Control system with error detection

Abstract

A control system for controlling a process. The control system includes a primary module bus and a secondary module bus through which information can be transmitted between controllers and a plurality of I / O modules. Each controller and I / O module has a power sense circuit for detecting current on a driver high side and a ground sense circuit for detecting current on a driver low side. If the current on the driver high side as measured by the power sense circuit is outside of a predetermined high range or the current on the driver low side as measured by the ground sense circuit is outside of a predetermined low range, then it is determined that the driver has failed.

Description

[0001] This application is a divisional application of Chinese patent application No. 201680048646.4, filed on June 16, 2016, entitled "Control System with Error Detection". Technical Field

[0002] This disclosure relates to industrial control systems, and more specifically, to industrial control systems having controllers and input / output modules that communicate via a module bus. Background Technology

[0003] Industrial control systems, such as distributed control systems, typically include one or more controllers. These controllers utilize input signals from field devices (such as flow meters) to provide control output signals to final control elements (such as valves) to control the process or one or more subprocesses. Such control systems are usually modular and include one or more controller modules and multiple input / output (I / O) modules. The controller modules receive input signals from the field and send output signals to the field through these I / O modules. The I / O modules communicate with the controller modules via one or more module buses. In traditional control systems, when a communication failure occurs on the module bus, it is often unknown whether the failure is caused by a fault in the module bus itself or by a failure in one of the modules. Detecting the source of a communication failure requires extensive testing.

[0004] This disclosure relates to a control system with error detection. Summary of the Invention

[0005] In one aspect of this disclosure, a process control system includes a module bus and a controller module connected to communicate via the module bus. The controller module is programmed to perform operations for controlling a process using data transmitted via the module bus. The control system also includes a plurality of I / O modules connected to communicate with the controller module via the module bus. Each I / O module includes a microprocessor with memory and a driver for sending information to the module bus. The driver has a high side connected to a voltage source and a low side connected to ground. A sensing circuit detects current on the high side of the driver. The microprocessor is operable to execute computer-executable instructions stored in memory to perform an I / O module error detection method that determines whether the current on the high side of the driver, as measured by the sensing circuit, is outside a predetermined high range, and if so, determines that the driver has failed.

[0006] In another aspect of this disclosure, a process control system includes a controller module connected to communicate via a first module bus and a second module bus. The controller module is programmed to operate using data transmitted via the module buses to perform actions for controlling a process. The control system also includes a plurality of I / O modules connected to communicate with the controller module via the first and second module buses. Each I / O module includes a microprocessor with memory and a driver for sending information to the first module bus. The driver has a high side connected to a voltage source and a low side connected to ground. A power sensing circuit detects current on the high side of the driver, while a ground sensing circuit detects current on the low side of the driver. The microprocessor is operable to execute computer-executable instructions stored in memory to perform a module error detection method, the method including determining whether a communication error has occurred on the first module bus. If a communication error has occurred on the first module bus, then determining whether the current on the high side of the driver measured by the power sensing circuit is outside a predetermined high range and whether the current on the low side of the driver measured by the ground sensing circuit is outside a predetermined low range. If it is determined that the current on the high side of the driver is outside a predetermined high range or the current on the low side of the driver is outside a predetermined low range, then the driver is determined to be faulty.

[0007] In another aspect of this disclosure, a method for detecting errors in a process control system having multiple modules connected to communicate via a first module bus and a second module bus is provided. Each module has a driver for sending information to the first module bus. The driver has a high side connected to a voltage source and a low side connected to ground. According to the method, in each module, it is determined whether a communication error has occurred on the first module bus. In each module where a communication error has been determined, the current on the high side of the driver is measured. In each module where a communication error has been determined, the current on the low side of the driver is also measured. The current measured on the high side of the driver in each module where the high side measurement was performed is compared with a predetermined high range, and the current measured on the low side of the driver in each module where the low side measurement was performed is compared with a predetermined low range. If the current on the high side of the driver is outside the predetermined high range or the current on the low side of the driver is outside the predetermined low range, then it is determined that the driver in one of the modules has failed. Attached Figure Description

[0008] The features, aspects, and advantages of this disclosure will become more readily understood with reference to the following description, the appended claims, and the accompanying drawings, in which:

[0009] Figure 1A front view of the module rows of the control system is shown;

[0010] Figure 2 A schematic diagram of the communication connections of the control system is shown;

[0011] Figure 3 The communication circuitry within the module is shown;

[0012] Figure 4 A flowchart of the module error detection procedure is shown; and

[0013] Figure 5 A flowchart of the system error detection procedure for the control system is shown. Detailed Implementation

[0014] It should be noted that in the following detailed description, the same components have the same reference numerals, regardless of whether they are shown in different embodiments of this disclosure. It should also be noted that, for clarity and brevity, the drawings may not necessarily be drawn to scale, and certain features of the embodiments may be shown in schematic form.

[0015] Now for reference Figure 1 This diagram illustrates a module row 8 of a node in an industrial control system 10. Module row 8 includes a controller assembly 12, multiple I / O components 14, and end modules 16, 18, which are interconnected and mounted to a top-cap DIN rail that can extend horizontally or vertically. A node may include one or more additional module rows, each including more I / O components 14 and a first end module 16 and a second end module 18. Each additional module row can be mounted to a separate DIN rail 20. A node can be used to control all or part of an industrial process, such as a power generation process. Furthermore, a node can be connected to other nodes of the industrial control system 10, as described in more detail below. Module row 8 and other module rows of the control system 10 can be mounted in a housing such as a cabinet.

[0016] Controller component 12 communicates with I / O component 14 via one or more module buses 22. A pair of redundant module buses 22a, 22b are typically used to increase the integrity of control system 10. Communication between modules occurs via both module buses 22a, 22b. However, if the master bus 22a is functioning correctly, the module uses only data from that master bus 22a. If the master module bus 22a fails, the module uses data from the secondary module bus 22b. Each module bus 22 includes a clock line 24 and a data line 26. The data line 26 carries data between controller component 12 and I / O component 14, while the clock line 24 provides synchronization between controller component 12 and I / O component 14. The message structure and communication protocol used by controller component 12 and I / O component 14 for communication via module buses 22a, 22b include one or more features for ensuring data integrity, such as Cyclic Redundancy Check (CRC) and / or checksum features. For example, each message sent via module buses 22a and 22b may contain a CRC code based on the remainder of a polynomial division of the message's data blocks. When a message is received, the receiving device compares the CRC code of the message with a recently calculated CRC code in the data block, or equivalently performs a CRC check on the entire message and compares the resulting check value with the expected remainder constant. If the check values ​​do not match, then the message is determined to contain an error.

[0017] Each I / O component 14 handles multiple inputs and / or multiple outputs. A typical control system has multiple I / O components 14 that handle inputs and / or outputs. Inputs can be analog inputs, digital inputs, thermocouple inputs, or RTD inputs. Outputs can be analog outputs or digital outputs. Inputs and outputs (I / O) are typically powered by sensors and control elements in the field. However, digital outputs can be powered by I / O components 14, such as when a digital output is used to energize a relay coil.

[0018] Each I / O component 14 includes an I / O module 30 releasably mounted to an I / O base 32. Each I / O module 30 includes a housing enclosing one or more circuit boards. The circuit board of each I / O module 30 includes a microprocessor 34 with memory and multiple communication circuits 36 for communication via module buses 22a, 22b. Depending on whether the I / O module 30 processes inputs and / or outputs, conditioning circuitry on the circuit board processes field inputs received from sensors in the field or control outputs received from the controller component 12. More specifically, the conditioning circuitry performs conversions between field signals (e.g., analog 4-20mA, digital 24VDC, etc.) and digital bus signals, such as by using analog-to-digital converters and / or digital-to-analog converters. The conditioning circuitry also (e.g., by using switches, filters, and multiplexers) conditions signals received from or destined for the field and isolates field signals from the controller component 12.

[0019] The controller assembly 12 includes a pair of redundant controller modules 50 releasably mounted to a controller base 52. Each controller module 50 has a similar construction to each I / O module 30 and includes one or more circuit boards mounted inside a housing. The circuit boards in each controller module 50 include a microprocessor 34 with memory and multiple communication circuits 36 for communication via module buses 22a, 22b. The memory stores control programs that can be executed by the microprocessor 33 of each controller module 50. The control programs in each controller module 50 include one or more control loops (such as PID loops) that operate on one or more field inputs to generate control outputs. The field inputs and control outputs are routed to and from the controller assembly 12 via the I / O assembly 14 through module buses 22a, 22b. Each controller module 50 is programmed with the same control program and can execute the same control program; however, only one controller module 50 (the master) executes the control program to control the industrial process at any given time. If the master controller module 50 fails, the other controller modules 50 (the secondary) automatically take over and execute the control program to control the industrial process.

[0020] The controller base 52 has multiple Ethernet jacks 54, each adapted to receive a plug of an Ethernet cable 55. The Ethernet jacks 54 are connected to an Ethernet external device interface 56 in the controller module 50. In this way, the controller module 50 can communicate with other devices via the Ethernet cable 55 plugged into the Ethernet jack. More specifically, the controller module 50 can communicate with other controller modules 50 similarly connected to the Ethernet cable 55 (in other nodes), and / or with an operator workstation 58 connected to the Ethernet cable 55. The controller 50 can use protocols such as Modbus TCP to communicate with other devices connected to the Ethernet cable. The operator workstation 58 may have a graphical user interface (GUI) that displays information from the controller module 50.

[0021] As described above, each I / O module 30 and each controller module 50 includes multiple communication circuits 36 for communication via module buses 22a, 22b. More specifically, each I / O module 30 and each controller module 50 has four communication circuits 36, and each module bus 22 uses two communication circuits: one for the clock line 24 of the module bus and the other for the data line 26 of the module bus 22. Therefore, for the sake of brevity, only one communication circuit 36 ​​will be shown and described; it should be understood that this illustrative representation and description also applies to the other communication circuits 36.

[0022] Now for reference Figure 3 The diagram illustrates a communication circuit 36, which typically includes a transceiver 42, a power sensing circuit 44, and a ground sensing circuit 46. The transceiver 42 is connected between the microprocessor 33 or 34 and the module bus 22, and typically includes a driver 60 and a receiver 62. The driver 60 transmits signals from the microprocessor 33 or 34 to the module bus 22, while the receiver 62 transmits signals from the module bus 22 back to the microprocessor 33 or 34. The power sensing circuit 44 is connected to the high side (VCC) of the driver 60, while the ground sensing circuit 46 is connected to the low side (GND) of the driver 60.

[0023] Power sensing circuit 44 is operable to sense the current on the high side of driver 60, which is connected to a power supply 64 such as a 3-volt DC power supply. Power sensing circuit 44 may consist of only a single resistor. Alternatively, power sensing circuit 44 may include a differential amplifier connected across a main resistor 68. The differential amplifier includes an operational amplifier 70 and resistors 70, 72, 74, and 76. The output of the differential amplifier is connected to a gain resistor 78. The differential amplifier 66 and the gain resistor 78 operate to increase the voltage difference across the main resistor 68 to provide a wider range of acceptable operating values. In this way, erroneous values ​​(outside the range) are more distinguishable, thereby reducing the number of false error indications. The output from power sensing circuit 44 is an analog signal representing the high-side current of the driver. This analog signal is fed to an analog-to-digital converter (ADC) 80, which converts the analog signal into a digital signal, which is then fed to a microprocessor 33 or 34.

[0024] Ground sensing circuit 46 is operable to sense the current on the low side of driver 60. Ground sensing circuit 46 may consist of only a single resistor. Alternatively, ground sensing circuit 46 may include a single-ended amplifier connected between gain resistors 84, 86. The single-ended amplifier includes an operational amplifier 82 with negative feedback circuitry having resistors 90, 92. Single-ended amplifier 82 and gain resistors 84, 86 operate to increase the voltage difference between the low side of driver 60 and ground to provide a wider range of acceptable operating values. In this way, erroneous values ​​(outside the range) are more distinguishable, thereby reducing the number of false error indications. The output from ground sensing circuit 46 is an analog signal representing the low-side current of driver 60. This analog signal is fed to analog-to-digital converter (ADC) 80, which converts the analog signal into a digital signal, which is then fed to microprocessor 33 or 34.

[0025] The microprocessor 33 in each controller module 50 receives a high-side current signal generated by the power sensing circuit 44 and a low-side current signal generated by the ground sensing circuit 46 from each communication circuit 36 ​​in the controller module 50. Similarly, the microprocessor 34 in each I / O module 30 receives a high-side current signal generated by the power sensing circuit 44 and a low-side current signal generated by the ground sensing circuit 46 from each communication circuit 36 ​​in the I / O module 30. Therefore, each microprocessor 33, 34 receives more than eight current signals.

[0026] The module error detection program 100 in each I / O module 30 uses eight current signals to determine whether one of the drivers 60 of the I / O module 30 has failed (e.g., short-circuited). In each I / O module 30, the error detection program 100 is stored in memory and executed by the microprocessor 34. Now refer to... Figure 4 The module error detection procedure 100 initially determines in steps 102, 104, 106, and 108 whether a communication error has occurred on clock line 24 and / or data line 26 of module buses 22a and 22b. This determination may be performed using a CRC function or other data integrity functions. If a communication error has occurred, the procedure 100 proceeds to steps 110, 112, 114, and / or 116, where it waits until the drivers 60 for the fault lines(s) send a message to the fault lines(s). Once the affected driver 60 sends a message, the procedure 100 moves to steps 120, 122, 124, and / or 126, where it determines whether the affected driver 60 has a high-side current outside the high range (e.g., from about 8 mA to about 14 mA) or a low-side current outside the low range (e.g., from about 2 mA to about 4 mA). It should be noted in this regard that the determination of the high-side and low-side currents should be performed simultaneously with the message transmission via driver 60.

[0027] If the affected driver 60 has a high-side current outside the high range (such as 7mA or 15mA) or a low-side current outside the low range (such as 1mA or 5mA), then the affected driver 60 is determined to be faulty. In step 130, program 100 determines which of the drivers 60 has an out-of-range high-side current or low-side current. If one or more of the drivers 60 have out-of-range current, then in step 132, program 100 activates a red LED 110 on the I / O module 30 to provide a visual indication of the error. Furthermore, in step 134, program 100 transmits an error message to the main controller module 50a via module buses 22a, 22b that are not experiencing communication errors. This error message includes the address of the I / O module 30 and notifies the main controller module 50a that a communication error has been detected and that one of the drivers 60 has been determined to be faulty. The error message may also identify the (clock or data) line where the driver 60 has failed. If, in step 130, program 100 determines that no driver 60 has an out-of-range high-side current or low-side current, then in step 136, error detection program 100 transmits a status message to main controller module 50a via module buses 22a, 22b, which are free of communication errors. This status message includes the address of I / O module 30 and notifies main controller module 50a that a communication error has been detected, but none of the drivers 60 in I / O module 30 have been determined to be faulty.

[0028] Each controller module 50 also has a module error detection program stored in memory. However, only the main controller module 50a (using its microprocessor 33) executes the program to determine whether one of its drivers 60 has failed. Except for omitting steps 134 and 136, the module error detection program in each controller module 50 is the same as the error detection program 100 used in the I / O module 30.

[0029] In addition to its module error detection program, each controller module 50 also has a system error detection program 150 stored in memory. However, only the main controller module 50a (using its microprocessor 33) executes the system error detection program 150. Now refer to... Figure 5In step 152, the system error detection procedure 150 initially determines whether a communication error has occurred on clock line 24 and / or data line 26 of module buses 22a and 22b. If no communication error has occurred, the procedure 150 proceeds to step 154 ​​to determine whether any status message has been received from I / O module 30. If a status message has been received from I / O module 30 (indicating that I / O module 30 has detected a communication error but no driver 60 has been determined to be faulty), the procedure 150 determines that receiver 62 in I / O module 30 may have failed (e.g., short-circuited). In step 156, the main controller module 50a sends a notification of the error (and identification of the affected I / O module 30) to operator workstation 58, where the notification can be displayed on the GUI.

[0030] If, in step 152, program 150 determines that a communication error has occurred on specific buses 22a, 22b, then program 150 proceeds to step 158 to determine whether an error message has been received from one of the I / O modules 30 or whether the module detection program of the main controller module 50a has determined that one of its drivers 60 has failed. If no error message has been received and the module detection program of the main controller module 50a has determined that none of its drivers 60 have failed, then program 150 proceeds to step 160, where program 150 determines whether any status messages have been received. If one or more status messages have been received, then program 150 determines that the specific buses 22a, 22b themselves may have failed, and in step 162 sends a notification of the error to operator workstation 58, which can be displayed on the GUI at operator workstation 58. If no status message is received in step 160, then program 150 determines that one of the receivers 62 of the main controller module 50a may have failed. In step 164, the main controller module 50a sends the error notification to the operator workstation 58, where the notification can be displayed on the GUI.

[0031] If, in step 158, program 150 determines that it has received one or more error messages from I / O module 30, or if the controller's own module detection program has determined that one or more of its drivers 60 have failed, then program 150 proceeds to step 168, where program 150 identifies the module with the failed driver 60. In step 170, the main controller module 50a sends an error message identifying the module with the failed driver 60 to operator workstation 58, which can be displayed on the GUI at operator workstation 58.

[0032] It should be understood that the foregoing description of exemplary embodiments is intended to be illustrative of the invention only and not an exhaustive description. Those skilled in the art will be able to make certain additions, deletions, and / or modifications to the embodiments of the disclosed subject matter without departing from the spirit of this disclosure or the scope of the appended claims. For example, each receiver 62 in controller module 50 and I / O module 30 may be provided with a power sensing circuit 44 and a ground sensing circuit 46 for detecting current on the high side and low side of receiver 62, respectively. However, it has been determined that this is generally unnecessary, as most communication errors are caused by driver failures. Therefore, a typical control system provided according to this disclosure does not include sensing circuitry for receivers in its modules.

Claims

1. A control system for controlling a process, the control system comprising: The first module bus and the second module bus can transmit information through the first module bus and the second module bus; A controller module is connected to communicate via a first module bus and a second module bus, and the controller module is programmed to perform operations using data transmitted via the first module bus and the second module bus to control the process; Multiple I / O modules are connected to communicate with the controller module via the first module bus and the second module bus. Each I / O module includes: A microprocessor with built-in memory; A first driver is configured to send information to the first module bus and has a high side connected to a voltage source and a low side connected to ground. A first sensing circuit is used to detect the current on the high side of the first driver; A second driver, used to send information to the second module bus, has a high side connected to a voltage source and a low side connected to ground; and A second sensing circuit is used to detect the current on the high side of the second driver; The microprocessor is operable to execute computer-executable instructions stored in the memory to perform an I / O module error detection method, the I / O module error detection method comprising: Each I / O module in the I / O module determines whether a communication error has occurred on the bus of the first module; If a communication error has been determined to have occurred, determine whether the current on the high side of the first driver, as measured by the first sensing circuit, is outside a predetermined high range, and if so, determine that the first driver in one of the I / O modules has failed. If it is determined that the first driver has failed, then an error message regarding the failure of the first driver is sent to the controller module via the second module bus; and The I / O module error detection method further includes: In each of the I / O modules, it is determined whether a communication error has occurred on the bus of the second module; If a communication error has been determined to have occurred, determine whether the current on the high side of the second driver, as measured by the second sensing circuit, is outside the predetermined high range, and if so, determine that the second driver in one of the I / O modules has failed. If it is determined that the second driver has failed, an error message about the failure of the second driver is sent to the controller module via the first module bus.

2. The control system according to claim 1, wherein the step of determining whether a communication error has occurred on the first module bus and the second module bus is performed using a cyclic redundancy check function.

3. The control system according to claim 1, wherein the first sensing circuit and the second sensing circuit are respectively a first power sensing circuit and a second power sensing circuit, and wherein each I / O module further includes a first ground sensing circuit and a second ground sensing circuit for detecting current on the low side of the first driver and the second driver, respectively, and wherein the I / O module error detection method further includes: Determine whether the current on the low side of the first driver, as measured by the first ground sensing circuit, is outside the predetermined low range, and if so, determine that the first driver has failed. and Determine whether the current on the low side of the second driver, as measured by the second ground sensing circuit, is outside the predetermined low range, and if so, determine that the second driver has failed.

4. The control system according to claim 3, wherein the I / O module error detection method further includes: Determine whether a communication error has occurred on the first module bus, and if so, perform the steps of determining whether the current on the high side of the first driver, as measured by the first power sensing circuit, is outside the predetermined high range and whether the current on the low side of the first driver, as measured by the first ground sensing circuit, is outside the predetermined low range. and Determine whether a communication error has occurred on the second module bus, and if so, perform the steps of determining whether the current on the high side of the second driver, as measured by the second power sensing circuit, is outside the predetermined high range and whether the current on the low side of the second driver, as measured by the second ground sensing circuit, is outside the predetermined low range.

5. The control system according to claim 4, wherein the controller module comprises: A microprocessor with built-in memory; A first driver and a second driver are respectively used to interface with the first module bus and the second module bus, and each of the first driver and the second driver has a high side connected to a voltage source and a low side connected to ground. A first power sensing circuit is used to detect the current on the high side of the first driver; A grounding sensing circuit is used to detect the current on the low side of the driver; and The microprocessor is operable to execute computer-executable instructions stored in the memory to perform a controller module error detection method, the controller module error detection method comprising: Determine whether a communication error has occurred on the first module bus and the second module bus, respectively. If a communication error has occurred on the first module bus, then determine whether the current on the high side of the first driver, as measured by the first power sensing circuit, is outside a predetermined high range; If a communication error has occurred on the first module bus, then determine whether the current on the low side of the first driver, as measured by the first ground sensing circuit, is outside a predetermined low range; If the current on the high side of the first driver is outside the predetermined high range or the current on the low side of the first driver is outside the predetermined low range, then it is determined that the first driver has failed. If a communication error has occurred on the second module bus, then determine whether the current on the high side of the second driver, as measured by the second power sensing circuit, is outside the predetermined high range; If a communication error has occurred on the second module bus, then determine whether the current on the low side of the second driver, as measured by the second ground sensing circuit, is outside the predetermined low range; If the current on the high side of the second driver is outside the predetermined high range or the current on the low side of the second driver is outside the predetermined low range, then the second driver is determined to be faulty.

6. The control system according to claim 5, wherein the I / O module error detection method further includes: If it is determined that the first driver has failed, then an error message about the failure of the first driver is sent to the controller module via the second module bus; and If it is determined that the second driver has failed, an error message about the failure of the second driver is sent to the controller module via the first module bus.

7. A control system for controlling a process, the control system comprising: The first module bus and the second module bus can transmit information through the first module bus and the second module bus; A controller module is connected to communicate via a first module bus and a second module bus, and the controller module is programmed to perform operations to control the process using data transmitted via one or more of the first module bus and the second module bus. and Multiple I / O modules are connected to communicate with the controller module via the first module bus and the second module bus; Each of the controller module and the I / O module includes: A microprocessor with built-in memory; A driver for sending information to the first module bus and having a high side connected to a voltage source and a low side connected to ground; and A power sensing circuit for detecting the current on the high side of the driver; A grounding sensing circuit is used to detect the current on the low side of the driver; The microprocessor is operable to execute computer-executable instructions stored in the memory to perform a module error detection method, the module error detection method comprising: Determine whether a communication error has occurred on the bus of the first module; If a communication error has occurred on the first module bus, then determine whether the current on the high side of the driver, measured by the power sensing circuit, is outside a predetermined high range and determine whether the current on the low side of the driver, measured by the ground sensing circuit, is outside a predetermined low range; and If it is determined that the current on the high side of the driver is outside the predetermined high range, or if it is determined that the current on the low side of the driver is outside the predetermined low range, then it is determined that the driver has failed; and The module error detection method further includes: If it is determined that the driver has failed, then an error message is sent to the controller module via the second module bus; and If it is determined that the driver is not faulty, then a status message is sent to the controller module via the second module bus.

8. The control system of claim 7, further comprising a workstation including a graphical user interface, and wherein the microprocessor in the controller module executes computer-executable instructions stored in the memory to perform a system error detection method, the system error detection method comprising: Determine whether a communication error has occurred on the bus of the first module; If a communication error is determined to have occurred, then determine whether any error messages have been received and whether the driver of the controller module has been determined to be faulty; If it is determined that no error message has been received and that the driver of the controller module is not faulty, then determine whether any status message has been received. If it is determined that one or more status messages have been received, then it is determined that the first module bus has failed; Send a message to the workstation that the module bus has been determined to be faulty.

9. The control system according to claim 8, wherein the controller module and the I / O module each further include a receiver, the receiver being configured to receive information from the first module bus, and wherein the system error detection method further includes: If it is determined that no communication error has occurred and that a status message has been received from the I / O module, then it is determined that the receiver of the I / O module has failed. and The workstation is sent a message that the receiver of the I / O module has been determined to be faulty.

10. The control system according to claim 9, wherein the system error detection method further comprises: If it is determined that a communication error has occurred and an error message has been received from the I / O module, then a message indicating that the driver of the I / O module has failed is sent to the workstation.

11. A method for detecting errors in a process control system, the process control system having a plurality of modules connected to communicate via a first module bus and a second module bus, each module having a driver for sending information to the first module bus and having a high side connected to a voltage source and a low side connected to ground, the method comprising: In each of the modules, it is determined whether a communication error has occurred on the bus of the first module; In each of the modules in which a communication error has been determined to have occurred, the current on the high side of the driver is measured; In each of the modules in which a communication error has been determined to have occurred, the current on the low side of the driver is measured; The current measured on the high side of the driver in each of the modules that has undergone high-side measurement is compared with a predetermined high range; The current measured on the low side of the driver in each module that has undergone low-side measurement is compared with a predetermined low range. If the current on the high side of the driver is outside the predetermined high range or the current on the low side of the driver is outside the predetermined low range, then it is determined that the driver of one of the modules has failed. After determining that a communication error has occurred, each module in the module determines when the driver will send a message; In each of the modules in which a communication error has been determined to have occurred, when it is determined that a message has been sent by the driver, the steps of measuring the current on the high side of the driver and measuring the current on the low side of the driver are performed. If it is determined that the driver of one of the modules has failed, then a notification of the failed driver is displayed on the graphical user interface of the workstation of the control system. and If more than one module in the modules detects a communication error on the first module bus and no driver in the module is determined to be faulty, then the first module bus is determined to be faulty.

Images