I / O mesh architecture for safety instrumented systems

Abstract

The present invention discloses a safety instrumented system (SIS), which includes a safety controller and a safety input / output (I / O) module coupled to a safety field device, which is coupled in parallel with the field device of the process control system to the processing equipment configured and controlled to run the process. The I / O grid network between the safety controller and the safety I / O module is configured to select any safety controller to be coupled to any safety I / O module so as to be used as a safety I / O module pool, so that any safety controller can be configured to receive sensor signals from any safety field device and transmit control signals to any safety field device. The safety field device is used to monitor the process variables of the process, so that when one of the safety controllers identifies a dangerous condition about the processing equipment, the SIS takes action alone to keep the processing equipment under control or in a safe state.

Description

Technical Field

[0001] The present disclosure relates to an industrial automation system including a process control system, and in particular, to a safety instrumented system (SIS) as an additional component of the industrial automation system. Background Art

[0002] Processing facilities or industrial plants are often managed using industrial automation systems. Exemplary processing facilities include manufacturing plants, chemical plants, crude oil exploration, production and refining facilities, ore processing plants and power stations.

[0003] Various process industries have seen a continuous development of industrial automation technology. Specifically, there is a need to move to a more capital efficient system and provide a design that is compatible with modular unit construction technology. However, it is often challenging to provide the necessary level of industrial automation while maintaining capital efficiency and providing modular construction.

[0004] A safety instrumented system (SIS) known in the field of industrial automation systems is a system configured to take automatic actions to maintain or cause processing equipment controlled by a process control system to be in a safe operating state when an abnormal condition is detected. SIS can implement a single safety function or multiple safety functions to prevent various hazards that may occur to processing equipment in the plant. SIS is also called a safety shutdown system, emergency shutdown system, safety interlock, protective instrumented system, fire and gas detection system, or safety critical system.

[0005] SIS is typically independent of the process control system, with its own actuators and sensors that monitor a subset of the process variables also monitored by the process control system. The SIS can independently take action to keep the process equipment under control or in a safe state when it detects a hazardous or potentially hazardous condition, thereby acting as a separate safety system.

[0006] Generally speaking, a SIS uses different hardware techniques than a process control system to reduce the effects of common cause failures associated with a process control system. At a minimum, a SIS includes devices and equipment for operating at Level 1 of the Purdue model, thereby providing a lowest level controller (Level 1 controller), and includes its own field devices (sensors and actuators; together with the process equipment are considered Purdue Level 0) directly coupled to the SIS Level 1 controller. A SIS also typically includes controllers in Level 3 of the Purdue model. The SIS is connected to the process equipment in parallel with the field devices of the process control system, which enables it to control the process equipment individually when a hazardous condition or potentially hazardous condition is determined to exist. Summary of the invention

[0007] This Summary is provided to introduce a brief selection of disclosed concepts in a simplified form, which are further described below in the Detailed Description including the provided figures. This Summary is not intended to limit the scope of the claimed subject matter.

[0008] The disclosed aspects recognize that conventional SIS solutions have a fixed relationship between safety I / O modules and safety controllers. In the case where a safety controller wants to use a point from a safety I / O module connected to another safety controller, this requires a dedicated communication structure and manual configuration (e.g., configuration of the required information exchange). As used herein, a point (or control point) known in the field of industrial automation is a term used to describe a control operation, whether the control operation is a sensing action or a control action, where a point can be anything from a temperature sensor or a pressure sensor to the output of a proportional controller that controls the operation of a control valve. Output points are usually always dedicated to the safety controller to which the output is connected. This conventional SIS arrangement requires a lot of advanced architecture and design work to make it as efficient as possible at an acceptable cost. Conventional SIS arrangements also reduce availability because using the I / O points of another controller also requires the other controller to operate correctly.

[0009] The disclosed aspects include a SIS that includes an I / O mesh network that allows any of the safety controllers to utilize any of the I / O points from a plurality of safety I / O modules such that the safety I / O modules collectively function as a pool of safety I / O modules (or Honeywell International Highly Integrated Virtual Environment (HIVE)). In some disclosed embodiments, any of the I / O points provided by any of the plurality of safety I / O modules may be utilized by any of the safety controllers. The I / O mesh network allows the I / O points of the safety I / O modules to also be available to any of the controllers in a process control system and also allows the SIS I / O points to be used in the process control system as if they were process control system I / O points on its own I / O mesh network.

[0010] One disclosed aspect includes a SIS including a safety controller and a safety I / O module coupled to a safety field device, the safety field device being coupled to process equipment in a process control system running a process. An I / O grid network is located between the safety controller and the safety I / O module. The I / O grid network is configured to select any safety controller to become coupled to any safety I / O module to serve as a safety I / O module pool, so that any safety controller can be configured to receive sensor signals from any safety field device and transmit control signals to any safety field device. The safety field device is used to monitor at least one process variable of the process, so that when one of the safety controllers identifies a hazardous condition regarding the process equipment, the SIS individually takes action to keep the process equipment under control or in a safe state. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1A An exemplary SIS including an I / O mesh architecture for a safety control system is shown.

[0012] Figure 1B A process automation system including a process control system and an exemplary SIS is shown. The SIS includes Figure 1A The I / O mesh architecture shown is connected in parallel to the process equipment relative to the field devices of the process control system. The SIS can move the process equipment to a safe state after an emergency or other abnormal condition is detected in the process equipment.

[0013] Figure 1C Another process automation system including a process control system and an exemplary SIS is shown. Figure 1A An I / O mesh architecture is shown that is connected to process equipment in parallel with respect to field devices of a process control system, wherein the process control system includes an optional I / O mesh network, shown as a second I / O mesh network, and a pool of I / O modules.

[0014] Figure 2A A known SIS arrangement is shown with multiple safety controllers, each with its own set of dedicated safety I / O modules.

[0015] Figure 2B The disclosed SIS arrangement is shown having multiple safety controllers enabled by the disclosed I / O mesh network to share a pool of safety I / O modules.

[0016] Figure 3 is a flow chart of a method of operating a SIS having the disclosed I / O grid network enabling multiple safety controllers to share a pool of safety I / O modules. DETAILED DESCRIPTION

[0017] The disclosed embodiments are described with reference to the accompanying drawings, wherein the same reference numerals are used throughout the drawings to represent similar or equivalent elements. The drawings are not drawn to scale, and they are provided only to illustrate certain disclosed aspects. Several disclosed aspects are described below with reference to exemplary applications for illustration. It should be understood that many specific details, relationships, and methods are set forth to provide a complete understanding of the disclosed embodiments.

[0018] The SIS of an industrial automation system is an important feature of today's industrial process plants. It is recognized herein that there is a need for a SIS for an industrial automation system to provide a separate safety control system connected in parallel to the process equipment relative to the field devices of the process control system.

[0019] Figure 1A An exemplary SIS 100 according to the present disclosure is shown that includes an I / O mesh architecture, shown as an I / O mesh network 154, for implementing at least one safety function to prevent various hazards that may occur in process equipment in a process control system. Figure 1B A process automation system 150 is shown including a process control system 140 and a SIS 100 having Figure 1A An I / O grid network 154 is shown connected to the process equipment 107 in parallel with field devices of the process control system 140 for implementing at least one safety function of the process equipment 107. The SIS 100 is configured to move a running process to a safe state after an emergency or other abnormal condition is detected in the process equipment 107, which emergency or other abnormal condition is not handled by the process control system 140.

[0020] like Figure 1A and Figure 1B As shown, SIS 100 includes various components that provide a single safety network for maintaining operational safety of processing equipment 107, wherein processing equipment 107 is configured to process at least one generally tangible product or other material. For example, SIS 100 is used to facilitate the monitoring of a plant (in Figure 1B 100). In the case of multiple plants, each plant building typically has its own dedicated SIS 100.

[0021] exist Figure 1A , a SIS 100 implemented using the Purdue model of process control is shown, including Level 3, Level 2, and Level 1, and Level 0 including field devices (sensors 152a and actuators 152b) and process equipment 107. Figure 1B, a process automation system 150 is shown including a process control system 140 implemented in a Purdue model including levels 1 to 5, wherein a SIS 100 is connected in parallel to process equipment 107 with respect to field devices of the process control system (shown as sensors 102a and actuators 102b).

[0022] "Level 0" generally includes field devices, which include one or more sensors and one or more actuators (shown as sensors 102a and actuators 102b for a process control system, and as sensors 152a and actuators 152b for a SIS). The sensors 102a, 152a and actuators 102b, 152b represent components of the process automation system 150 that can perform any of a variety of functions. For example, the sensors 102a, 152a can measure a variety of characteristics in the process equipment 107, such as temperature, pressure, or flow. Additionally, the actuators 102b, 152b can change a variety of characteristics in the process equipment 107.

[0023] The sensors 102a, 152a and the actuators 102b, 152b may represent any other or additional components in any suitable process automation system. Each of the sensors 102a, 152a includes any suitable structure for measuring one or more characteristics in the process equipment 107. Each of the actuators 102b, 152b includes any suitable structure for operating or affecting one or more conditions in the process equipment 107. The sensors 102a, 152a and the actuators 102b, 152b may generally be collectively referred to as "field devices".

[0024] SIS 100 includes an I / O mesh network 154 that enables any of a plurality of I / O modules in an I / O module pool 155 to be coupled to sensors 152a and actuators 152b. Thus, the I / O mesh network 154 facilitates interaction of any of the safety controllers 156 with the sensors 152a and actuators 152b. For example, the I / O mesh network 154 may transmit measurement data from the sensor 152a to any of the safety controllers 156, which in response may provide a control signal to any of the actuators 152b. The sensors 152a and actuators 152b (as well as the sensors 102a and actuators 102b in the process control system 140) are each coupled to the processing equipment 107.

[0025] The safety controller 156 is configured to trigger safety actions to prevent various hazards that may occur in the process control system 140, typically due to the processing equipment 107. The safety controller 156 typically includes a microprocessor that is specifically designed to comply with internal safety standards, such as IEC61508, which is an international standard for "functional safety" of electrical, electronic, and programmable electronic equipment. For example, the safety controller 156 may include Honeywell International Safety Manager SC.

[0026] The I / O mesh network 154 may represent any suitable network or combination of networks. As specific examples, the I / O mesh network 154 may represent an Ethernet network, an electrical signal network (such as a HART or Foundation Fieldbus network), a pneumatic control signal network, or any other or additional type of communication network.

[0027] Among other things, each of the safety controllers 156 can use measurements from one or more sensors 152a to control the operation of one or more actuators 152b. For example, the safety controller can receive measurement data from one or more sensors 152a and use the measurement data to generate control signals for one or more actuators 152b.

[0028] The safety controllers 156 can operate in either a non-redundant or redundant mode of operation. For the redundant mode of operation, two different approaches can be applied: 1) hot standby (via the primary and secondary controllers), where the secondary controller periodically synchronizes with the primary controller, and this involves a switching mechanism, and 2) parallel operation, where both controllers run the same software and are continuously synchronized and therefore do not require switching time, and therefore provide a constant reaction time even in the event of a failure of one of the safety controllers 156. Each of the safety controllers 156 includes any suitable structure for interacting with one or more sensors 152a and controlling one or more actuators 152b.

[0029] For SIS 100, in addition to the I / O grid network 154, a network 109 between the security controller 156 and the switch / firewall 151 and another network 112a between the switch / firewall 151 and the level 3 devices including the unit controller 157 and the operator station 158 are shown.

[0030] The networks 109, 112a for the SIS 100 and the Figure 1BThe networks 108, 112, 120, and 128 of the process control system 140 shown are merely examples shown with redundant network paths to represent Fault Tolerant Ethernet (FTE) from Honeywell International Inc. FTE is optional as a single network may also be used for any of these networks. Thus, to send information, network 112a couples the unit controller 157 shown in level 3 to the safety controller 156 shown in level 1 via a switch / firewall 151 positioned between levels 1 and 2. Network 108 associated with the process control system 140 couples the machine controller 114 to the controller 106 via a switch / firewall 110, and network 112 couples the machine controller 114 to the switch / firewall 110, network 120 couples the unit controller 122 to the machine controller 114, and network 128 couples the plant controller 130 to the unit controller 122. Networks 112a, 108, 112, 120, 128 may represent any suitable network or combination of networks.

[0031] In some embodiments, the network 109 or network 112a in the SIS 100 and the network 108 or network 112 in the process control system 140 may be the same network. In this arrangement, the controller 106 of the process control system 140 or its machine controller 114 and the safety controller 156 of the SIS 100 may therefore engage in peer-to-peer communications.

[0032] For the process control system 140, at least one switch / firewall 110 couples the network 108 to other networks 112, which are each shown as FTEs. The switch / firewall 110 (such as the switch / firewall 151) can transfer traffic from one network to another network. The switch / firewall 110 can also prevent traffic on one network from reaching another network. The switch / firewall 110 (such as the switch / firewall 151) includes any suitable structure for providing communication between networks, such as a HONEYWELL CONTROL FIREWALL (CF9) device.

[0033] In the Purdue model, as shown for the process control system 140, "Level 2" may include one or more machine-level controllers 114 coupled to the network 112. The machine-level controllers 114 perform various functions to support the operation and control of the controllers 106, sensors 102a, and actuators 102b that may be associated with a particular process equipment 107 (such as a boiler or other machine). For example, the machine-level controllers 114 may record information collected or generated by the controllers 106, such as measurement data from the sensors 102a or control signals for the actuators 102b.

[0034] For level 2, Figure 1B (and the above Figure 1A ) includes a switch / firewall 151 that may alternatively be positioned between levels 1 and 2. For the process control system 140, at level 2, one or more operator stations 116 are coupled to the network 112. The operator station 116 represents a computing device or communication device that provides user access to the machine controller 114, which in turn may provide user access to the controller 106 (and to the sensors 102a and actuators 102b via the network 104 through the I / O modules 105). As a specific example, the operator station 116 may allow a user to view the operation history of the sensors 102a and actuators 102b using information collected by the controller 106 and / or the machine controller 114.

[0035] The operator station 116 may also allow a user to adjust the operation of the sensor 102a, the actuator 102b, the safety controller 106, or the machine-level controller 114. In addition, the operator station 116 may receive and display warnings, alerts, or other messages or displays generated by the safety controller 106 or the machine-level controller 114. Each of the operator stations 116 includes any suitable structure for supporting user access and control of one or more components in the system 100. Each of the operator stations 116 may represent, for example, a computing device running a MICROSOFT WINDOWS operating system.

[0036] At least one router / firewall 118 couples network 112 to network 120. Router / firewall 118 includes any suitable structure for providing communication between networks, such as a security router or a combination router / firewall. Network 120 may represent any suitable network, such as a pair of Ethernet networks or an FTE network.

[0037] SIS 100 and process control system 140 both include Purdue Model "Level 3". Process control system 140 may include one or more unit-level controllers 122 coupled to network 120, while SIS 100 includes a unit-level controller 157 coupled to network 112a. SIS 100 also includes an operator station 158 coupled to network 112a. Each unit-level controller 122, 157 is typically associated with a processing unit, where a processing unit represents a collection of different machines that operate together to implement at least a portion of a process.

[0038] The unit-level controllers 122, 157 perform various functions to support the operation and control of components in the lower levels. For example, the unit-level controllers 122, 157 may record information collected or generated by components in the lower levels, execute applications that control components in the lower levels, and provide secure access to components in the lower levels. Each of the unit-level controllers 122, 157 includes any suitable structure for providing access to, control of, or operations related to one or more machines or other equipment in the processing unit. Each of the unit-level controllers 122, 157 may, for example, represent a server computing device running a MICROSOFT WINDOWS operating system. Although not shown, different unit-level controllers 122, 157 may be used to control different units in the process system, each of which is associated with one or more machine controllers 114, safety controllers 106, sensors 102a, and actuators 102b of the process control system 140, and with respect to the SIS 100, is associated with the safety controller 156, the sensor 152a, and the actuator 152b (for the SIS 100).

[0039] With respect to the process control system 140, access to the unit-level controllers 122 may be provided by one or more operator stations 124. Similarly, with respect to the SIS 100, access to the unit-level controllers 157 may be provided by one or more operator stations 158. Each of the operator stations 124, 158 includes any suitable structure for supporting user access and control of one or more components in the process control system 140 and the SIS 100, respectively. Each of the operator stations 124, 158 may represent, for example, a computing device running a MICROSOFT WINDOWS operating system.

[0040] In the process control system 140, at least one router / firewall 126 couples the network 120 to a network 128. The router / firewall 126 includes any suitable structure for providing communication between networks, such as a secure router or a combined router / firewall. The network 128 may represent any suitable network, such as a pair of Ethernet networks or an FTE network.

[0041] Also shown is a process control system 140 that includes a Purdue model, "Level 4" including one or more plant-level controllers 130 coupled to a network 128. Each plant-level controller 130 is typically associated with a plant 101, which may include one or more processing units that implement the same, similar, or different processes. The plant-level controller 130 performs various functions to support the operation and control of components in lower levels. As a specific example, the plant-level controller 130 may execute one or more manufacturing execution system (MES) applications, scheduling applications, or other or additional plant or process control applications. Each of the plant-level controllers 130 includes any suitable structure for providing access to, control of, or operations related to one or more processing units in a processing plant. Each of the plant-level controllers 130 may, for example, represent a server computing device running a MICROSOFT WINDOWS operating system.

[0042] Access to the plant-level controller 130 may be provided by one or more operator stations 132. Each of the operator stations 132 includes any suitable structure for supporting user access and control of one or more components in the SIS 100. Each of the operator stations 132 may represent, for example, a computing device running a MICROSOFT WINDOWS operating system.

[0043] At least one router / firewall 134 couples network 128 to one or more networks 136. Router / firewall 134 includes any suitable structure for providing communication between networks, such as a security router or a combination router / firewall. Network 136 may represent any suitable network, such as a full enterprise Ethernet or other network, or all or a portion of a larger network such as the Internet.

[0044] Also shown is a process control system 140 that includes components in the Purdue model, "Level 5" including one or more enterprise-level controllers 138 coupled to the network 136. Each enterprise-level controller 138 is generally capable of executing planning operations for the plant 101 to control various aspects of the plant 101. As specific examples, the enterprise-level controllers 138 may execute one or more order processing applications, enterprise resource planning (ERP) applications, advanced planning and scheduling (APS) applications, or any other or additional enterprise control applications. Each of the enterprise-level controllers 138 includes any suitable structure for providing access to, control of, or control-related operations on the plant.

[0045] Access to the enterprise-level controller 138 may be provided by one or more operator stations 139. Each of the operator stations 139 includes any suitable structure for supporting user access and control of one or more components in the SIS 100. Each of the operator stations 139 may represent, for example, a computing device running a MICROSOFT WINDOWS operating system.

[0046] Each level of the Purdue model may include other components, such as one or more databases. The database associated with each level may store any suitable information associated with that level or one or more other levels of the process automation system 150. For example, a data historian database 141 may be coupled to the network 136. The data historian database 141 may represent a component that stores various information about the process control system 140 and, optionally, also about the SIS 100. The data historian database 141 may, for example, store information used during production scheduling and optimization and abnormal conditions regarding the process equipment 107. The data historian database 141 represents any suitable structure for storing information and facilitating retrieval of the information.

[0047] Figure 1C Another process automation system 180 is shown, which includes a process control system shown as 140', which includes an optional second I / O grid network 104' and an I / O module pool 105', and as described above includes Figure 1A SIS 100 of an I / O grid network 154 is shown. SIS 100 is connected in parallel to field devices 102a, 102b coupled to process equipment 107 of a process control system 140'.

[0048] Figure 2A A known SIS arrangement 200 is shown having multiple safety controllers (shown as 166), each having its own set of dedicated safety I / O modules (shown collectively as dedicated I / O 165); wherein multiple I / O modules from the dedicated I / O 165 are provided to each safety controller 166 as dedicated I / O 165, the safety controller being configured such that there is a spare dedicated I / O module for each safety controller 166. The safety controllers 166 are shown connected together by a safety network 112b and by a network 112a (e.g., Honeywell FTE) connecting the safety controllers 166 to the aforementioned Level 3 (not shown).

[0049] The dedicated safety I / O modules 165 associated with safety controller 1, shown as C1, are collectively shown as I / O1, the dedicated safety I / O modules associated with safety controller 2, shown as C2, are collectively shown as I / O2, the dedicated safety I / O modules associated with safety controller 3, shown as C3, are collectively shown as I / O3, and the dedicated safety I / O modules associated with safety controller 4, shown as C4, are collectively shown as I / O4. In the SIS arrangement 200, the respective safety controllers C1-C4 may utilize only their dedicated own safety I / O modules, such that, for example, C2 may utilize only any safety I / O module in I / O2, but not any safety I / O module in I / O1, I / O3, or I / O4. The safety network 112b is an optional separate network for exchanging safety-critical data between the respective safety controllers 166.

[0050] Figure 2B The disclosed SIS arrangement 250 is shown having a plurality of safety controllers 156 (shown as C1, C2, and C3) enabled by the disclosed I / O mesh network 154 that replaces Figure 2A The safety network 112b in the known SIS arrangement 200 is shown. The I / O mesh network 154 makes any safety I / O module in the safety I / O module pool 155 available to any of the multiple safety controllers 156. Figure 2B Not shown, but optionally, in the above Figure 1A , Figure 1B and Figure 1C There may also be another network above the safety controller 156 shown, such as the network 109 coupled above between the safety controller 156 and the switch / firewall 151. The SIS arrangement 250 is shown to include optional I / O pool data concentrators 207, 208 separate from the safety controller 156. The I / O pool data concentrators 207, 208 reduce the amount of communication between the safety I / O module pool 155 and the safety controller 156, which improves overall system response time.

[0051] The I / O pool data concentrators 207, 208 handle all communications between the safety controller 156 and the I / O modules in the I / O pool 155 for which they are responsible. The I / O pool data concentrators 207, 208 are configured to combine all input information requested by the safety controller 156 from the safety I / O modules in its I / O pool 155 into a single communication message for the safety controller 156. Similarly, the I / O pool concentrators 207, 208 send the individual output information received from the safety controller 156 for one of the safety I / O modules in its I / O pool 155 as a single message to the safety I / O module. This is done for each safety controller 156 in the pool of safety controllers 156 and the safety I / O modules in the I / O pool 155 of the I / O pool data concentrator. The I / O mesh network 154 is configured to share any of the safety I / O modules in the safety I / O module pool 155 to any of the safety controllers 156 shown as C1 , C2 , and C3 .

[0052] Thus, the I / O mesh network 154 using the optional I / O pool data concentrators 207 and 208 enables any of the safety controllers 156 to access any of the I / O points of the safety I / O modules in the I / O pool 155. Figure 2A In the illustrated SIS arrangement 200, the SIS arrangement 250 has respective safety controllers 156, which are shown connected together via an I / O mesh network 154 and via FTEs 112a connected to level 3 and above. The I / O mesh network 154 can also be used to exchange safety critical data between respective ones of the safety controllers 156.

[0053] Conventional SIS for industrial automation systems (such as the above Figure 2A A limitation of the SIS arrangement 200 shown is that each safety controller 166 is dedicated to or bound to a specific safety I / O module and a set of channels and field devices associated with the specific safety I / O module. Therefore, the grouping of channels and associated field devices is fixed by the type of safety I / O module, the physical location of the safety I / O module, or the network location of the safety I / O module. Therefore, the safety I / O module flexibility is limited. The present disclosure eliminates this limitation.

[0054] The plurality of safety I / O modules typically each include a plurality of I / O channels, such that any of the plurality of safety controllers 156 enabled by the I / O mesh network 154 can become coupled to any of the I / O channels. In this arrangement, each safety controller 156 is configured to receive signals from and transmit signals to any of the plurality of channels within the safety I / O module pool 155, wherein the channels are connected in a mesh topology by the I / O mesh network 154. Just as each channel represents data for a process, the data is designated for a particular safety controller 156. In the case where the channels configured in a mesh topology are enabled by the I / O mesh network 154 coupled between the safety I / O module pool 155 and the safety controller 156, specific data in a particular channel can be connected to the appropriate safety controller 156, regardless of in which particular module of the safety I / O modules in the safety I / O module pool 155 the channel resides. In other words, through the mesh topology of the channels, data from field devices (see Figure 1C The data collected by the illustrated sensors 152a and actuators 152b) may be made available to any safety controller 156. Similarly, signals or instructions from the safety controller 156 may be made available to any channel through the mesh topology of channels.

[0055] Figure 3 is a flow chart of a method 300 of operating a SIS having a disclosed I / O mesh network enabling safety controllers to share a plurality of safety I / O modules in a safety I / O module pool. Step 301 includes configuring a plurality of safety I / O modules in a SIS 100 including a plurality of safety controllers 156, wherein a plurality of safety I / O modules 155 are coupled to a plurality of safety field devices 152a, 152b that are coupled to a process equipment 107 in parallel relative to field devices 102a, 102b of a process control system. The SIS includes an I / O mesh network providing a plurality of safety I / O modules as a safety I / O module pool, and a plurality of safety controllers are configured including application programming thereof.

[0056] The application programming uses signal identification for the safety field devices associated with the processing equipment 107. Step 302 includes one of the safety controllers requesting connection information for the safety field devices used in its application programming from the safety I / O module pool. This connection information is needed to optimize the communication messages and provide them with the necessary protection parameters required for safety-critical communications.

[0057] Step 303 includes transmitting an input including a status or value (and optionally other input related information, such as diagnostic information on an I / O channel) from any of a plurality of safety field devices to a safety I / O module pool, wherein any of a plurality of safety I / O modules reads the status or value. Step 304 includes providing the input to a plurality of safety controllers via an I / O mesh network, wherein the input is configured to be transmitted to any of a plurality of safety controllers requesting the input information.

[0058] Step 305 includes providing outputs from multiple safety controllers through the I / O mesh network and then through any of the multiple safety I / O modules that collectively serve as a safety I / O module pool. Step 306 includes transmitting outputs including output states or values ​​from any of the multiple safety I / O modules to any of the multiple safety field devices. As described above, when multiple safety I / O modules each provide multiple I / O channels, the I / O mesh network can enable any of the multiple safety controllers 156 to become coupled to any of the I / O channels in the safety I / O module pool 155. The selection may include using information from the safety field devices to build a safety control application on the multiple safety controllers, wherein the multiple safety controllers request connection information about any of the safety field devices from the multiple safety I / O modules, and then build a logical network connection between the multiple safety I / O modules and the multiple safety controllers.

[0059] Although various disclosed embodiments have been described above, it should be understood that they are presented by way of example only and not limitation. Many changes may be made to the subject matter disclosed herein in accordance with the present disclosure without departing from the spirit or scope of the present disclosure. In addition, although specific features may be disclosed with respect to only one of several implementations, such features may be combined with one or more other features of other implementations as may be desired or advantageous for any given or particular application.

Claims

1. A safety instrumented system SIS (100), comprising: a plurality of security controllers (156); a plurality of safety I / O modules (155) coupled to a plurality of safety field devices (152a, 152b), wherein each of the plurality of safety field devices is coupled in parallel with a corresponding one of the field devices (102a, 102b) in a process control system (140) relative to processing equipment (107) configured and controlled to operate a process, and an I / O mesh network (154) connected between the plurality of safety controllers and the plurality of safety I / O modules, wherein the I / O mesh network is configured to select any one of the plurality of safety controllers to become coupled to any one of the plurality of safety I / O modules so as to function as a safety I / O module pool, so that any one of the plurality of safety controllers can be configured to receive sensor signals from any one of the safety field devices and transmit control signals to any one of the safety field devices, The plurality of safety field devices are used to monitor at least a portion of the process variables of the process, so that when one of the plurality of safety controllers identifies a dangerous or potentially dangerous condition with respect to the process equipment, the SIS is configured to individually take action to keep the process equipment under control or in a safe state.

2. The SIS of claim 1, wherein the plurality of safety I / O modules each include a plurality of I / O channels, such that any one of the plurality of safety controllers can become coupled to any one of the I / O channels.

3. The SIS of claim 1, wherein the process control system includes a plurality of controllers (106) coupled to a plurality of I / O modules via an I / O network (104), wherein each of the plurality of I / O modules is coupled to a portion of the field device.

4. The SIS of claim 3, wherein the I / O network includes a second I / O grid network (104') coupled to the I / O grid network (154), wherein the plurality of controllers (106) are coupled via the second I / O grid network (104') to enable any of the plurality of controllers (106) to be coupled to any of the plurality of I / O modules.

5. The SIS of claim 1 , wherein the selection includes using information from the safety field devices to build a safety control application on the plurality of safety controllers, wherein the plurality of safety controllers request connection information about any one of the safety field devices from the plurality of safety I / O modules and then build a logical network connection between the plurality of safety I / O modules and the plurality of safety controllers.

6. A method (300), comprising: Configuring a plurality of safety I / O modules (155) in a safety instrumented system (SIS) (100), the SIS comprising a plurality of safety controllers (156) coupled to the plurality of safety I / O modules, the plurality of safety I / O modules coupled to a plurality of safety field devices (152a, 152b), wherein each of the plurality of safety field devices is coupled in parallel with a corresponding field device of a field device (102a, 102b) of a process equipment (107) coupled to a process control system (140), the SIS comprising an I / O mesh network (154) providing the plurality of safety I / O modules (155) as a safety I / O module pool and configuring the plurality of safety controllers, including application programming; One of the plurality of safety controllers requests connection information of the safety field device used in its application programming from the safety I / O module pool; communicating an input including a status or a value from any one of the plurality of safety field devices to the plurality of safety I / O modules, wherein one of the plurality of safety I / O modules reads the status or the value; providing the input to the plurality of safety controllers via the I / O mesh network, wherein the input is configured to be transmitted to any one of the plurality of safety controllers requesting input information; providing outputs from the plurality of safety controllers through the I / O mesh network and then through any one of the plurality of safety I / O modules collectively serving as the safety I / O module pool; as well as An output including an output state or value from any of the plurality of safety I / O modules is communicated to any of the plurality of safety field devices.

7. The method of claim 6, wherein the process control system (140) includes a plurality of controllers (106) coupled to a plurality of I / O modules via an I / O network (104), wherein each of the plurality of I / O modules is coupled to a portion of the field device.

8. The method of claim 7, wherein the I / O network comprises a second I / O mesh network (104') coupled to the I / O mesh network (154), wherein the plurality of controllers (106) are coupled via the second I / O mesh network (104') to enable any of the plurality of controllers (106) to be coupled to any of the plurality of I / O modules.

9. A process automation system (150), comprising: A process control system (140) comprising a plurality of controllers (106) coupled to a plurality of input / output (I / O) modules, the plurality of I / O modules coupled to field devices (102, 102b), the field devices coupled to process equipment (107); Safety instrumented system SIS (100), including: a plurality of security controllers (156); a plurality of safety I / O modules (155) coupled to a plurality of safety field devices (152a, 152b) coupled to the processing equipment (107), wherein the SIS (100) has its own safety controller and safety field devices connected in parallel to the field devices, and an I / O mesh network (154) connected between the plurality of safety controllers and the plurality of safety I / O modules, Wherein the I / O grid network is configured to select any one of the plurality of safety controllers to become coupled to any one of the plurality of safety I / O modules so as to be used as a safety I / O module pool, so that any one of the plurality of safety controllers can be configured to receive sensor signals from any one of the safety I / O field devices and transmit control signals to any one of the safety I / O field devices.

10. A process automation system according to claim 9, wherein the plurality of controllers (106) are coupled to a plurality of I / O modules via an I / O network (104), wherein each of the plurality of I / O modules is coupled to a portion of the field device, wherein the I / O network includes a second I / O grid network (104') coupled to the I / O grid network (154), wherein the plurality of controllers (106) are coupled via the second I / O grid network (104') to enable any one of the plurality of controllers (106) to be coupled to any one of the plurality of I / O modules.

Images