Technology for configuring voting blocks associated with process control systems

Abstract

This paper describes techniques for configuring voting blocks used in process control systems in process plants. Depending on certain aspects, the voting block can have a voting scheme that specifies the output based on a set of inputs, wherein the voting block can be parametrically configured using various control options that guide the behavior of the voting scheme. Specifically, bypass degradation options can be specified for one or more inputs, controlling whether a "bypass" input degrades the voting scheme; state degradation options can be specified for one or more inputs, controlling whether a "bad" input degrades the voting scheme; and trip enable options can be specified, controlling whether tripping occurs automatically under certain conditions. These control options allow the voting block to be configured to conform to various specifications and other requirements.

Description

Technical Field

[0001] This disclosure generally relates to configuring voting blocks for process control systems, and more specifically, to effectively and efficiently configuring voting blocks to comply with various specifications using a variety of control inputs. Background Technology

[0002] Distributed process control systems, such as those used in chemical, petroleum, industrial, or other process plants for manufacturing, refining, converting, generating, or producing physical materials or products, typically include one or more process controllers that are communicatively coupled to one or more field devices via analog, digital, or combined analog / digital buses, or via wireless communication links or networks. Field devices can be, for example, valves, valve positioners, switches, and transmitters (e.g., temperature, pressure, level, and flow rate sensors) located within the process environment and typically perform physical or process control functions, such as opening or closing valves, measuring process and / or environmental parameters, such as temperature or pressure, to control one or more processes executing within the process plant or system. Intelligent field devices, such as those conforming to the well-known Fieldbus protocol, may also perform control calculations, alarm functions, and other control functions typically implemented within the controller. Process controllers, typically located in a factory environment, receive signals indicating process measurement results obtained from field devices and / or other information related to the field devices. These controller applications execute controller applications that run, for example, different control modules. These control modules make process control decisions, generate control signals based on the received information, and coordinate with the control modules or blocks executing in the field devices, such as… and Fieldbus field devices. Control modules in the controller send control signals to field devices via communication lines or links to control the operation of at least a portion of a process plant or system, for example, to control at least a portion of one or more industrial processes running or executed within the plant or system. For example, the controller and field devices control at least a portion of a process controlled by the process plant or system. I / O devices, typically also located in the plant environment, are usually arranged between the controller and one or more field devices, and communication between them is achieved, for example, by converting electrical signals to digital values ​​and vice versa. As used herein, field devices and controllers are generally referred to as “process control devices.”

[0003] Information from field devices and controllers is typically made available via high-speed data channels or communication networks to one or more other hardware devices, such as operator workstations, personal computers or computing devices, data history repositories, report generators, centralized databases, or other centralized management computing devices. These devices are usually located in control rooms or other locations away from harsher plant environments. Each of these hardware devices is typically centralized across the entire process plant or a portion thereof. These hardware devices run applications that, for example, enable operators to perform functions related to controlling processes and / or operating the process plant, such as changing the settings of process control routines, modifying the operation of control modules within controllers or field devices, viewing the current status of the process, viewing alarms generated by field devices and controllers, simulating process operation for training personnel or testing process control software, maintaining and updating configuration databases, etc. The high-speed data channels used by hardware devices, controllers, and field devices can include wired communication paths, wireless communication paths, or a combination of wired and wireless communication paths.

[0004] Many process control systems include a separate safety system to detect safety-related critical issues in the process plant and automatically facilitate preventative measures, such as shutting down valves, removing power from equipment, and switching flow within the plant, in the event of problems that could cause or lead to serious hazards in the plant, such as spills of toxic chemicals or explosions. These safety systems typically have one or more separate controllers, called logic solvers, separate from the standard process controllers, connected to safety field devices via a separate bus or communication line installed in the process plant. The logic solver uses the safety field devices to detect process conditions associated with critical events, such as the position of certain safety switches or shut-off valves, overflows or underflows in the process, operation of important power generation or control equipment, operation of fault detection equipment, etc., thus detecting "events" within the process plant. When an event is detected, the safety controller takes an action to limit the adverse nature of the event, such as shutting down valves, shutting down equipment, removing power from parts of the plant, etc. Typically, these actions involve switching safety devices to a trip or "safe" operating mode, designed to prevent serious or hazardous conditions within the process plant.

[0005] Function blocks within a safety instrumentation system or logic solver can be programmed with logic to bypass or cover the use of signals or detection conditions of field devices, for example, when signals received from field devices are poor, when logic within the field devices is in a faulty or abnormal mode, or when a manual signal is sent from an operator workstation to initiate bypass or coverage. For instance, some analog input (AI) or digital input (DI) function blocks are programmed to provide bypass or coverage to logic within the safety system controller, preventing the safety system controller logic from using the output of the field device (i.e., the output of the AI ​​or DI block) as a valid input to determine whether an event has occurred. However, when field devices are undergoing maintenance, for example, these function blocks typically provide such bypass or coverage signals in response to a manual activation signal generated by the operator or engineer.

[0006] Similarly, in safety instrumented systems, it is common practice to use redundant input devices such as transmitters and switches to detect events within the system to provide greater safety integrity or availability of process variable measurements. In such systems, voting logic functions must sometimes be provided within the shutdown logic to determine whether a process condition is acceptable or hazardous based on redundant inputs. This voting logic is relatively simple, as it typically only requires determining a majority vote on the inputs to detect whether an event condition has occurred. For example, a 2oo3 (3-to-2) voting block can require the safety system to trip if two of the three inputs are TRIP (trip). Furthermore, voting function blocks with overriding and bypass capabilities can be provided to, for example, prevent shutdown of the system during process control system startup, enable maintenance personnel to perform maintenance operations on one or more input devices, or allow temporary ignoring of selected process conditions, etc.

[0007] Currently, voting blocks are programmed on demand and are not configurable. That is, each time a voting block needs to perform in a manner different from its initially defined "standard" behavior, it must be manually reprogrammed. This introduces the possibility of human error during the programming process, which could lead to suboptimal outcomes in the best-case scenario and, in the worst-case scenario, dangerous and / or life-threatening situations. Furthermore, in some cases, "calc (calculation)" is added to the general voting block to "customize" or modify its programmed voting strategy. Besides providing an opportunity for human error, using an additional computation block also introduces latency and inaccuracy into the security system because both blocks operate within a finite-duration set scan time, potentially introducing race conditions and read / write problems.

[0008] Therefore, among other benefits, there is an opportunity to configure voting blocks effectively and efficiently to reduce human error and comply with various specifications. Summary of the Invention

[0009] This document discloses techniques, systems, apparatuses, components, devices, and methods for configuring voting blocks. These techniques, systems, apparatuses, components, devices, and methods can be applied to industrial process control systems, environments, and / or plants, which are interchangeably referred to herein as “industrial control,” “process control,” or “process” systems, environments, and / or plants. Typically, such systems and plants provide control over one or more processes in a distributed manner, said processes operating to manufacture, refine, convert, generate, or produce physical materials or products. Process control or safety instrumentation systems use function block logic to coordinate the logic within the process control or safety instrumentation system with the operational states of field devices.

[0010] In one embodiment, a computer-implemented method is provided for configuring a configurable voting block for a process control system in a process plant. The configurable voting block may have a voting scheme associated with a set of inputs, and the method may include: receiving a first control selection via a user interface, the first control selection indicating whether a voting scheme degradation for the configurable voting block is applied to a first instance of a first type of input in the input set; receiving a second control selection via a user interface, the second control selection indicating whether a voting scheme degradation for the configurable voting block is applied to a second instance of a first type of input in the input set; configuring the configurable voting block according to the first control selection and the second control selection; receiving a set of inputs from a set of devices associated with the process plant; and processing the input set according to the configured configurable voting block, wherein the processing results in an output of the configurable voting block.

[0011] In another embodiment, a computing device is provided for configuring a configurable voting block for a process control system in a process plant. The configurable voting block may have a voting scheme associated with a set of inputs, and the computing device may include: a user interface, a memory storing a set of computer-executable instructions, and a processor connected to the user interface and the memory interface and configured to execute the set of computer-executable instructions to cause the processor to perform the following operations: receiving a first control selection via the user interface, the first control selection indicating whether to use a downgraded voting scheme for the configurable voting block for a first instance of a first type of input in the input set; receiving a second control selection via the user interface, the second control selection indicating whether to use a downgraded voting scheme for the configurable voting block for a second instance of a first type of input in the input set; configuring the configurable voting block according to the first control selection and the second control selection; receiving a set of inputs from a set of devices associated with the process plant; and processing the set of inputs according to the configured configurable voting block, wherein the processing results in an output of the configurable voting block.

[0012] In a further embodiment, a controller module for use in a process plant is provided, the process plant having a processor communicatively coupled to control one or more field devices. The controller module may include: a non-transitory computer-readable medium; and a function block stored on the non-transitory computer-readable medium and executed on the processor, the function block including: an input set, each input configured to receive an input signal indicating a process condition from within the process plant; a first control block including a first control parameter indicating whether a first instance of a first type of input for one input in the input set is used for voting scheme degradation of the function block; a second control block including a second control parameter indicating whether a second instance of a first type of input for another input in the input set is used for voting scheme degradation of the function block; an output providing an output signal; and a voter logic block coupled between the first control block, the second control block, and the output, the voter logic block being configured to generate the output signal based on the input signal set, the first control parameter, and the second control parameter. Attached Figure Description

[0013] Figure 1 This is a block diagram of an exemplary process plant having a safety system integrated with a process control system, according to certain embodiments;

[0014] Figure 2 According to certain embodiments Figure 1 A block diagram of one of the configurable voting unit functional blocks;

[0015] Figures 3A-3C Example state diagrams of various voting schemes with degradation options according to certain embodiments are shown;

[0016] Figure 4A-4I Example truth tables according to certain embodiments are shown, illustrating the inputs and outputs for various configurable voting blocks with different control options; and

[0017] Figure 5 This is a flowchart illustrating an example method for configuring a configurable voting block according to certain embodiments. Detailed Implementation

[0018] Process control systems used in process plants typically include one or more safety instrumented systems that monitor the status of values ​​and parameters within certain operating limits. When a hazardous condition occurs, the safety system can trigger alarms and / or place one or more parts of the process plant in a safe or shutdown state. Such safety systems are designed to prevent accidents (e.g., fire, explosion, equipment damage, etc.) inside and outside the process plant.

[0019] According to the systems and methods discussed herein, the security system incorporates configurable voting block functionalities that can be integrated into a programming environment to implement user-specified voting logic. In embodiments, each configurable voting block can receive multiple inputs from sensors or other field devices and generate a specified output when a preset number of inputs indicate a desired output. For example, in a 2oo3 (three-out-of-two) voting block, at least two of the three inputs must indicate a "skip" condition so that the voting block outputs a "skip" signal; otherwise, the voting block outputs "normal".

[0020] Typically, when the input to the voting block is only NML (Normal) or TRP (Trip), the voting block can operate without concern. However, there are additional types of inputs relevant to the process plant. For example, the input can be BAD (Bad), such as if the corresponding field device is inoperable or unreliable (or not receiving a signal), or BYP (Bypass), such as during maintenance of the field device or when the “Trip” signal is considered faulty. The voting block can implement different logic to handle BAD and BYP inputs. In one implementation, when the input is BAD-NML-TRP, the 2oo3 voting block can produce a “Trip” output (i.e., treat the BAD input as a TRP input). In another implementation, when the input is BAD-NML-TRP, the 2oo3 voting block can produce a “Normal” output (i.e., treat the BAD input as an NML input). Similarly, various implementations can treat the BYP input as either a TRP input or an NML input.

[0021] For example, if different customers sometimes require different types of voting strategies for different parts of a process plant, multiple different voting block configurations may be needed, where strategies can vary based on various factors such as safety principles, cost, execution time, type of control functions, and / or other factors. Traditionally, voting blocks are programmed as needed and are not configurable. As a result, each time a voting block needs to execute in a way different from its initially defined "standard" behavior, the block must be manually reprogrammed. This introduces the possibility of human error during the programming process, which could lead to suboptimal situations in the best case and dangerous and / or life-threatening situations in the worst case. Furthermore, in some cases, a "calc (calculation) block" can be added to a general voting block to "customize" or modify its programmed voting strategy. Besides providing an opportunity for human error, using an additional calculation block also introduces latency and inaccuracy into the safety system, as both blocks operate within a finite-duration set scan time, potentially introducing race conditions and read / write problems.

[0022] The systems and methods described herein address these problems by enabling individuals (e.g., configuration engineers) to parametrically configure the behavior of individual voting blocks, rather than requiring the programming of new blocks and / or the addition of computational blocks. The systems and methods may incorporate a user interface with dropdowns that allow individuals to set the behavior for each input or combination of inputs. According to embodiments, a configurable voting block can treat a first input (a first instance of a BAD or BYP input) differently from a conventional block where each input undergoes the same logical evaluation programmed into the block (e.g., asymmetric input treatment) compared to a second or subsequent input of the same type. For example, a configurable voting block may treat a first instance of a BAD input as NML and a second instance of a BAD input as TRP, or it may treat a first instance of a BAD input as NML but treat both BAD inputs as TRP if two BAD inputs occur.

[0023] Figure 1 Process plant 10 is shown, including a process control system 12 integrated with a safety system 14 (indicated by dashed lines). The safety system typically operates as a Safety Instrumented System (SIS) to monitor and override controls provided by the process control system 12 to maximize the safe operation of process plant 10. Process plant 10 also includes one or more host workstations, computers, or user interfaces 16 (which can be any type of personal computer, laptop, desktop computer, mobile device, workstation, PDA, etc.) accessible to plant personnel such as process control operators, maintenance personnel, safety engineers, etc. Figure 1 In the example shown, two user interfaces 16 are shown connected to two separate process control / safety control nodes 18 and 20 and to a configuration database 21 via a common communication line or bus 22. The communication network 22 can be implemented using any desired bus-based or non-bus-based hardware, any desired hardwired or wireless communication architecture, and any desired or suitable communication protocol (e.g., Ethernet).

[0024] According to an embodiment, each node 18 and 20 of the process plant 10 includes process control system equipment and safety system equipment connected together via a bus structure, which can be set on the base plate to which different equipment are attached. Node 18 is in Figure 1 The node is shown as including process controller 24 (which may be a redundant pair of controllers) and one or more process control system input / output (I / O) devices 28, 30, and 32, while node 20 is shown as including process controller 26 (which may be a redundant pair of controllers) and one or more process control system I / O devices 34 and 36. Each of the process control system I / O devices 28, 30, 32, 34, and 36 is communicatively connected to a set of process control-related field devices. Figure 1 The components are shown as field devices 40 and 42. The process controllers 24 and 26, I / O devices 28-36, and controller field devices 40 and 42 roughly constitute the system. Figure 1 12. Process control system.

[0025] Similarly, node 18 includes one or more security system logic resolvers 50, 52, while node 20 includes security system logic resolvers 54 and 56. Each of the logic resolvers 50-56 is an I / O device having a processor 57 that executes a security logic module 58 stored in memory 79, and is communicatively connected to provide control signals to and / or receive signals from security system field devices 60 and 62. Additionally, each of nodes 18 and 20 includes at least one message propagation device (MPD) 70 or 72, which are connected via a ring bus 74. Figure 1 (Only a portion of them is shown) are communicatively coupled to each other. The security system logic solvers 50-56, security system field devices 60 and 62, MPDs 70 and 72, and bus 74 roughly constitute the system. Figure 1 Security system 14. It should be understood that security system 14 as described herein is an example, and additional or alternative security systems may be envisioned.

[0026] Process controllers 24 and 26, for example only, could be DeltaV sold by Emerson Process Management. TM A controller, or any other desired type of process controller, is programmed to provide process control functionality (using what is commonly referred to as a control module) using I / O devices 28, 30, and 32 (for controller 24), I / O devices 34 and 36 (for controller 26), and field devices 40 and 42. Specifically, each of controllers 24 and 26 implements or monitors one or more process control routines stored therein or otherwise associated with it, and communicates with field devices 40 and 42 and workstation 14 to control process 10 or a portion thereof in any desired manner. Field devices 40 and 42 can be any desired type of field device, such as sensors, valves, transmitters, positioners, etc., and can conform to any desired open, proprietary, or other communication or programming protocols, including, for example, Or 4-20mA protocol (as shown for field device 40), any fieldbus protocol, such as Fieldbus protocol (as shown for field device 42), or CAN, Profibus, AS-Interface protocol, to name just a few. Similarly, I / O devices 28-36 can be any known type of process control I / O device using any suitable one or more communication protocols.

[0027] Figure 1 The safety logic solvers 50-56 can be any desired type of safety system control device, including a processor 57 and a memory. The memory stores safety logic modules 58 suitable for execution on the processor 57 to provide control functions related to the safety system 14 using field devices 60 and 62. Of course, safety field devices 60 and 62 can be any desired type of field device, conforming to or using any known or desired communication protocols, such as those mentioned above. In particular, field devices 60 and 62 can be the type of safety-related field devices traditionally controlled by a separate dedicated safety-related control system. Figure 1 In the process plant 10 shown, the safety field device 60 is shown using a dedicated or point-to-point communication protocol, such as Or a 4-20mA protocol, while the safety field device 62 is shown using a bus communication protocol, such as Fieldbus protocol. Safety field device 60 can perform any desired function, such as shutting off valves, cutting off switches, etc.

[0028] A common backplane 76 (represented by dashed lines through controllers 24, 26, I / O devices 28-36, safety logic solvers 50-56, and MPDs 70 and 72) is used in each node 18 and 20 to connect controllers 24 and 26 to process control I / O cards 28, 30 and 32 or 34 and 36, and to safety logic solvers 50, 52, 54 or 56 and MPDs 70 or 72. Controllers 24 and 26 are also communicatively coupled to bus 22 and operate as bus arbitrators of bus 22, enabling each of the I / O devices 28-36, logic solvers 50-56, and MPDs 70 and 72 to communicate with any workstation 16 via bus 22.

[0029] According to an embodiment, each of the workstations 16 includes a processor 77 and a memory 78, the memory storing one or more configuration and / or viewing applications suitable for execution on the processor 78. Figure 1In the exploded view, configuration application 80 and viewing application 82 are shown stored in one of workstations 16, while diagnostic application 84 is shown stored in another of workstations 16. However, these and other applications may be stored and executed in different workstations 16 or in other computers associated with process plant 10 if needed. Generally, configuration application 80 provides configuration information to safety engineers, enabling them to configure some or all components of process plant 10 and store this configuration in configuration database 21. As part of the configuration activities performed by configuration application 80, safety engineers may create control routines or control modules for process controllers 24 and 26, and may create safety logic modules 58 (including creating and programming voter function blocks for use in safety logic solvers 50-56 or even in controllers 24 and 26) for any and all safety logic solvers 50-56, and may download these different control and safety modules to the appropriate one of process controllers 24 and 26 and safety logic solvers 50-56 via bus 22 and controllers 24 and 26. Similarly, configuration application 80 can be used to create other programs and logic and download them to any of the I / O devices 28-36, field devices 40, 42, 60 and 62, etc.

[0030] Conversely, if needed, the viewing application 82 can be used to provide one or more displays to a user (such as a process control operator, safety operator, etc.) either in a separate view or in the same view, including information about the status of the process control system 12 and the safety system 14. For example, the viewing application 82 can be an alarm display application that receives and displays alarm indications to the operator. According to an embodiment, the viewing application 82 can receive alarms from the process control system 12 and the safety system 14 and display the alarm in an integrated alarm display, because alarms from systems 12 and 14 will be sent to the operator workstation 14 executing the alarm display application and will be identified as alarms from different devices. Similarly, the operator can handle safety alarms displayed in the alarm header in the same way as process control alarms. For example, the operator or user can use the alarm display to acknowledge a safety alarm, disable a safety alarm, etc., and the alarm display will use communication via bus 22 and backplane 76 to send messages to the appropriate process controllers 24, 26 within the safety system 14 to take appropriate action regarding the safety alarm. In a similar manner, other viewing applications can display information or data from process control system 12 and safety system 14, because these systems can use the same type and kind of parameters, safety and references, making it possible for any data from one of systems 12 and 14 to be integrated into displays or views traditionally provided for process control systems.

[0031] Diagnostic application 84 can be used to perform diagnostic or maintenance procedures within the process control and safety systems of plant 10. This diagnostic application, capable of performing any desired type of diagnostic or maintenance procedure (e.g., process and valve testing, startup procedures, etc.), can provide coverage to one or more voter function blocks (described below) used within process plant 10 to prevent the operation of the safety system based on inputs from one or more devices implemented by the diagnostic procedure.

[0032] In any case, applications 80, 82, and 84, as well as any other applications, can send and receive separate configuration and other signals to each process controller 24 and 26 and each safety system logic resolver 50-56. These signals may include process-level messages relating to the operating parameters of the process field devices 40 and 42, and may include safety-level messages relating to the operating parameters of the safety-related field devices 60 and 62. While safety logic resolvers 50-56 can be programmed to recognize both process-level and safety-level messages, they are capable of distinguishing between the two types of messages and will not be programmed or influenced by process-level configuration signals. In one example, programming messages sent to the process control system devices may include certain fields or addresses that are recognized by the safety system devices and prevent those signals from being used to program the safety system devices.

[0033] If necessary, safety logic solvers 50-56 can employ the same or different hardware or software designs compared to those used for process control I / O cards 28-36. Using replacement techniques for devices within process control system 12 and safety system 14 can minimize or eliminate hardware or software failures of common causes. Furthermore, safety system devices including logic solvers 50-56 can employ any desired isolation and security techniques to reduce or eliminate the opportunity for unauthorized changes to the safety-related functions implemented thereunder. For example, safety logic solvers 50-56 and configuration application 80 can require a person with a specific privilege level or located at a specific workstation to modify the safety modules within logic solvers 50-56, a privilege level or location different from the privilege or access level or location required to modify the process control functions performed by controllers 24 and 26 and I / O devices 28-36. In this case, only those specified in the safety software or located at workstations authorized to modify safety system 14 are authorized to change safety-related functions, thus minimizing the chance of disruption to the operation of safety system 14. Understandably, in order to achieve this security, the processors in the security logic solvers 50-56 evaluate the appropriate form and security of the input messages and act as a gatekeeper for changes made by the security level control module 58, which is executed in the security logic solvers 50-56.

[0034] According to an embodiment, a backplane 76 is used at each node 18 and 20 to enable safety logic resolvers 50 and 52, as well as safety logic resolvers 54 and 56, to communicate locally with each other to coordinate safety functions implemented by each of these devices, communicate data with each other, or perform other integrated functions. On the other hand, MPDs 70 and 72 operate to allow portions of the safety system 14 located in very different locations within the plant 10 to still communicate with each other to provide coordinated safety operation at different nodes of the process plant 10. Specifically, MPDs 70 and 72, together with bus 74, enable safety logic resolvers associated with different nodes 18 and 20 of the process plant 10 to be communicatively cascaded together to allow safety-related functions within the process plant 10 to cascade according to specified priorities. Alternatively, two or more safety-related functions at different locations within the process plant 10 can be interlocked or interconnected without having to run dedicated lines to individual safety field devices within separate areas or nodes of the plant 10. That is, the use of MPDs 70 and 72 and bus 74 enables safety engineers to design and configure safety system 14, which is essentially distributed throughout the process plant 10, but has different interconnected components to allow completely different safety-related hardware to communicate with each other as needed. This feature also provides scalability to safety system 14, as it allows additional safety logic solvers to be added to safety system 14 when needed or when new process control nodes are added to process plant 10.

[0035] According to an embodiment, logic solvers 50-56 can be programmed to perform control activities regarding security devices 60 and 62 using a function block programming paradigm. Specifically, as shown in an expanded view of one of the security control modules 58A (stored in memory 79) of logic solver 54, the security control module may include a set of interconnected function blocks that can be created and downloaded to logic solver 54 for implementation during operation of process 10. Figure 1As shown, control module 58a includes two voting function blocks 92 and 94, which have inputs communicatively interconnected with other function blocks 90. These other function blocks may be, for example, analog input (AI), digital input (DI) function blocks, or other function blocks designed to provide signals to voting function block 92. Voting function blocks 92 and 94 have at least one output connected to one or more other function blocks 91. These other function blocks may be analog output (AO), digital output (DO), causal function blocks implementing causal logic, control and diagnostic function blocks that can receive output signals from voting function blocks 92 and 94 to control the operation of safety devices 60 and 62, etc. Of course, safety control module 58a can be programmed in any desired manner to include any type of function block and one or more voting function blocks, which are configured in any desired or useful manner to perform any desired function.

[0036] Although Figure 1 An extended view of the safety control module 58a includes a digital voter function block 92 with five digital inputs and an analog voter function block 94 with three analog inputs. However, it should be understood that any number of different safety logic modules 58 can be created for each different logic solver 50-56 and used therein, and each of these modules can include any number of voter function blocks with any desired number of inputs that are communicatively connected to other function blocks in any desired manner. Similarly, if used in, for example, a Fieldbus network, the voter function blocks 92 and 94 can be any Fieldbus type function block, or any other function blocks connected to them can be located in other devices, such as field device 62, and implemented therein. If used outside the safety system, the voter function blocks 92 and 94 can be implemented in process controllers 24, 26, I / O devices 28-36, field device 42, etc. As is generally understood, voting function blocks 92 and 94 typically receive redundant inputs from redundant sensors or transmitters within the safety system 14 and apply a voting scheme to these inputs to determine whether a safety system tripping condition exists based on all of these inputs.

[0037] Figure 2 It is shown Figure 1 The block diagram shows the components of an example voter 94, which is an analog voter function block because it processes analog input signals transmitted via, for example, analog input (AI) function block 90. ​​Typically, voter function block 94 includes three inputs labeled IN1 (input 1), IN2 (input 2), and IN3 (input 3), adapted to receive input signals from, for example, redundant sensors or other redundant elements within process plant 10, such as from… Figure 1Field devices 60 and 62 receive input signals. Each of inputs IN1, IN2, and IN3 can be provided to one of trip limit check blocks 95a, 95b, or 95c and pre-limit check blocks 96a, 96b, or 96c. Trip limit check block 95 compares the inputs sent to it with preset limits to determine whether the input signal has reached a value associated with a trip condition (which can be a high value, a low value, or a value within a predetermined range). In a similar manner, pre-limit check block 96 compares the inputs sent to it with preset pre-limits to determine whether the input signal has reached a value associated with an alarm or warning indicating a trip condition that is close to being present, even if it is not yet present. In effect, pre-limit check block 96 enables the creation of alarm or event signals indicating that a dangerous or other undesirable condition is approaching, even if it is not yet present.

[0038] The outputs of the escape limit check block 95 and the pre-limit check block 96 (which may be digital signals set to high values ​​when limits or pre-limits are met in blocks 95 and 96) are each passed to one of the sets of input bypass disable blocks 98a, 98b, and 98c. Input bypass disable block 98 performs input disable on each of the inputs IN1, IN2, and IN3, allowing one or more of these inputs to be disabled, i.e., not used within the voter function block 94, to determine whether an escape condition or a pre-exit alarm condition exists. Each input bypass disable block 98 provides an output to the escape voter logic block 100a for the associated escape limit condition and to the pre-exit voter logic block 100b for the associated pre-limit condition. Voter logic blocks 100a and 100b execute voter logic, as described in more detail below, to determine whether an escape condition or a pre-exit alarm condition exists based on their inputs.

[0039] The detach voter logic block 100a and the pre-detach voter logic block 100b respectively provide a detach signal and a pre-detach alarm signal to the start-up disable block 102 (when these conditions are determined to exist). The start-up disable block 102 can prevent the voter function block 94 from providing any detach signal or pre-detach alarm signal output during startup or other execution or runtime processes, such as when it is desired to disable the operation of the voter function block 94. The start-up disable block 102 generates a detach output signal (labeled Out) determined as a result of the operation of the detach voter logic block 100a and the start-up disable block logic, and additionally generates a Pre_out signal determined as a result of the operation of the pre-detach voter logic block 100b and the start-up disable block logic. The Out signal can be used to drive... Figure 1The Out and Pre_out signals are used to operate the shutdown procedure within the safety system 14, while the Pre_out signal can be used to provide an alarm to indicate that a trip condition is imminent within the process plant 10. Of course, the Out and Pre_out signals can be used for other purposes if needed.

[0040] Voting function block 94 may include a set of parameters, some of which are in Figure 2 These parameters are indicated as being above or below the blocks using them, and are set, for example, during the configuration of voter function block 94 to implement or specify the operation of voter function block 94. Specifically, the Trip_Lim and Pre_Trip_Lim parameters are used to set or establish the trip limit used in trip limit block 95, and to set the pre_Trip_Lim parameter used in pre_Trip check block 96. The trip limit and / or pre_Trip_Lim parameters can be the same for each of the different blocks 95 and 96, or they can be set individually for each of blocks 95 and 96. Similarly, the Trip_Hys and Pre_Trip_Hys parameters are used to set the hysteresis that blocks 95 and 96 must experience between consecutive trips. That is, once one of blocks 95 or 96 detects that one of the input signals is above (or below) a limit, the hysteresis value of the jump hysteresis parameter (for block 95) and the hysteresis value of the pre-jump hysteresis parameter (for block 96) determine how far the input signal must be below (or above) the limit before the jump signal (or pre-jump signal) is turned off or before a second jump signal (or pre-jump signal) can be set by that block.

[0041] Voting block 94 also has an internal trip type configuration parameter called Trip_Type, which defines the normal and trip state values ​​associated with the inputs and / or outputs of voting block 94. For example, when voting block 94 is configured to "power-off trip" (which can be the default value), the normal operating value of the output is one, and the trip state value is zero. Conversely, when voting block 94 is configured to "power-on trip," the normal operating value is zero, and the trip state value is one. This initial determination is made at trip limit check blocks 95a, 95b, and 95c corresponding to inputs IN1, IN2, and IN3, respectively, and at pre-limit check blocks 96a, 96b, and 96c. The Detect_Type parameter can be used to determine whether the comparison with the trip limit is a greater than (high limit) comparison or a less than (low limit) comparison. This comparison occurs at the appropriate trip limit check block 95 and pre-limit check block 96 to determine whether the input signal has reached the predetermined limit.

[0042] As will be understood, the output of the trip limit check block 95 will each indicate whether a corresponding one of the inputs IN1, IN2, and / or IN3 indicates a trip. As described above, the input bypass disable block 98 can apply maintenance overrides or bypasses to each of the individual inputs IN1, IN2, and IN3 to prevent these inputs from being used in the voting logic applied by the voter logic block 100. For example, this bypass feature is desirable when performing maintenance on a transmitter or other field device that provides input signals to the voter function block 94. When using voting logic that determines the trip output based on multiple inputs, maintenance bypass is not always necessary because a single erroneous trip vote (which may arise from maintenance activities on the sensors providing the inputs) will not necessarily result in a trip. However, this bypass function is desirable to prevent erroneous trips during maintenance activities and may be necessary in some voter logic, such as in one of two voter logic schemes, where the presence of even a single trip signal from a redundant sensor will result in a trip.

[0043] When one of the input bypass disable blocks 98 bypasses an input, voter logic blocks 100a and 100b will not use the bypassed input to generate a jump signal or a pre-jump alarm signal, even if the input value exceeds the limit specified by the jump limit or pre-jump limit parameter. To enable bypassing, the Bypass_Permit parameter can be enabled first to control whether input bypassing is initially allowed. Generally, if the Bypass_Permit parameter is set or enabled, input bypassing will be allowed, and if the Bypass_Permit parameter is not set or enabled, input bypassing will not be allowed. Although a single Bypass_Permit parameter can apply to all bypass disable blocks 98, individual bypass permissions can be set for each input bypass disable block 98a, 98b, and 98c.

[0044] If the Bypass_Permit parameter is set or enabled, the BYPASSx parameter can be used to cause one or more of the Bypass Disabling Blocks 98 to operate to disable one of the associated inputs IN1, IN2, or IN3. The x in the BYPASSx parameter indicates which of the inputs IN1, IN2, or IN3 will be disabled. More than one input can be disabled at any given time if needed, or the Voter Block 94 can be configured to allow only one input to be disabled at a time. The Bypass_Permit and BYPASSx parameters can be set or issued in any desired manner, such as via operator display buttons on an operator or maintenance screen, physical key switches, discrete inputs to the security module, through configuration, control, display, or diagnostic applications, or in any other way. Of course, if bypass permission is not required in any particular implementation of the Voter Block 94, the default value of the Bypass_Permit parameter can be set to enabled when configuring the Voter Block 94.

[0045] The Bypass_Timeout parameter can be used to set the amount of time after a bypass is set for one of the blocks 98, after which the bypass will automatically expire. In this case, each input bypass disable block 98 may include a bypass timer as one of a set of timers 110, which is set to the Bypass_Timeout parameter value and can count down when the bypass begins. In this case, the input bypass disable block 98 can disable the relevant input until BYPASSx is turned off or until the bypass timer reaches zero. As will be understood, the bypass timer is used to ensure that the bypass is removed after a predetermined amount of time.

[0046] The Bypass_Degrad parameter can be used to indicate whether a bypass input to one of the blocks 98 degrades the voting scheme. For example, a degraded 2oo3 voting scheme becomes a 1oo3 voting scheme. Each of blocks 98a, 98b, and 98c can have a Bypass_Degrad parameter, allowing each block 98 to indicate whether the corresponding bypass input degrades the voting scheme.

[0047] Similarly, the Status_Degrad parameter can be used to indicate whether a bad input to one of the blocks 98 has degraded the voting scheme. For example, a degraded 2oo3 voting scheme becomes a 1oo3 voting scheme. Each of blocks 98a, 98b, and 98c can have a Status_Degradation parameter, allowing each block 98 to indicate whether the corresponding bad input has degraded the voting scheme.

[0048] The Trip_INH option can be used to indicate whether an automatic trip occurs when the number of required votes exceeds the number of non-bypass or bad votes. For example, in a given voting scheme AooB, an automatic trip will occur when the number of required votes (A) exceeds the number of non-bypass or bad votes (B) (i.e., A > B). See also... Figure 4A-4I The Bypass_Degrad, Status_Degrad, and Trip_INH parameters are described in more detail.

[0049] If needed, the input bypass disable block 98 can also be configured to provide an alert to users (e.g., operators, safety engineers, technicians, etc.) to remind or notify them that a bypass timeout is imminent. If the bypass is configured to disappear or be disabled upon bypass timeout, a notification can be sent to the user or other operator before the timeout by setting the reminder time (REMINDER_TIME) parameter to a non-zero value. In this case, if the bypass timer is non-zero but less than the reminder time parameter, and any bypassed input is voting to be detached, an alert can be activated to provide an alert to the user indicating that an impending shutdown may occur once the bypass timer expires. If there are no bypassed inputs voting to be detached, no alert needs to be activated, although it can still be activated. However, it will be understood that even when the bypass timeout alert is valid, detachment is not necessarily imminent, as there may not be enough other inputs voting to be detached for the detach voter logic block 100a to generate a detach signal.

[0050] In one embodiment, the bypass timer is re-provided only when the first bypass times out. However, the bypass timer can be a writable parameter, allowing the bypass timer to be incremented to extend the bypass time using an operator display button (or some other suitable technique) after a timeout notification has been given. This feature allows the user to extend the bypass time, for example, while still performing maintenance procedures on a field device that is providing bypassed input to the voter function block 94. Alternatively, the bypass timeout notification can be used only for indicative purposes, for example, if the bypass is not disabled when the bypass timer times out. In this case, the alert alarm can be enabled even if the alert time parameter is set to zero when the bypass timer times out. However, if the alert time parameter is non-zero, the alert will still occur before the timeout (if the input is a vote to be skipped). Both the alert alarm and the bypass alarm can be acknowledged or unacknowledged.

[0051] The voting logic executed by voter logic blocks 100a and 100b is preferably configured as an "N-to-M" logic function. According to this function, M out of a total of N inputs must vote to skip. For example, voter function block 94 can be configured as a 3-to-2 (2oo3) voter, meaning that two of the three inputs must satisfy the skip limit before the output of voter logic block 100a is set to the skip state value, and two of the three inputs must satisfy the pre-skip limit before voter logic block 100b is set to the pre-skip alarm value. The value of N in the "N-to-M" function is determined based on the number of inputs that are not disabled, while the value of M is determined based on an internal parameter of the block called the number to skip (NUM_TO_TRIP), which can be configured to default to any desired value equal to or less than N. Common voting schemes can include, for example, 3-to-2 (2oo3), 2-to-1 (1oo2), 2-to-2 (2oo2), etc. However, any other voting logic can be used. Due to other features of block 94, the voter function block 94 can also be used in single transmitter applications, such as in the case of a one-to-one (1oo1) voter function logic.

[0052] Typically, 1oo2 or 1oo1 voting schemes may require maintenance bypass functionality because during maintenance activities, bypassing is disabled in a way that causes a detected tripping condition at the input of the voter function block 94 for that transmitter, even if one of the transmitters would necessarily cause a tripping condition to be set by the voter logic block 100a. However, voter function blocks configured to require multiple votes to trip can still benefit from bypass functionality for more predictable behavior during maintenance procedures.

[0053] Bypassing one of the inputs IN1, IN2, or IN3 can affect voter logic blocks 100a and 100b in one of two ways. It can either reduce the number of inputs required to determine a trip condition (or a pre-trip alarm condition) by one, or it can keep that number of inputs the same. For example, when voter logic block 100a is configured as a 2oo3 voter logic block and one of the inputs IN1, IN2, or IN3 is bypassed, the voting scheme can become a 1oo2 voting scheme, meaning that the number of inputs required for a vote to trip is reduced by one (as is the possible number of inputs). Alternatively, when the selected input is bypassed, the 2oo3 voting scheme can be changed to a 2oo2 voting scheme, meaning that the number of inputs required for a vote to trip remains the same (even if the possible number of inputs is reduced by one). The bypass option parameter can be used to specify whether the actual number of inputs required to trip should be reduced by one when the input is bypassed.

[0054] Figures 3A-3B Example state diagrams of various voting schemes for configurable voting blocks are shown. Specifically, Figure 3AExample state diagram 305 shows a 2oo3 voting scheme with a downgrade option. Figure 3B Example state diagram 325 shows a 2002 voting scheme with a downgrade option, and, Figure 3C Example state diagram 350 shows a 1oo2 voting scheme with a degradation option. Specifically, state diagrams 305, 325, and 350 illustrate how a voting scheme can be downgraded or modified based on certain control choices. Crossed-out lines (i.e., indicated by "x") represent invalid paths.

[0055] Figure 4A-4I Example truth tables, such as those for configurable voting blocks, are shown. Each truth table indicates a voting scheme (2oo3 in each case) and an input set (input 1, input 2, and input 3 in each case). According to an embodiment, each of the input sets can have one of four values: Normal (“NML”), Skip (“TRP”), Bypass (“BYP”), or Bad (“BAD”).

[0056] Additionally, each example truth table indicates a set of control choices that can be specified or selected by the user via a user interface. In one implementation, this set of control choices can be selected via a user interface that can implement drop-down menus or other selection techniques. One type of control choice is a bypass degradation choice, which indicates whether the BYP input degrades the voting scheme. For example, a degraded 2oo3 voting scheme becomes a 1oo3 voting scheme. According to an embodiment, the "N" (normal) choice indicates that the BYP input does not degrade the voting scheme, while the "R" (reduction) choice indicates that the BYP input degrades the voting scheme. The bypass degradation choice allows the user to specify "N" or "R" for multiple instances of the BYP input. For example, "N" can be specified for a first instance of the BYP input, and "R" can be specified for a second instance of the BYP input (or vice versa). It should be understood that other combinations of "N" and "R" are conceivable.

[0057] Similarly, another control choice is the state degradation choice, which indicates whether a BAD input degrades the voting scheme. According to an embodiment, the "N" (normal) choice indicates that a BAD input does not degrade the voting scheme, and the "V" (vote to skip) choice indicates that a BAD input degrades the voting scheme. The state degradation choice allows the user to specify "N" or "V" for multiple instances of a BAD input. For example, "N" can be specified for the first instance of a BAD input, and "V" can be specified for the second instance of a BAD input (or vice versa). It should be understood that other combinations of "N" and "V" are conceivable. The control choice can also support the occurrence of multiple BAD inputs, where each BAD input is treated as a TRP (independent of the state degradation choice).

[0058] In addition, another control option is the skip disallow enable option, which indicates whether a skip should occur automatically when the number of required votes exceeds the number of non-bypass or bad votes. According to various embodiments, the "N" (No) selection can indicate that a skip should not occur automatically, while the "Y" (Yes) selection can indicate that a skip should occur automatically. For example, in a given voting scheme AooB, a skip will occur automatically when the number of required votes (A) exceeds the number of non-bypass or bad votes (B) (i.e., A > B).

[0059] Each truth table indicates a set of columns with a value or state that depends on the voting scheme, the set of inputs, and the control selection. Specifically, each truth table includes a "Voting Quantity" column indicating the number of votes (i.e., the amount of TRP input received) and a "Degradation Scheme" column indicating an updated or revised voting scheme (in some cases, a degraded voting scheme) based on the inputs and control selections. Additionally, each truth table includes an "Output" column indicating the output of a configurable voting block based on the corresponding inputs and control selections. Furthermore, each truth table includes a "Bypass Status" column indicating whether bypassing is allowed.

[0060] Typically, in each truth table, the second number in the revised voting scheme of the "Degradation Scheme" column (e.g., "3" in 2oo3) represents the number of BYP or BAD inputs subtracted from 3. For example, if the second number is "2", the number of BYP or BAD inputs is one; if the second number is "1", the number of BYP or BAD inputs is two, and so on. The second number then represents the number of good, non-bypass inputs in a valid voting scheme.

[0061] exist Figure 4A In the truth table 400 shown, the bypass degradation selection is “N” (402) and “R” (404) (that is, the first instance of the BYP input does not degrade the voting scheme, and the second instance of the BYP input degrades the voting scheme), the state degradation selection is “V” (406) and “N” (408) (that is, the first instance of the BAD input degrades the voting scheme, and the second instance of the BAD input does not degrade the voting scheme), and the escape disallowing enable selection is “N” (410) (that is, escape will not occur automatically when the number of required votes exceeds the number of non-bypass or bad votes).

[0062] like Figure 4AAs shown, line 411 includes the input sets NML, NML, and TRP, resulting in "vote count" being "1", the updated voting scheme (2oo3), the output of NML (because two of the three inputs are NML), and allowing bypassing; line 412 includes the input sets NML, TRP, and TRP, resulting in "vote count" being "2", the updated voting scheme (2oo3), the output of TRP (because two of the three inputs are TRP), and allowing bypassing; line 413 includes the input sets BYP, NML, and NML, resulting in "vote count" being "0", The updated voting scheme 2oo2 (the first BYP input does not downgrade the voting scheme), the output of NML (because two of the three inputs are NML), and bypassing is allowed (because the second BYP input is configured to reduce the number of votes to be skipped, so the second bypass will go to the 1oo1 scheme); line 414 includes the input sets BYP, BYP, and NML, resulting in "vote count" being "0", the updated voting scheme 1oo1 (because the second BYP input downgrades the voting scheme), the output of NML (because the first BYP is treated as an NML input), and bypassing is not allowed. The remaining lines of truth table 400 allow the configurable voting block to operate similarly.

[0063] Figure 4B An additional example truth table 420 is shown with a 2oo3 voting scheme and the following control choice set 421: N, N, N, N, and N. A representative line 422 of the truth table 420 includes the input sets BYP, NML, and NML, resulting in a "vote count" of "0", an updated voting scheme 2oo2 (the first BYP input does not downgrade the voting scheme), the output of NML (because two of the three inputs are NML), and no bypassing (because the second BYP input is configured not to reduce the vote to be skipped, so a second bypass will not occur, as it is configured not to reduce 2 to 1, therefore bypassing is not allowed due to entering a disallowed state). Another representative line 423 of the truth table 420 includes the input sets BAD, TRP, and NML, resulting in a "vote count" of "1", an updated voting scheme 2oo2 (the BAD input does not downgrade the voting scheme), the output of NML (because the BAD input is treated as NML), and no bypassing.

[0064] Figure 4CAn additional example truth table 425 is shown with a 2oo3 voting scheme and the following control choice set 426: R, N, N, N, and N. A representative line 427 of truth table 425 includes the input sets BYP, TRP, and NML, resulting in a "vote count" of "1", an updated voting scheme 1oo2 (the first BYP input demotes the voting scheme), the output of TRP (because the BYP input is treated as TRP), and allowing bypassing. Another representative line 428 of truth table 425 includes the input sets BAD, TRP, and NML, resulting in a "vote count" of "1", an updated voting scheme 2oo2 (the BAD input does not demote the voting scheme), the output of NML (because the BAD input is treated as NML), and disallowing bypassing.

[0065] Figure 4D An additional example truth table 430 is shown with a 2oo3 voting scheme and the following control choice set 431: N, R, N, N, and N. A representative line 432 of the truth table 430 includes the input sets BYP, TRP, and NML, resulting in a "vote count" of "1", an updated voting scheme 2oo2 (the first BYP input does not downgrade the voting scheme), the output of NML (because the BYP input is treated as NML), and allowing bypassing. Another representative line 433 of the truth table 430 includes the input sets BAD, NML, and NML, resulting in a "vote count" of "0", an updated voting scheme 2oo2 (the BAD input does not downgrade the voting scheme), the output of NML (treating the BAD input as NML), and disallowing bypassing.

[0066] Figure 4E An additional example truth table 435 is shown with a 2oo3 voting scheme and the following control choice set 436: R, R, N, N, and N. A representative line 437 of truth table 435 includes the input sets BYP, TRP, and NML, resulting in a "vote count" of "1", an updated voting scheme 1oo2 (the first BYP input downgrades the voting scheme), the output of TRP (because the BYP input reduces the number of votes required for a jump, and there is a TRP input that results in the TRP output in the resulting voting scheme 1oo2), and no bypassing allowed. Another representative line 438 of truth table 435 includes the input sets BYP, BAD, and NML, resulting in a "vote count" of "0", an updated voting scheme 1oo1 (the BYP input downgrades the voting scheme), the output of NML (because there is an NML input in the 1oo1 voting scheme), and no bypassing allowed.

[0067] Figure 4FAn additional example truth table 440 is shown with a 2oo3 voting scheme and the following control choice set 441: N, N, V, N, and N. A representative line 442 of the truth table 440 includes the input sets BAD, TRP, and NML, resulting in a "vote count" of "1", an updated voting scheme 1oo2 (the BAD input downgrades the voting scheme), the output of TRP (because the BAD input reduces the number of votes required for a jump, and there is a TRP input that results in the TRP output in the resulting voting scheme 1oo2), and allowing bypassing. Another representative line 443 of the truth table 440 includes the input sets BAD, BAD, and NML, resulting in a "vote count" of "0", an updated voting scheme 1oo1 (the first BAD input downgrades the voting scheme), the output of NML (because there is an NML input in the 1oo1 voting scheme), and disallowing bypassing.

[0068] Figure 4G An additional example truth table 445 is shown with a 2oo3 voting scheme and the following control choice set 446: N, N, N, V, and N. A representative line 447 of truth table 445 includes the input sets BAD, TRP, and NML, resulting in a "vote count" of "1", an updated voting scheme 2oo2 (the first BAD input does not downgrade the voting scheme), the output of NML (because the BAD input is ignored and there is only a single TRP input in the 2oo2 voting scheme), and no bypassing allowed. Another representative line 448 of truth table 445 includes the input sets BYP, BAD, and NML, resulting in a "vote count" of "0", an updated valid voting scheme 2oo1 (the BAD input does not downgrade the voting scheme), the output of TRP (because there is a BAD input as a vote to be skipped), and no bypassing allowed.

[0069] Figure 4H An additional example truth table 450 is shown with a 2oo3 voting scheme and the following control choice set 451: N, N, V, V, and N. A representative line 452 of the truth table 450 includes the input sets BAD, TRP, and NML, resulting in a "vote count" of "1", an updated voting scheme 1oo2 (BAD inputs demote the voting scheme), the output of TRP (because BAD inputs are treated as TRP), and allowing bypassing. Another representative line 453 of the truth table 450 includes the input sets BAD, BAD, and NML, resulting in a "vote count" of "0", an updated voting scheme 0oo1 (each BAD input demotes the voting scheme), the output of TRP (because both BAD inputs are treated as votes), and allowing bypassing.

[0070] Figure 4IAn additional example truth table 455 is shown with a 2oo3 voting scheme and the following control choice set 456: N, N, N, N, and Y. A representative line 457 of truth table 455 includes the input sets BYP, BYP, and NML, resulting in a "vote count" of "0", an updated voting scheme 2oo1 (the BYP input does not downgrade the voting scheme), the output of INH (because escaping INH achieves "Y" in the 2oo1 voting scheme and 2 > 1), and disallowing bypassing. Another representative line 458 of truth table 455 includes the inputs BAD, TRP, and the TRP set, resulting in a "vote count" of "2", an updated voting scheme 2oo2 (the BAD input does not downgrade the voting scheme), the output of TRP (because there are two TRP inputs), and disallowing bypassing.

[0071] Figure 5 A block diagram of an example method 500 is shown that enables the configuration of a configurable voting block for a process control system in a process plant. According to an embodiment, the configurable voting block may have a voting scheme associated with a set of inputs. Furthermore, method 500 is readily executable by a computer device (specifically, its processor) configured to connect to implement the configurable voting block and interface with a controller associated with the process control system.

[0072] Method 500 may begin when the computer device displays (box 505) instructions in a user interface for: (i) a set of inputs for a configurable voting block, and (ii) a set of outputs for the configurable voting block corresponding to a set of instructions associated with the inputs. According to an embodiment, the input set may represent one or more combinations of inputs, including NML, TRP, BYP, BAD, and / or others, wherein the input set may be “test” inputs that allow the user of the computer device to evaluate the input set in conjunction with the output set, such as... Figure 4A-4I As shown. Furthermore, each output in the output set may correspond to multiple inputs in the input set, and the set can be selected based on controls configurable via a user interface. It should be understood that configurable voting blocks can be configured using a voting scheme (e.g., 2oo3) that can be the default or configured by the computer device or its user.

[0073] The computer device may receive (box 510) a first control selection via a user interface, indicating whether to apply a voting scheme degradation for a first instance of a first type of input in one of the input sets to the configurable voting block. Furthermore, the computer device may receive (box 515) a second control selection via the user interface, indicating whether to apply a voting scheme degradation for a second instance of a first type of input in another input in the input set. Additionally, the computer device may receive (box 520) a third control selection via the user interface, indicating whether to apply a voting scheme degradation for a first instance of a second type of input in one of the input sets to the configurable voting block. Furthermore, the computer device may receive (box 525) a fourth control selection via the user interface, indicating whether to apply a voting scheme degradation for a second instance of a second type of input in another input in the input set.

[0074] According to an embodiment, the first type of input may be a BYP input (in which case the first and second control selections correspond to bypass degradation selections indicating whether to use a voting scheme degradation for a configurable voting block), and the second type of input may be a BAD input (in which case the first and second control selections correspond to state degradation selections indicating whether to use a voting scheme degradation for a configurable voting block), or the first type of input may be a BAD input and the second type of input may be a BYP input.

[0075] In one implementation, the computer device may receive (box 530) a skip enable selection via a user interface, which indicates whether the output of the voting block is automatically skipped when the required number of votes for a voting scheme exceeds the number of non-bypassed or bad votes for the voting scheme (i.e., A>B for the AooB voting scheme).

[0076] The computer device can configure (box 535) a configurable voting block based on a first control selection, a second control selection, a third control selection, a fourth control selection, and a skip enable selection. Furthermore, the computer device can receive (box 540) an input set from a set of devices associated with the process plant. Specifically, the computer device can initially receive a first instance of a first type input (or a second type input) from a first device in the input set, and subsequently receive a second instance of a first type input (or a second type input) from a second device in the input set.

[0077] The computer device can process (box 545) the input set according to the configurable voting block configured in box 535, resulting in output(s) of the configurable voting block. In an embodiment, after processing the input set, the computer device can display an updated set of outputs based on the configured configurable voting block in a user interface.

[0078] Embodiments of the technology described in this disclosure may include any number of the following aspects, individually or in combination:

[0079] 1. A computer-implemented method for configuring a configurable voting block for a process control system in a process plant, the configurable voting block having a voting scheme associated with a set of inputs, the method comprising: receiving a first control selection via a user interface, the first control selection indicating whether a voting scheme degradation for the configurable voting block applies to a first instance of a first type of input for one input in the set; receiving a second control selection via a user interface, the second control selection indicating whether a voting scheme degradation for the configurable voting block applies to a second instance of a first type of input for another input in the set; configuring the configurable voting block according to the first control selection and the second control selection; receiving a set of inputs from a set of devices associated with the process plant; and processing the set of inputs according to the configured configurable voting block, wherein the processing results in an output of the configurable voting block.

[0080] 2. The computer-implemented method of claim 1, wherein the first control selection instruction degrades the voting scheme of the configurable voting block, and wherein the second control selection instruction does not degrade the voting scheme of the configurable voting block.

[0081] 3. The computer-implemented method of claim 1, wherein the first control selection instruction does not degrade the voting scheme of the configurable voting block, and wherein the second control selection instruction degrades the voting scheme of the configurable voting block.

[0082] 4. The computer-implemented method according to any one of claims 1 to 3, wherein the first type of input is a bypass (BYP) input or a bad (BAD) input.

[0083] 5. The computer-implemented method according to any one of claims 1 to 4, further comprising: receiving a third control selection via a user interface, the third control selection indicating whether a voting scheme degradation for a configurable voting block is applied to a first instance of a second type input for one input in the input set; and receiving a fourth control selection via a user interface, the fourth control selection indicating whether a voting scheme degradation for a second instance of a second type input for another input in the input set is applied to a configurable voting block.

[0084] 6. The computer-implemented method according to any one of claims 1 to 5, wherein receiving the input set comprises: receiving a first instance of a first type of input from a first device in the input set; and subsequently receiving a second instance of a first type of input from a second device in the input set.

[0085] 7. The computer-implemented method according to any one of claims 1 to 6, further comprising: receiving a detach enable selection via a user interface, the detach enable selection indicating whether the output of a configurable voting block automatically detaches when the required number of votes for a voting scheme exceeds the number of non-bypassed or bad votes for the voting scheme.

[0086] 8. The computer-implemented method according to any one of claims 1 to 7, further comprising: displaying in a user interface an instruction for: (i) an input set for a configurable voting block, and (ii) an output set of the configurable voting block corresponding to the input set; and, after processing the input set according to the configured configurable voting block, displaying in the user interface an updated set of the output set according to the configured configurable voting block.

[0087] 9. The computer-implemented method according to any one of claims 1 to 8, wherein the voting scheme is a two-out-of-three (2oo3).

[0088] 10. A computing device for configuring a configurable voting block for a process control system in a process plant, the configurable voting block having a voting scheme associated with a set of inputs, comprising: a user interface; a memory storing a set of computer-executable instructions; and a processor connected to the user interface and the memory interface and configured to execute the set of computer-executable instructions to cause the processor to perform the following operations: receiving a first control selection via the user interface, the first control selection indicating whether a voting scheme for the configurable voting block is downgraded for a first instance of a first type of input in the set of inputs; receiving a second control selection via the user interface, the second control selection indicating whether a voting scheme for the configurable voting block is downgraded for a second instance of a first type of input in the set of inputs; configuring the configurable voting block according to the first control selection and the second control selection; receiving a set of inputs from a set of devices associated with the process plant; and processing the set of inputs according to the configured configurable voting block, wherein the processing results in an output of the configurable voting block.

[0089] 11. The computing device of claim 10, wherein the first control selection instruction degrades the voting scheme of the configurable voting block, and wherein the second control selection instruction does not degrade the voting scheme of the configurable voting block.

[0090] 12. The computing device of claim 10, wherein the first control selection instruction does not degrade the voting scheme of the configurable voting block, and wherein the second control selection instruction degrades the voting scheme of the configurable voting block.

[0091] 13. The computing device according to any one of claims 10 to 13, wherein the first type of input is a bypass (BYP) input or a bad (BAD) input.

[0092] 14. The computing device according to any one of claims 10 to 13, wherein the processor is further configured to: receive a third control selection via a user interface, the third control selection indicating whether a voting scheme degradation for a configurable voting block is used for a first instance of a second type input to one of the input sets; and receive a fourth control selection via a user interface, the fourth control selection indicating whether a voting scheme degradation for a second instance of a second type input to another input to the input set is used for a configurable voting block.

[0093] 15. The computing device according to any one of claims 10 to 14, wherein, in order to receive an input set, the processor is configured to: receive a first instance of a first type of input from a first device in the input set; and subsequently receive a second instance of a first type of input from a second device in the input set.

[0094] 16. The computing device according to any one of claims 10 to 15, wherein the processor is further configured to: receive a detach enable selection via a user interface, the detach enable selection indicating whether the output of the voting block is automatically detached when the required number of votes for a voting scheme exceeds the number of non-bypassed or bad votes for the voting scheme.

[0095] 17. The computing device according to any one of claims 10 to 16, wherein the processor is further configured to: cause a user interface to display instructions for: (i) an input set for a configurable voting block, and (ii) an output set of the configurable voting block corresponding to the input set; and after processing the input set according to the configured configurable voting block, cause the user interface to display an updated set of the output set according to the configured configurable voting block.

[0096] 18. The computing device according to any one of claims 10 to 17, wherein the voting scheme is a two-out-of-three (2oo3).

[0097] 19. A controller module for use in a process plant having a processor communicatively coupled to control one or more field devices, comprising: a non-transitory computer-readable medium; and a function block stored on the non-transitory computer-readable medium and executed on the processor, the function block comprising: an input set, each input configured to receive an input signal indicating a process condition from within the process plant; a first control block including a first control parameter indicating whether a first instance of a first type of input for one of the inputs in the input set is used for voting scheme degradation of the function block; a second control block including a second control parameter indicating whether a second instance of a first type of input for another input in the input set is used for voting scheme degradation of the function block; an output providing an output signal; and a voter logic block coupled between the first control block, the second control block, and the output, the voter logic block being configured to generate the output signal based on the input signal set, the first control parameter, and the second control parameter.

[0098] 20. The controller module of claim 19, wherein the first control parameter indicates a voting scheme degradation applied to the function block, and wherein the second control parameter indicates a voting scheme degradation not applied to the function block.

[0099] 21. The controller module of claim 19, wherein the first control parameter indicates a voting scheme downgrade not used for the function block, and wherein the second control parameter indicates a voting scheme downgrade used for the function block.

[0100] 22. The controller module according to any one of claims 19 to 21, wherein the first type of input is a bypass (BYP) input or a bad (BAD) input.

[0101] 23. The controller module according to any one of claims 19 to 22, wherein the function block further comprises: a third control block including a third control parameter indicating whether a voting scheme degradation of the function block is applied to a first instance of a second type input for one input in the input set; and a fourth control block including a fourth control parameter indicating whether a voting scheme degradation of the function block is applied to a second instance of a second type input for another input in the input set.

[0102] 24. The controller module according to any one of claims 19 to 23, wherein the functional block further comprises: a fifth control block, including a trip enable parameter, the trip enable parameter indicating whether the output signal of the functional block automatically trips when the required number of votes for the voting scheme exceeds the number of non-bypassed or bad votes for the voting scheme.

[0103] 25. The controller module according to any one of claims 19 to 24, wherein the voting scheme is a two-out-of-three (2oo3).

[0104] Furthermore, the foregoing aspects of this disclosure are merely exemplary and are not intended to limit the scope of this disclosure.

[0105] The following additional considerations apply to the foregoing discussion. Throughout this specification, an operation described as being performed by any device or routine generally refers to an operation or process by which a processor manipulates or transforms data according to machine-readable instructions. Machine-readable instructions may be stored in and retrieved from a memory device communicatively coupled to the processor. That is, the methods described herein may be embodied by a set of machine-executable instructions stored on a computer-readable medium (i.e., a storage device). When executed by one or more processors of a corresponding device (e.g., an operator workstation, debugging tool, etc.), the instructions cause the processor to perform the method. Where instructions, routines, modules, procedures, services, programs, and / or applications are referred to herein as being stored or preserved in computer-readable memory or a computer-readable medium, the terms “stored” and “preserved” are intended to exclude transient signals.

[0106] Furthermore, while the terms “operator,” “person,” “human,” “user,” “technician,” “administrator,” and other similar terms are used to describe persons in a process plant environment who may use or interact with the systems, apparatus, and methods described herein, these terms are not intended to be restrictive. Where a particular term is used in the specification, that term is used in part due to the conventional activities performed by plant personnel, but is not intended to limit the personnel capable of performing that particular activity.

[0107] Furthermore, throughout this specification, multiple instances can implement components, operations, or structures described as a single instance. Although the individual operations of one or more methods are illustrated and described as separate operations, one or more of the individual operations can be performed simultaneously, and the operations are not required to be performed in the order illustrated. Structures and functions presented as multiple separate components in the example configuration can be implemented as combined structures or components. Similarly, structures and functions presented as a single component can be implemented as multiple separate components. These and other variations, modifications, additions, and improvements fall within the scope of this document's subject matter.

[0108] Unless otherwise specified, the use of terms such as “processing,” “computing,” “operation,” “determining,” “identifying,” “presenting,” “causing to present,” “causing to display,” and “displaying” in this document may refer to the operation or process of a machine (e.g., a computer), the manipulation or transformation of data represented as physical (e.g., electronic, magnetic, biological, or optical) quantities within one or more memories (e.g., volatile memory, non-volatile memory, or combinations thereof), registers, or other machine components that receive, store, transmit, or display information.

[0109] When implemented in software, any of the applications, services, and engines described herein can be stored in any physical, non-transitory computer-readable storage medium, such as on a hard disk, laser disk, solid-state storage device, molecular memory storage device, or other storage medium, or in the RAM or ROM of a computer or processor. Although the example systems disclosed herein are disclosed to include software and / or firmware, as well as other components, which execute on hardware, it should be noted that such systems are illustrative only and should not be considered limiting. For example, it is conceivable that any or all of these hardware, software, and firmware components may be implemented exclusively in hardware, exclusively in software, or in any combination of hardware and software. Therefore, those skilled in the art will readily understand that the examples provided are not the only way to implement such systems.

[0110] Therefore, although the invention has been described with reference to specific examples, these examples are intended to be illustrative only and not to limit the invention, and it will be apparent to those skilled in the art that changes, additions or deletions may be made to the disclosed embodiments without departing from the spirit and scope of the invention.

[0111] It should also be understood that unless a term is explicitly defined in this patent using the phrase “As used herein, the term ’____’ is thus defined as meaning…” or a similar statement, there is no intention to explicitly or implicitly limit the meaning of the term beyond its ordinary or general meaning, and the term should not be construed as being limited to the scope of any statement made in any part of this patent (other than the language of the claims). With regard to any term referenced in the appended claims in this patent in a manner consistent with its singular meaning, this is done only for clarity so as not to obscure the reader, and is not intended to implicitly or otherwise limit such claim terms to that singular meaning. Finally, unless a claim element is defined by stating the word “module” and function without stating any structure, there is no intention to interpret the scope of any claim element based on the application of 35 USC §112(f) and / or pre-AIA 35 USC §112 paragraph 6.

[0112] Furthermore, although the foregoing text describes specific implementations of many different embodiments, it should be understood that the scope of this patent is defined by the wording of the appended claims. These specific implementations should be interpreted as exemplary only, and not every possible embodiment is described, as describing every possible embodiment would be impractical, if not impossible. Numerous alternative embodiments can be implemented using current technology or technology developed after the filing date of this patent, and these alternative embodiments will still fall within the scope of the claims.

Claims

1. A computer-implemented method for configuring a configurable voting block for a process control system in a process plant, the configurable voting block having a voting scheme associated with a set of inputs generated by a set of field devices to control the operation of at least one device within the process plant, the method comprising: A first control selection is received via a user interface, the first control selection indicating whether a first instance of a first type of input for one of the input sets is used for the voting scheme degradation of the configurable voting block; A second control selection is received via the user interface, the second control selection indicating whether a second instance of the first type of input for another input in the input set is used for the voting scheme degradation of the configurable voting block; The user interface receives a skip disable enable selection, which indicates whether the at least one device is prohibited from automatic skipping when the number of required votes for the voting scheme exceeds the number of non-bypassed or bad votes for the voting scheme. The configurable voting block is configured according to the first control selection, the second control selection, and the skip disable enable selection; Receive the input set from the set of field devices; Determine from the input set and according to the configured configurable voting block whether the required number of votes for the voting scheme exceeds the number of non-bypassed or bad votes of the voting scheme; as well as Based on the determination, the at least one device is either automatically disconnected or prevented from automatically disconnecting.

2. The computer-implemented method according to claim 1, wherein, The first control selection indication is used for the voting scheme degradation of the configurable voting block, and wherein the second control selection indication is not used for the voting scheme degradation of the configurable voting block.

3. The computer-implemented method according to claim 1, wherein, The first control selection indication is not used for the voting scheme degradation of the configurable voting block, and the second control selection indication is used for the voting scheme degradation of the configurable voting block.

4. The computer-implemented method according to claim 1, wherein, The first type of input is either a Bypass (BYP) input or a Bad (BAD) input.

5. The computer-implemented method according to claim 1, further comprising: A third control selection is received via the user interface, the third control selection indicating whether the voting scheme degradation is applied to the configurable voting block for a first instance of a second type of input for one of the inputs in the input set; as well as A fourth control selection is received via the user interface, the fourth control selection indicating whether to use the voting scheme degradation of the configurable voting block for a second instance of the second type of input for the other input in the input set.

6. The computer-implemented method according to claim 1, wherein, Receiving the input set includes: The first instance of the first type of input of the input set is received from the first field device in the set of field devices; and Then, the second instance of the first type of input of the other input in the input set is received from the second field device in the set of field devices.

7. The computer-implemented method according to claim 1, further comprising: The user interface displays instructions for: (i) the set of inputs for the configurable voting block, and (ii) the set of outputs of the configurable voting block corresponding to the set of inputs; as well as After the input set is processed according to the configured configurable voting block, the updated set of the output set according to the configured configurable voting block is displayed in the user interface.

8. The computer-implemented method according to claim 1, wherein, The voting scheme is a choice of two out of three (2003).

9. A computing device for configuring a configurable voting block for a process control system in a process plant, the configurable voting block having a voting scheme associated with a set of inputs generated by a set of field devices to control the operation of at least one device within the process plant, the computing device comprising: User interface; Memory stores the set of instructions that a computer can execute; as well as A processor, connected to the user interface and the memory interface, and configured to execute the computer-executable instruction set to cause the processor to perform the following operations: A first control selection is received via the user interface, the first control selection indicating whether the voting scheme degradation of the configurable voting block is applied to a first instance of a first type of input for an input in the input set. A second control selection is received via the user interface, the second control selection indicating whether a second instance of the first type of input for another input in the input set is used for the voting scheme degradation of the configurable voting block; The user interface receives a skip disable enable selection, which indicates whether the at least one device is prohibited from automatic skipping when the number of required votes for the voting scheme exceeds the number of non-bypassed or bad votes for the voting scheme. The configurable voting block is configured according to the first control selection, the second control selection, and the skip disable enable selection; Receive the input set from the set of field devices; Determine from the input set and according to the configured configurable voting block whether the required number of votes for the voting scheme exceeds the number of non-bypassed or bad votes of the voting scheme; as well as Based on the determination, the at least one device is either automatically disconnected or prevented from automatically disconnecting.

10. The computing device according to claim 9, wherein, The first control selection indication is used for the voting scheme degradation of the configurable voting block, and wherein the second control selection indication is not used for the voting scheme degradation of the configurable voting block.

11. The computing device according to claim 9, wherein, The first control selection indication is not used for the voting scheme degradation of the configurable voting block, and the second control selection indication is used for the voting scheme degradation of the configurable voting block.

12. The computing device according to claim 9, wherein, The first type of input is either a Bypass (BYP) input or a Bad (BAD) input.

13. The computing device according to claim 9, wherein, The processor is also configured to: A third control selection is received via the user interface, the third control selection indicating whether the voting scheme degradation is applied to the configurable voting block for a first instance of a second type of input for one of the inputs in the input set; as well as A fourth control selection is received via the user interface, the fourth control selection indicating whether to use the voting scheme degradation of the configurable voting block for a second instance of the second type of input for the other input in the input set.

14. The computing device according to claim 9, wherein, In order to receive the input set, the processor is configured to: The first instance of the first type of input from the input set is received from the first field device in the set of field devices; as well as Then, the second instance of the first type of input of the other input in the input set is received from the second field device in the set of field devices.

15. The computing device according to claim 9, wherein, The processor is also configured to: The user interface displays instructions for: (i) the set of inputs for the configurable voting block, and (ii) the set of outputs of the configurable voting block corresponding to the set of inputs; as well as After processing the input set according to the configured configurable voting block, the user interface displays an updated set of the output set according to the configured configurable voting block.

16. The computing device according to claim 9, wherein, The voting scheme is a choice of two out of three (2003).

17. A controller module for use in a process plant, the process plant having a processor communicatively coupled to control at least one device within the process plant based on an input set generated from a set of field devices, the controller module comprising: Non-transitory computer-readable medium; as well as Function blocks, stored on the non-transitory computer-readable medium and executed on the processor, the function blocks comprising: An input set, each input being configured to receive an input signal from the set of field devices, the input signal indicating a process status. The first control block includes a first control parameter, which indicates whether a voting scheme degradation is applied to the function block for a first instance of a first type of input from the input set. The second control block includes a second control parameter indicating whether the voting scheme degradation of the function block is applied to a second instance of the first type of input for another input in the input set. The third control block includes a trip disable enable parameter, which indicates whether the at least one device is prohibited from automatically tripping when the number of required votes for the voting scheme exceeds the number of non-bypass or bad votes for the voting scheme. Output, providing output signals, and A voting logic block, coupled between the first control block, the second control block, the third control block, and the output, is configured as follows: From the set of input signals and based on the first control parameter, the second control parameter, and the skip disable enable parameter, determine whether the required number of votes for the voting scheme exceeds the number of non-bypass or bad votes in the voting scheme; and Based on the determination, the output signal is generated; The processor is configured to cause the at least one device to automatically disconnect or be prevented from automatically disconnecting based on the output signal.

18. The controller module according to claim 17, wherein, The first control parameter indicates that the voting scheme used for the function block is downgraded, and the second control parameter indicates that the voting scheme not used for the function block is downgraded.

19. The controller module according to claim 17, wherein, The first control parameter indicates that the voting scheme degradation is not used in the function block, and wherein the second control parameter indicates that the voting scheme degradation is used in the function block.

20. The controller module according to claim 17, wherein, The first type of input is either a Bypass (BYP) input or a Bad (BAD) input.

21. The controller module according to claim 17, wherein, The functional block also includes: The fourth control block includes a third control parameter indicating whether, for a first instance of a second type of input in the input set, the voting scheme degradation of the function block is applied; and The fifth control block includes a fourth control parameter indicating whether the voting scheme of the function block is downgraded for a second instance of the second type of input for the other input in the input set.

22. The controller module according to claim 17, wherein, The voting scheme is a choice of two out of three (2003).

Images