

In operation <NUM>, the third processor <NUM> can receive the safety function output <NUM> and the shadow function output <NUM>. The third processor <NUM> can be different from the first processor <NUM> and the second processor <NUM>.

In operation <NUM>, the third processor <NUM> can validate each safety function output <NUM>. As an example, the third processor <NUM> can compare the safety function output <NUM> with its corresponding shadow function output <NUM>.

In operation <NUM>, the third processor <NUM> can output the condition <NUM> determined from the comparison performed in operation <NUM>. The output condition <NUM> can be received by one or more of the relays <NUM>, <NUM>, <NUM>. As discussed above, receipt of the condition <NUM> by a respective relay <NUM>, <NUM>, <NUM> can trigger actuation of its corresponding relay contact (e.g., <NUM>, <NUM>, <NUM>, respectively) to transmit an corresponding condition signal to the HMI operator interface <NUM> for annunciation.

Under circumstances where the status represented by the safety function output <NUM> and the shadow function output <NUM> agree (e.g., are equivalent), the third processor <NUM> can output that status as the condition <NUM>. As discussed above, in an embodiment, the safety function output <NUM> and the shadow function output <NUM> can be one of "asset fault present" or "no asset fault. " Alternatively, under circumstances where the status represented by the safety function output <NUM> and the shadow function output <NUM> are not in agreement (e.g., are not equivalent), neither status is output by the third processor <NUM>. Instead, a "diagnostic fault" is output as the condition <NUM>.

In further embodiments, when the condition <NUM> output by the third processor <NUM> is either the "asset fault present" condition or the "diagnostic fault" condition, one or more of the relays <NUM>, <NUM>, <NUM>) can be triggered (e.g., via actuation of respective relay contacts <NUM>, <NUM>, <NUM>) to cause commands (e.g., control and/or operational commands) to be sent to the control system <NUM>. Such commands can be operative to suspend normal operation of the industrial system <NUM> and cause the components of the gas turbine system <NUM> that correspond to the asset fault condition or diagnostic fault to operate in a predetermined safe state. In further embodiments, annunciation of an instrumentation fault can be optionally suppressed by an operator (e.g., via the HMI operator interface <NUM>) at their discretion to continue normal operation of the industrial system <NUM>.

Exemplary technical effects of the methods, systems, and devices described herein include, by way of non-limiting example systems and methods for providing diagnostic coverage of safety functions utilizing a shadow function. A safety instrumented system including the shadow function can provide SIL certification without employing full redundancy, reducing the cost per point for safety function diagnostics. Commercially available high-reliability platforms can be used without the need to process all safety functions simultaneously. A Golden Rule concept can be implemented, where if a difference between safety function output and shadow function output occurs, there is a high degree of confidence that the failure is in the safety function, rather than the shadow function. The Golden Rule can be improved with shadow function redundancy, improving availability.

Certain exemplary embodiments have been described to provide an overall understanding of the principles of the structure, function, manufacture, and use of the systems, devices, and methods disclosed herein. One or more examples of these embodiments have been illustrated in the accompanying drawings. Those skilled in the art will understand that the systems, devices, and methods specifically described herein and illustrated in the accompanying drawings are non-limiting exemplary embodiments and that the scope of the present invention is defined solely by the claims. The features illustrated or described in connection with one exemplary embodiment may be combined with the features of other embodiments. Such modifications and variations are intended to be included within the scope of the present invention.

Claim 1:
A diagnostic system, comprising:
a plurality of processors (<NUM>, <NUM>, <NUM>), wherein at least a portion of the processors are configured to receive data acquired by a sensor (<NUM>), the plurality of processors including,
a first processor (<NUM>) configured to, continuously execute one or more safety functions during a respective portion of a diagnostic interval, wherein each executed safety function is configured to perform operations including,
determining one or more respective sensor measurements representing an
operating parameter of a monitored asset from the received data;
comparing selected ones of the one ore more respective sensor measurements to respective
predetermined alarm set points (<NUM>);
determining a safety function output (<NUM>) for the selected sensor measurements based upon the sensor measurement comparison, the safety function output (<NUM>) representing a first status estimate for the monitored asset; and
transmitting the safety function output (<NUM>);
characterized by a second processor (<NUM>) configured to:
execute a shadow function configured to determine one or more shadow function output (<NUM>) each corresponding to a respective safety function output (<NUM>) during a respective portion of a the diagnostic interval distinct from the respective portion of the corresponding safety function, and wherein each shadow function output (<NUM>) represents a second status estimate for the monitored asset using the same data from the sensor (<NUM>) as the corresponding safety function; and
transmit each of the shadow function outputs (<NUM>) for the safety function output (<NUM>);
a third processor (<NUM>), different from the first and second processors (<NUM>, <NUM>), and configured to:
validate the one or more safety function outputs (<NUM>) by comparing each of the safety function outputs (<NUM>) with its corresponding one shadow function output (<NUM>), and
output a condition (<NUM>) for the monitored asset based upon the validation comparison; and
a plurality of relays (<NUM>,<NUM>,<NUM>) configured to receive the output condition (<NUM>) to actuate a respective relay contact (<NUM>,<NUM>,<NUM>) and transmit a condition signal representing the determined condition for annunciation.