Method and apparatus for implementing safety applications associated with a process control system - Patents.com

Abstract

To provide methods and apparatus to implement safety applications associated with process control systems.SOLUTION: An apparatus includes a configuration controller to: provide a plurality of available safety applications for implementation by a safety trip device 110 to a user for selection, the first safety application associated with a first set of I / O signals and implemented based on first pre-programmed instructions stored in memory, the second safety application associated with a second set of I / O signals and implemented based on second pre-programmed instructions stored in the memory; and, in response to a user selection of the first safety application, prompt the user to specify values for configuration settings associated with the first safety application. The apparatus also includes an I / O analyzer to implement the first safety application.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates generally to safety instrumented systems, and more particularly, to methods and apparatus for implementing safety applications associated with process control systems. [Background technology]

[0002] Many process control applications (e.g., distributed control systems (DCS), supervisory control and data acquisition (SCADA) systems, etc.) include equipment for triggering safety trips when one or more monitored parameter values ​​are outside of corresponding trip limits and / or other safety conditions are met. Such safety trips may be implemented using different types of equipment depending on the number of inputs / outputs (I / O) of the safety system and / or the associated complexity of the system. For example, in advanced implementations, safety logic solvers may be configured to handle a varying number of I / O points (which may amount to thousands) of different types, which can be handled in a fully configurable (e.g., programmable) manner. At the other end of the spectrum, relatively simple devices generally referred to as trip amplifiers or safety relays typically receive a single input signal, compare it to limits, and trip an output signal (usually a discrete output). Summary of the Invention

[0003] A method and apparatus for implementing safety applications associated with a process control system is disclosed. and an I / O analyzer for implementing the first safety application based on the values ​​for the configuration settings specified by the user and based on the first preprogrammed instructions.

[0004] Exemplary non-transitory computer readable medium including instructions that, when executed, cause a safety trip device to provide a plurality of available safety applications for implementation by the safety trip device associated with at least a process control system to a user for selection, wherein a first safety application of the safety applications is associated with a first set of I / O signals and a second safety application of the safety applications is associated with a second set of I / O signals, the first set of I / O signals being different from the second set of I / O signals, and the first safety application being stored in a memory of the safety trip device. and a second safety application implemented based on first pre-programmed instructions stored in a memory of a safety trip device; and in response to a user selection of the first safety application, prompting a user to specify values ​​for configuration settings associated with the first safety application, the first pre-programmed instructions defining the configuration settings; and implementing the first safety application based on the values ​​for the configuration settings specified by the user and based on the first pre-programmed instructions.

[0005] An example method includes providing a plurality of available safety applications for implementation by a safety trip device associated with a process control system to a user for selection, where a first safety application among the safety applications is associated with a first set of I / O signals and a second safety application among the safety applications is associated with a second set of I / O signals, the first set of I / O signals being different from the second set of I / O signals, the first safety application being implemented based on first pre-programmed instructions stored in a memory of the safety trip device and the second safety application being implemented based on second pre-programmed instructions stored in a memory of the safety trip device; in response to a user selection of the first safety application, prompting the user to specify values ​​for configuration settings associated with the first safety application, the first pre-programmed instructions defining the configuration settings; and implementing the first safety application based on the values ​​for the configuration settings specified by the user and based on the first pre-programmed instructions.

[0006] The safety trip device includes a housing including a backplane, a terminal block including respective slots, the slots receiving a first set of termination modules to communicate with a first set of field devices associated with a first safety application associated with the process control system and the slots receiving a second set of termination modules to communicate with a second set of field devices associated with a second safety application associated with the process control system, and an I / O scanner for communicating with the termination modules in the slots of the terminal block via the backplane, the I / O scanner including a memory for storing first pre-programmed instructions defining the operation of the first safety application and for storing second pre-programmed instructions defining the operation of the second safety application. [Brief description of the drawings]

[0007] [Figure 1] 1 illustrates an example of a process control system in which the teachings of the present disclosure may be implemented. [Diagram 2] FIG. 1 illustrates an example process control system with example safety trip devices in different locations. [Diagram 3] 3 illustrates any one of the example safety trip devices of FIG. 1 and / or FIG. 2. [Figure 4] FIG. 4 is a block diagram illustrating an example implementation of one of the example I / O scanners of FIG. [Diagram 5] 5 is a flowchart representing machine-readable instructions that may be executed to implement the example I / O scanner of FIG. 4. [Figure 6] 6 is a block diagram of an example processing platform configured to execute the instructions of FIG. 5 to implement the example I / O scanner of FIG. 4.

[0008] The figures are not to scale. Instead, the thickness of a layer or region may be exaggerated in the drawings. Generally, the same reference numbers are used throughout the drawings or drawings and the accompanying written description to refer to the same or similar parts. As used in this patent, stating that any part (e.g., layer, film, region, area, or plate) is on (e.g., positioned on, located on, disposed on, formed on, etc.) another part in any way indicates that the referenced part is in contact with the other part or is above the other part with one or more intermediate part(s) located therebetween. Connection references (e.g., attached, coupled, connected, and joined) should be interpreted broadly and may include intermediate members between sets of elements and relative movement between the elements unless otherwise indicated. As such, connection references do not necessarily infer that two elements are directly connected and in a fixed relationship to each other. Stated that any part is "in contact" with another part means that there are no intermediate parts between the two parts. Although the figures show layers and regions with sharp lines and boundaries, some or all of these lines and / or boundaries may be idealized. In reality, the boundaries and / or lines may be non-observable, blended, and / or irregular.

[0009] Descriptors such as "first," "second," "third," and the like are used herein when identifying multiple elements or components that may be referred to separately. Such descriptors are not intended to imply any sense of priority, physical order or arrangement in a list, or chronological ordering, unless otherwise specified or understood based on the context of usage, but are used merely as labels to refer to multiple elements or components separately to facilitate understanding of the disclosed examples. In some instances, a descriptor "first" may be used to refer to an element in the detailed description, but may refer to the same element in a claim with a different descriptor such as "second" or "third." In such cases, it should be understood that such descriptors are used merely to facilitate reference to multiple elements or components. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] The equipment used to implement safety applications associated with process control systems can vary from very advanced logic solvers that can handle a large number of I / O signals in a flexible manner to single-purpose safety relays that monitor one input of a particular type and generate one output. While advanced safety devices (e.g., logic solvers) offer high flexibility for many different applications in a fully configurable manner, such equipment is relatively expensive and difficult to implement due to the complexity involved in programming and / or configuring the safety application(s) to be implemented. Not only can the complexity of programming and / or configuring a safety application result in the possibility of human error, but the flexible nature of a fully programmable system also creates the possibility that a safety application may be tampered with (either inadvertently or maliciously (e.g., via a cyber attack)) after it has been correctly configured.

[0011] In contrast, low-complexity safety trip devices (e.g., safety relays) have the advantage of being relatively inexpensive and easy to set up, since they have limited, fixed functionality. Furthermore, the limited functionality reduces the likelihood of human error in the configuration of such devices and also prevents tampering with the implementation of such devices through cyber attacks. The simple design and functionality of safety relays is such that their operation is highly reliable. However, many safety relays do not have redundancy built in, meaning that if there is a system failure, there is no built-in backup to address the problem. Furthermore, many safety relays are standalone devices and do not allow communication with other monitoring systems (e.g., wellhead applications where trips need to be relayed to a master station).

[0012] Some safety applications may include several different I / O signals (e.g., applications based on voting logic). In some such situations, several different safety relays may be wired together to provide the desired functionality associated with the application. While this adds complexity compared to using a single safety trip device, this may still result in significantly less complexity than would be required to acquire, set up, and maintain an advanced fully programmable logic solver. Furthermore, if the number of I / Os in such a safety application is relatively low (e.g., less than 25), the ease of such application may not justify the cost of a fully programmable logic solver. In some safety applications that include multiple but relatively few I / O signals, dedicated safety trip devices have been developed to eliminate the need to wire multiple single-input safety relays. These dedicated safety trip devices typically have a fixed number of I / Os of a predefined type that corresponds to a particular safety application. While such devices provide convenience in system setup and configuration, they are typically fixed or limited in operation and functionality based on the particular application for which they are developed. As a result, such devices cannot be easily adapted to new situations and / or different types of safety applications (e.g., associated with different types of I / O signals) beyond the limited constraints defined by their design and manufacture. Furthermore, like many safety relays, such dedicated safety trip devices may not provide for redundancy.

[0013] The example safety trip devices disclosed herein may accommodate different types of safety applications associated with different types and / or numbers of I / O signals without the end user having to spend the time and expense of programming the device for each different type of safety application. Rather, in some examples, machine-readable instructions (e.g., software and / or firmware) for implementing the associated safety applications are pre-installed and / or pre-programmed and made available for a user to select for implementation in the example safety trip device. As used herein, the term "pre-programmed" is expressly defined to mean programmed by someone other than the end user before the end user utilizes the example safety trip device for the corresponding safety application. In some examples, the machine-readable instructions associated with a particular safety application are pre-programmed by the manufacturer of the example safety trip device and installed at the time of manufacture. Additionally, in some examples, the pre-programmed instructions for a particular safety application may be developed by a third-party entity (e.g., an original equipment manufacturer (OEM)) for installation at the time of manufacture. Additionally or alternatively, in some examples, pre-programmed instructions (whether developed by the manufacturer or by another third party) may be provided to an end user for download and installation after manufacture of the safety trip device.

[0014] While the examples disclosed herein include "pre-programmed" instructions for a particular safety application, such instructions may be programmed with the ability to define and / or specify specific values ​​for associated safety parameters and / or other configuration settings. Exemplary safety parameters and / or other configuration settings associated with a particular safety application may include trip limits (e.g., set points), units for the trip limits, direction of trip (e.g., high or low), delay periods associated with a trip, etc. Although an end user is provided with the ability to set such configuration settings, the remaining operation and functionality of the associated safety application is predefined in the pre-programmed instructions. That is, the specific types and numbers of input and output signals, as well as the procedures by which the I / O signals are analyzed and / or processed, are already defined. In some examples, the safety trip devices disclosed herein include a communication interface that allows for communication with monitoring and / or other systems using any suitable communication protocol (e.g., Modbus). In some such examples, the mapping of communication addresses (e.g., registers) to different I / O parameters and / or signal values ​​is also defined by pre-programmed instructions, so that the user only needs to specify basic communication port settings (e.g., Modbus port settings) to complete the system setup. As a result, setting up a safety application using the example safety trip devices disclosed herein is much faster and easier than a fully programmable logic solver and less prone to human error. Furthermore, the ability for a user to select different pre-programmed safety applications allows the example safety devices to be more flexible than safety relays and / or dedicated safety trip devices with fixed functions.

[0015] Another advantage of pre-programmed instructions developed by manufacturers and / or other third party entities is that such entities may obtain certification for the pre-programmed instructions from relevant safety compliance authorities or governing bodies. As a result, end users can confidently rely on the pre-programmed instructions as meeting all necessary safety requirements and / or codes without having to incur the time and expense of programming their own applications and seeking appropriate certification each time they develop a new application. Additionally, the exemplary safety trip devices disclosed herein provide redundancy, thereby increasing reliability, as compared to other relatively low I / O count safety trip devices (e.g., safety relays and dedicated safety trip devices). Additionally, unlike fully programmable logic solvers, which are more susceptible to tampering, some disclosed examples prevent end users and / or malicious attackers from modifying the underlying (pre-programmed) instructions for a particular safety application. Additionally, in some examples, end users and / or malicious attackers are prevented from modifying the specific safety application and / or associated settings for the application being implemented without physical confirmation of the user's presence, thus improving the cybersecurity of such devices.

[0016] Referring in detail to the drawings, Figure 1 illustrates an exemplary process control system 100 in which the teachings of the present disclosure may be implemented. This particular example corresponds to a stand-alone safety instrumented system (SIS) such as may be implemented at a wellhead. This example is provided for illustrative purposes only. The teachings disclosed herein may be implemented in connection with safety applications in any type of process control system (e.g., distributed control system (DCS), supervisory control and data acquisition (SCADA) system, etc.) that may be more or less complex than that shown in the illustrated example.

[0017] As shown in the depicted example of Figure 1, the example system 100 includes a remote terminal unit (RTU) 102 in communication with one or more field devices 104, 106. Additionally, as shown in Figure 1, the RTU 102 is also in communication with a system host 108 (e.g., an existing SCADA network) associated with the example system 100. In the depicted example, communication between the RTU 102 and the system host 108 may be accomplished via any suitable communication device and / or medium. In this example, the RTU 102 and associated field devices 104, 106 implement non-safety aspects of the example process control system 100.

[0018] The example system host 108 of FIG. 1 enables operators, engineers, and / or other plant personnel (any of which may be referred to herein as users) to review and / or interact with one or more operator display screens and / or applications that enable users to view system variables, states, conditions, and / or alarms associated with the example control system 100, change control settings for the example control system 100 (e.g., set points, operating states, clear alarms, silence alarms, etc.), configure and / or calibrate devices within the example control system 100, perform diagnostics on devices within the example control system 100, and / or otherwise interact with devices within the example control system 100.

[0019] The example system host 108 of FIG. 1 may be implemented using one or more workstations and / or any other suitable computer system and / or processing system. For example, the system host 108 can be implemented using a single processor personal computer, a single or multi-processor workstation, a portable laptop computer, or the like. The host 108 may be configured with one or more application stations to execute one or more information technology applications, user interactive applications, and / or communications applications. For example, an application station may be configured to execute primarily process control related applications, and another application station may be configured to execute primarily communications applications that enable the control system 100 to communicate with other devices or systems using any desired communications media (e.g., wireless, hardwired, etc.) and protocols (e.g., HTTP, SOAP, etc.).

[0020] 1 includes one or more safety trip devices 110, 112, 114, each of which is in communication with one or more field devices 116, 118, 120, 122. Although the safety trip devices 110, 112, 114 are shown and described as being associated with the process control system 100, in some examples, the safety trip devices 110, 112, 114 may be implemented as part of one or more safety instrumented systems that operate independently from the remainder of the system 100. In some examples, one or more of the field devices 116, 118, 120, 122 may be in communication with two or more of the safety trip devices 110, 112, 114. Additionally or alternatively, in some examples, one or more of the field devices 116, 118, 120, 122 in communication with one or more of the safety trip devices 110, 112, 114 may correspond to one or more of the field devices in communication with the RTU 102. In some examples, at least some of the example field devices 104, 106, 116, 118, 120, 122 may be smart field devices such as Fieldbus-compliant valves, actuators, sensors, etc., in which case the smart field devices 104, 106, 116, 118, 120, 122 communicate with the RTU 102 and / or the safety trip devices 110, 112, 114 using the well-known Foundation Fieldbus protocol, either via wired or wireless communication mediums. Of course, other types of smart field devices and communication protocols may be used instead. For example, the smart field devices 104, 106, 116, 118, 120, 122 may alternatively be Profibus® and HART® compliant devices that communicate with the RTU 102 and / or the safety trip devices 110, 112, 114 using the well-known Profibus® and HART® communication protocols.Additionally or alternatively, in some examples, the field devices 104, 106, 116, 118, 120, 122 may be communicatively coupled via a local wireless network according to the WirelessHART™ protocol. Further, in some examples, at least some of the field devices 104, 106, 116, 118, 120, 122 may be non-smart field devices, such as conventional 4-20 milliamp (mA) or 0-24 volts direct current (VDC) equipment devices, that communicate with the RTU 102 and / or the safety trip devices 110, 112, 114 via respective hardwired links. Further details regarding communication between the example field devices 116, 118, 120, 122 and the example safety trip devices 110, 112, 114 are provided further below in conjunction with FIG.

[0021] In the illustrated example, the safety trip devices 110, 112, 114 communicate with the RTU 102 through a primary network 124 via a first switch 126 and through a redundant network 128 via a second switch 130. In some examples, the switches 126, 130 may be omitted. In this example, the networks 124, 128 are implemented using the well-known Modbus protocol. However, in other examples, other communication protocols may be used. In the illustrated example of FIG. 1, each of the exemplary safety trip devices 110, 112, 114 independently connects to the two networks 124, 128 to provide independent safety instrumented functions (SIFs). Communicatively coupling the safety trip devices 110, 112, 114 to the RTU 102 allows for SIS information to be shared with personnel at a workstation associated with the system host 108.

[0022] The exemplary process control system 100 of the illustrated example of FIG. 1 also includes a human machine interface 132 to enable display of information associated with operation of the process control system 100 including the RTU 102 and / or the safety trip devices 110, 112, 114. Additionally, in some examples, a configuration tool 134 is communicatively coupled to the safety trip devices 110, 112, 114 to enable a user to configure and / or set up each safety trip device 110, 112, 114 to implement a particular safety application. In some examples, as shown in FIG. 1, the configuration tool 134 communicates with the safety trip devices 110, 112, 114 through the primary network 124 via the first switch 126. Additionally or alternatively, in some examples, the configuration tool 134 may be hardwired directly to a particular one of the safety trip devices 110, 112, 114. As mentioned above and further described below, in some examples, the safety trip devices 110, 112, 114 include pre-programmed instructions associated with different safety applications stored in memory and available for a user to select and configure. In some examples, a user selects a particular safety application via the configuration tool 134 and further specifies values ​​for associated configuration parameters and / or settings via the configuration tool 134. Additionally, in some examples, a user may use the configuration tool 134 to download a different (e.g., new) pre-programmed application from a website (e.g., maintained by the safety trip device manufacturer and / or a third party entity) and then install the new application on the safety trip devices 110, 112, 114. The configuration tool 134 may be a laptop computer, a notebook computer, a smartphone, a handheld device, and / or any other computing device.

[0023] In some examples, the safety trip devices 110, 112, 114 may be configured to handle any suitable number of I / O points and / or channels, up to the limit defined by the size of the trip device. In some examples, the safety trip devices 110, 112, 114 are configured to handle up to 12 I / O channels, which is sufficient to provide flexibility to address many safety applications with relatively low I / O counts. In situations where the I / O count for a particular safety application requires more I / O channels than are available in a single safety trip device, multiple devices may be combined, as shown in the illustrated example of FIG. 2. In particular, FIG. 2 illustrates the example process control system 100 of FIG. 1 with the second safety trip device 112 reconfigured to function as a slave node with the first safety trip device 110 as the master node. Combining the two safety trip devices in this manner doubles the number of I / Os available in a single SIF (e.g., 24 I / Os instead of 12 I / Os). The exemplary safety trip device described herein includes 12 I / O channels, although other exemplary trip devices may have more or less than 12 I / O channels.

[0024] Additionally, although the exemplary safety trip devices 110, 112, 114 are described as including up to 12 I / O channels, the actual number of channels used for any particular application may be set by the user based on the requirements of the particular application being implemented. That is, in one application, only four channels may be used, while another application may include the use of eleven channels. Additionally, the particular type of I / O signal associated with any of the channels may be tailored to the particular application being implemented. For example, in one application, a first I / O channel may be designated for a 4-20 mA analog input. In a second, different application, a first I / O channel may be designated for a thermocouple input. Different types of I / O signals compatible with the exemplary safety trip devices 110, 112, 114 include 4-20 mA analog input signals, 4-20 mA analog output signals, 0-10 V analog input signals, 0-10 V analog output signals, thermocouple signals, resistance temperature detector (RTD) signals, dry or NAMUR discrete input signals, high side discrete output signals, isolated discrete input or output signals for high current or high VAC voltage, relay contact output signals, etc. Enabling any combination of these different types of I / O signals in any quantity up to the construction capacity of the safety trip device (and even more if multiple trip devices are combined) provides considerable flexibility in adapting the safety trip device to different uses and applications than is possible using existing dedicated safety trip devices designed for specific applications. Furthermore, by providing the user with pre-programmed instructions for selection that correspond to specific applications, the configuration and setup of such devices becomes much less complicated than is possible with a fully programmable logic solver.

[0025] FIG. 3 illustrates a more detailed view of the first exemplary safety trip device 110 of FIG. 1 and / or FIG. 2. The following description is provided with respect to the first safety trip device 110, however, the second and third safety trip devices 112, 114 of FIG. 1 and / or FIG. 2 may be similar or identical to the first safety trip device 110. The exemplary safety trip device 110 of the illustrated example includes a housing 302 that holds one or more I / O scanners 304, 306. In this example, there are two I / O scanners, a first I / O scanner 304 functions as a primary I / O scanner and a second I / O scanner 306 functions as a redundant I / O scanner. The I / O scanners 304, 306 are communicatively coupled to respective I / O ports 308, 310 through which the I / O scanners 304, 306 may be communicatively coupled to the first and second networks 124, 128 shown in FIG. 1. Additionally or alternatively, the I / O ports 308, 310 may be used to communicatively interconnect multiple safety trip devices, such as illustrated by the first and second safety trip devices 110, 112 in Figure 2. In some examples, the I / O scanners 304, 306 are communicatively coupled to the I / O ports 308, 310 via a backplane contained within the housing 302.

[0026] In some examples, the I / O scanners 304, 306 are selectively removable from the housing 302, thereby allowing for a particular I / O scanner to be replaced with a different scanner. In some such examples, clips or latches 312 and / or other locking mechanisms are used to secure the I / O scanners 304, 306 in place when coupled to the housing 302. In other examples, the I / O scanners 304, 306 are integral with the housing 302. Similar to the I / O scanners 304, 306, in some examples, the I / O ports 308, 310 are selectively removable from the housing 302, thereby allowing for a particular I / O port to be replaced with a different port (e.g., a port including multiple communication plugs rather than just the one shown in the illustrated example). In some examples, clips or latches 314 and / or other locking mechanisms secure the I / O ports 308, 310 to the housing. In other examples, the I / O ports 308, 310 are integral with the housing 302.

[0027] As shown in the illustrated example, the safety trip device 110 also includes a number of terminal blocks 316. In this example, there are twelve terminal blocks 316. In other examples, the number of terminal blocks 316 may be more or less than twelve. The exemplary terminal block 316 provides a first physical interface (e.g., wire termination point 318) onto which one or more wires from the field devices 116, 118, 120, 122 may land. Additionally, the exemplary terminal block 316 includes a second physical interface (e.g., a slot or socket 320 having electrical contacts 322 included therein) for receiving and holding one of a number of different types of I / O termination modules 324. In the illustrated example, the I / O termination modules 324 are inserted into the slots 320 of the first, second, third, fifth and twelfth terminal blocks 316. In some examples, the termination modules are CHARMs (Characterization Modules) developed by Emerson Process Management.

[0028] In the illustrated example, the safety trip device 110 also includes an address plug 326. In some examples, the address plug 326 may correspond to one of two types that may be selectively swapped for one another in corresponding slots in the housing 302 of the safety trip device 110. The first type of address plug 326 is a run-time address plug, which is a standard type of address plug that provides the I / O scanners 304, 306 with addressing information for the different termination modules 324. The second type of address plug 326 is a configuration address plug, which may be used specifically when the safety trip device 110 is configured for a particular safety application, as described in more detail below.

[0029] In some examples, the terminal block 316 is selectively removable from the housing 302 to allow replacement with a different terminal block (e.g., having a different number and / or type of termination points 318 for connecting to different types of field devices). In some such examples, the I / O termination module 324 may be integrated with a corresponding terminal block 316 such that a different I / O termination module 324 and terminal block 316 as a unit may be selectively removed and / or replaced from the safety trip device 110. In other examples, the terminal block 316 may be integrated with the housing 302 with only the I / O termination module 324 being selectively removable.

[0030] In the illustrated example, the electrical contacts 322 on the terminal block 316 are electrically coupled to the termination points 318 to enable communication between the field devices 116, 118, 120, 122 (wired to the termination points 318) and the I / O termination modules 324 inserted into the slots 320 of the corresponding terminal blocks 316. Additionally, the electrical contacts 322 of the terminal blocks 316 are electrically coupled to the backplane of the housing 302 to enable communication between the I / O scanners 304, 306 and the corresponding I / O termination modules 324 inserted into the terminal blocks 316. More specifically, in some examples, the backplane of the housing 302 includes a universal I / O bus (e.g., a common or shared communication bus) that communicatively couples the I / O termination modules 324 in any of the terminal blocks 316 to the I / O scanners 304, 306.

[0031] In some examples, I / O signals transmitted to or received from different field devices 116, 118, 120, 122 may be of different types based on the types of field devices involved. As a result, the I / O signals may not be directly compatible with the universal I / O bus because they are based on different communication protocols. Thus, in some examples, transmissions to and from different types of field devices 116, 118, 120, 122 associated with different types of I / O signals (communicated based on different communication protocols) are handled by different types of I / O termination modules 324 configured to handle the corresponding types of I / O signals. That is, the different types of I / O termination modules 324 include different logic circuits for receiving field device information from the corresponding field devices based on a particular communication protocol and communicating the field device information to the I / O scanners 304, 306 using the different communication protocols associated with the universal I / O bus. Similarly, the I / O scanners 304, 306 may communicate field device information to the I / O termination modules 324 based on the communication protocol associated with the universal I / O bus, and logic circuitry in each I / O termination module 324 may then extract the field device information and communicate that information to its respective field device according to the particular type of I / O signal and associated communication protocol targeted to each particular field device.

[0032] The ability to use different I / O termination modules 324 constructed to process different types of I / O signals (associated with different communication protocols) allows the safety trip device 110 to be adapted to different safety applications by selecting an appropriate type of I / O termination module 324 corresponding to the particular type of I / O signal involved in each desired application and inserting such module 324 into the terminal block 316. Of course, in order for the I / O scanners 304, 306 to be able to properly analyze and / or process the I / O signals for a given safety application, the I / O scanners 304, 306 must be programmed and / or configured to do so. In some examples, the I / O scanners 304, 306 include memory for storing pre-programmed instructions associated with different types of safety applications, eliminating the need for an end user to program the I / O scanner each time the safety trip device 110 is adapted for a new safety application. In some examples, the pre-programmed instructions are stored in the memory during manufacture of the safety trip device 110 prior to sale. Additionally or alternatively, pre-programmed instructions may be downloaded by an end user and stored in the I / O scanners 304 , 306 after purchase of the safety trip device 110 .

[0033] By providing pre-programmed instructions for a particular safety application that do not need to be developed by an end user, the complexity of setting up the safety trip device 110 for such a safety application is greatly reduced. For example, in some examples, the pre-programmed instructions define for a particular safety application the number and type of I / O signals involved, as well as the interrelationships of such signals and how they are handled and / or processed. Furthermore, in some examples, the pre-programmed instructions define for a particular safety application the logical sequence(s) of operations, as well as the mapping of communication addresses (e.g., registers) for the different I / O signals involved in the particular application for communication with external components (e.g., the host system 108 of FIG. 1). As a result, when an end user desires to configure the safety trip device 110 to implement a particular safety application, the user selects the associated pre-programmed instructions, inserts the associated I / O termination module 324, and defines the particular configuration settings and / or communication port settings. In some examples, the configuration settings include the value of the trip limit (e.g., set point), units for the trip limit, the direction of the trip (e.g., high or low), a delay period associated with the trip, etc. In some examples, the communication port configuration (e.g., Modbus port configuration) includes defining an Internet Protocol (IP) address, subnet mask, port number, etc. associated with the terminal block 316 and / or associated I / O signals associated with the safety application.

[0034] In some examples, the pre-programmed instructions may be certified by an associated safety compliance authority or governing body. Such certification need only be done once and may then be reliably used on any number of safety trip devices 110 by any number of end users. To ensure that the certification remains valid, in some examples, end users are prevented from modifying the pre-programmed instructions. That is, while a user may select and provide configuration settings appropriate for a particular implementation of an associated safety application, the user may be prevented from accessing, viewing and / or modifying the underlying logic sequences and associated relationships and interactions of signals of I / Os defined in the pre-programmed instructions. Although end users may not be able to modify the pre-programmed instructions stored in the I / O scanners 304, 306, in some examples, end users may develop their own programs to be implemented by the I / O scanners 304, 306, for example, when pre-programmed instructions are not available for a particular safety application. In such examples, end users may be able to update and / or modify the programs as needed.

[0035] In some examples, selection of a particular safety application associated with pre-programmed instructions stored in the I / O scanners 304, 306, and the associated configuration of such instructions for implementation, is restricted to when the configuration address plug 326 is inserted into the safety trip device 110 in place of the standard runtime address plug 326. Restricting modifications to the configuration and setup of a particular safety application to when the configuration address plug 326 is inserted into the safety trip device 110 effectively provides a test of user presence for added security before modifications can be made, since the user must physically insert the configuration address plug 326. Once the safety trip device 110 is set up and configured for a particular safety application and the standard runtime address plug is replaced with the configuration address plug 326, the safety trip device 110 operates as configured without the risk of someone inadvertently or maliciously tampering with the configuration settings for the application (and / or switching the operation of the safety trip device 110 to correspond to a different safety application associated with a different set of pre-programmed instructions). In other words, the configuration address plug 326 places the safety trip device 110 in a configuration mode where a safety application may be modified but not implemented, whereas the runtime address plug 326 places the safety trip device in a run mode where a safety application may be implemented but not modified.

[0036] Figure 4 is a block diagram illustrating an example implementation of the primary I / O scanner 304 of Figure 3. The following description is provided with respect to the primary I / O scanner 304, however, the redundant I / O scanner 306 may be similar or identical to the primary I / O scanner 304. As shown in the illustrated example, the primary I / O scanner 304 includes an example external communications interface 402, an example I / O communications interface 404, an example configuration controller 406, an example I / O analyzer 408, and an example memory 410.

[0037] The example external communication interface 402 enables communication with components external to the safety trip device 110. That is, in this example, the external communication interface 402 interacts with corresponding I / O ports 308, 310 to enable communication with networks 124, 128 and / or with other safety trip devices 110. For example, among other things, a user may select and / or configure a particular safety application on the safety trip device 110 via the configuration tool 134 of FIGS. 1 and 2, which is in communication with the safety trip device 110 via the external communication interface 402 of the I / O scanner 304.

[0038] The example I / O communication interface 404 enables communication with different I / O termination modules 324 inserted into the terminal blocks 316 on the safety trip device 110. In such examples, the I / O communication interface 404 communicates with the I / O termination modules 324 through the backplane of the housing 302 using a universal I / O bus, as described above. In some examples, the I / O communication interface 404 also enables communication between the primary I / O scanner 304 and the redundant I / O scanner 306. As a result, in some examples, modifications and / or changes to one of the I / O scanners 304, 306 are automatically passed on to the other. Although the external communication interface 402 is shown separate from the I / O communication interface 404, in some examples the external communication interface 402 may be integrated and / or combined with the I / O communication interface 404.

[0039] The example configuration controller 406 of the I / O scanner 304 of FIG. 4 manages user selection and configuration of safety applications to be implemented by the safety trip device 110. In some examples, the configuration controller 406 determines whether the address plug 326 is a configuration address plug or a runtime address plug. If the plug 326 is a runtime address plug, the configuration controller 406 prevents the user from selecting (e.g., changing) a safety application designation for implementation in the safety trip device 110. Additionally, if the address plug 326 is a runtime address plug, the configuration controller 406 may also prevent the user from modifying configuration settings for the currently designated safety application. On the other hand, if the address plug 326 is a configuration address plug, the configuration controller 406 may allow the user to select and / or configure a safety application for implementation by the safety trip device 110. However, the configuration address plug 326, by its very nature of lacking valid address information, prevents the safety application from actually being implemented. Only when the standard run-time address plug 326 is reinserted into the safety trip device 110 can the specified safety application be implemented.

[0040] As noted above, in some examples, the user selects and configures a particular safety application using the configuration tool 134. Thus, in some examples, the configuration controller 406 communicates with the configuration tool 134 via the external communication interface 402 to provide prompts and / or options for the user to select and / or provide feedback during the configuration process. More specifically, in some examples, the configuration controller 406 provides the available safety applications to the user for selection, which are rendered on a display screen of the configuration tool 134. In some examples, the configuration controller 406 may generate a graphical user interface with associated user options for rendering via a display on the configuration tool 134. In other examples, the configuration controller 406 may transmit relevant information to enable the configuration tool 134 to generate an appropriate graphical user interface to display the information to the user. The available safety applications may be displayed in any suitable manner (e.g., a drop-down list, a table, etc.).

[0041] In some examples, the available safety applications provided to the user for selection correspond to all safety applications associated with pre-programmed instructions stored in memory 410 of the I / O scanner 304. Additionally or alternatively, in some examples, the available safety applications provided to the user may include applications that the user (or a different end user) previously developed and stored in memory 410. In some examples, the available safety applications provided to the user for selection may correspond to a subset of all safety applications with pre-programmed instructions stored in memory 410. For example, in some examples, only safety applications associated with a particular type of process control system (e.g., a wellhead safety application) may be provided to the user.

[0042] In some examples, the available safety applications may include pre-programmed instructions that are not already stored in memory 410. In such examples, the user may be provided with an option to obtain such pre-programmed instructions by downloading them from a website using configuration tool 134. Once downloaded, configuration tool 134 may send the pre-programmed instructions to I / O scanner 304 for storage in memory 410. In some examples, configuration controller 406 may not specifically identify pre-programmed applications that are not stored in memory 410, but may nevertheless provide an option for the user to check for new and / or different safety applications other than those stored in memory 410.

[0043] The available safety applications may correspond to any suitable type of application that may be implemented in a safety instrumented system. Different exemplary applications that may have pre-programmed instructions stored in memory 410 include a burner management system (BMS) application, an emergency shutdown (ESD) application, an automatic overflow protection system (AOPS) application, a high-integrity pressure protection system (HIPPS) application, a single vote application (e.g., one out of two (1oo2), two out of three (2oo3), etc.), a multiple repeat vote application (e.g., two repeats of a 2oo3 vote, three repeats of a 1oo2 vote, etc.), a wellhead application, etc.

[0044] In some examples, once a user selects a particular safety application to be implemented, the configuration controller 406 retrieves associated instructions stored in memory 410 and prompts the user (e.g., via the configuration tool 134) to provide values ​​for associated parameters and other configuration settings (e.g., trip limits, trip direction, time delays, etc.). In some examples, the configuration controller 406 provides the user (e.g., via the configuration tool 134) with a list of the types of I / O signals involved in the selected safety application to allow the user to verify that the correct I / O termination modules 324 are inserted into the terminal blocks 316 of the safety trip device 110. In some examples, the user specifies the types of termination modules 324 installed in the safety trip device 110 and their locations within the different terminal blocks 316 to allow the configuration controller 406 to verify that the correct I / O termination modules 324 are being used based on the I / O signals involved in the selected application, as defined in the pre-programmed instructions. Additionally, a user may specify a location (e.g., an I / O channel) for each of the I / O termination modules 324, allowing the configuration controller 406 to properly configure their communication addresses. In some examples, the configuration controller 406 may automatically scan the I / O termination modules 324 to verify that the modules are the correct type corresponding to the I / O signals defined in the pre-programmed instructions associated with the safety application selected by the user and / or determine the particular terminal block 316 into which each I / O termination module 324 is inserted. In some examples, if an incorrect I / O termination module 324 is detected and / or an associated I / O termination module 324 is not detected, the configuration controller 406 may generate a warning or error message to notify the user of the detected error.

[0045] Once the configuration controller 406 has received all the configuration settings and communication port settings from the user, the configuration controller 406 may monitor the removal of the configuration address plug 326 from the safety trip device 110 and its replacement with a runtime address plug. Once the runtime address plug 326 is inserted, control and / or operation of the I / O scanner 304 is passed to the exemplary I / O analyzer 408. The I / O analyzer 408 implements pre-programmed instructions to control the implementation of the safety application selected by the user. That is, the I / O analyzer 408 generates field device information that is communicated to the intended field devices 116, 118, 120, 122 and also receives and processes field device information received from the field devices 116, 118, 120, 122. More specifically, the I / O analyzer 408 compares the associated I / O signals to user-configured trip limits and / or otherwise processes the I / O signals according to a logical sequence(s) of actions defined in the pre-programmed instructions to enable the associated safety application.

[0046] An example manner of implementing the I / O scanner 304 of Figure 3 is illustrated in Figure 4, although one or more of the elements, processes, and / or devices illustrated in Figure 4 may be combined, divided, rearranged, omitted, deleted, and / or implemented in any other manner. Additionally, the example external communication interface 402, the example I / O communication interface 404, the example configuration controller 406, the example I / O analyzer 408, the example memory 410, and / or, more generally, the example I / O scanner 304 of Figure 3 may be implemented by hardware, software, firmware, and / or any combination of hardware, software, and / or firmware. Thus, for example, the example communications interface 402, the example I / O communications interface 404, the example configuration controller 406, the example I / O analyzer 408, the example memory 410, and / or, more generally, the example I / O scanner 304 may be implemented by one or more analog or digital circuit(s), logic circuit(s), programmable processor(s), programmable controller(s), graphics processing unit(s) (GPU(s)), digital signal processor(s) (DSP(s)), application specific integrated circuit(s) (ASIC(s)), programmable logic device(s) (PLD(s)), and / or field programmable logic device(s) (FPLD(s)). When reading any of the apparatus or system claims of this patent covering purely software and / or firmware implementations, the exemplary communications interface 402, the exemplary I / O communications interface 404, the exemplary configuration controller 406, the exemplary I / O analyzer 408, and / or the exemplary memory 410 are hereby expressly defined to include software and / or non-transitory computer-readable storage devices or storage discs, such as memory, digital versatile discs (DVDs), compact discs (CDs), Blu-ray discs, etc., containing software.Additionally, the example I / O scanner 304 of Figure 3 may include one or more elements, processes and / or devices in addition to or instead of those shown in Figure 4 and / or may include two or more of any or all of the shown elements, processes and devices. As used herein, the phrase "in communication", including variations thereof, encompasses direct communication and / or indirect communication through one or more intermediate components and does not require direct physical (e.g., wired) communication and / or constant communication, but rather further includes selective communication at periodic intervals, scheduled intervals, aperiodic intervals, and / or one-time events.

[0047] A flow chart representing example hardware logic, machine-readable instructions, hardware-implemented state machines, and / or any combination thereof for implementing the I / O scanner 304 of FIG. 3 and / or FIG. 4 is shown in FIG. 5. The machine-readable instructions may be one or more executable programs or portions of executable programs for execution by a computer processor, such as the processor 612, shown in the example processor platform 600 described below in connection with FIG. 6. The program may be embodied in software stored on a non-transitory computer-readable storage medium, such as a CD-ROM, a floppy disk, a hard drive, a DVD, a Blu-ray disk, or a memory associated with the processor 612, although the entire program and / or portions thereof may alternatively be executed by a device other than the processor 612 and / or embodied in firmware or dedicated hardware. Additionally, although the example program is described with reference to the flow chart shown in FIG. 5, many other ways of implementing the example I / O scanner 304 may alternatively be used. For example, the order of execution of the blocks may be changed, and / or some of the described blocks may be changed, eliminated, or combined. Additionally or alternatively, any or all of the blocks may be implemented by one or more hardware circuits (e.g., discrete and / or integrated analog and / or digital circuits, FPGAs, ASICs, comparators, operational amplifiers (opamps), logic circuits, etc.) configured to perform the corresponding operations without executing software or firmware.

[0048] The machine-readable instructions described herein may be stored in one or more of a compressed, encrypted, fragmented, compiled, executable, packaged, etc. format. The machine-readable instructions described herein may be stored as data (e.g., portions of instructions, code, representations of code, etc.) that can be utilized to create, manufacture, and / or produce machine-executable instructions. For example, the machine-readable instructions may be fragmented and stored on one or more storage devices and / or computing devices (e.g., servers). The machine-readable instructions may require one or more of installation, modification, adaptation, updating, combination, supplementation, configuration, decryption, decompression, deployment, distribution, reallocation, compilation, etc. to make them directly readable, interpretable, and / or executable by the computing device and / or other machines. For example, the machine-readable instructions may be stored in multiple portions that are individually compressed, encrypted, and stored on separate computing devices, which portions, when decrypted, decompressed, and combined, form a set of executable instructions that implement a program as described herein.

[0049] In another example, machine-readable instructions may be stored in a state in which they may be read by a computer, but require the addition of libraries (e.g., dynamic link libraries (DLLs)), software development kits (SDKs), application programming interfaces (APIs), etc., to execute the instructions on a particular computing device or other device. In another example, it may be necessary to configure the machine-readable instructions (e.g., save settings, enter data, record network addresses, etc.) before the machine-readable instructions and / or corresponding program(s) can be executed in whole or in part. Thus, the disclosed machine-readable instructions and / or corresponding program(s) are intended to be discrete, regardless of the particular format or state of the machine-readable instructions and / or programs, whether stored or otherwise stored or transported.

[0050] The machine-readable instructions described herein may be expressed in any past, present, or future instruction language, scripting language, programming language, etc. For example, the machine-readable instructions may be expressed using any of the following languages: C, C++, Java, C#, Perl, Python, JavaScript, HyperText Markup Language (HTML), Structured Query Language (SQL), Swift, etc.

[0051] As mentioned above, the exemplary process of Figure 5 may be implemented using executable instructions (e.g., computer and / or machine readable instructions) stored on a non-transitory computer and / or machine readable medium, such as a hard disk drive, a flash memory, a read-only memory, a compact disk, a digital versatile disk, a cache, a random access memory, and / or any other storage device or storage disk in which information is stored for any duration (e.g., long term, permanently, short term, during temporary buffering, and / or during caching of information). As used herein, the term "non-transitory computer readable medium" is expressly defined to include any type of computer readable storage device and / or storage disk, to exclude propagating signals, and to exclude transmission media.

[0052] "Comprises" and "comprises" (and all forms and tenses thereof) are used herein as open-ended terms. Thus, when a claim uses any form of "comprises" or "comprises" as a preamble or in any type of claim description (e.g., comprises, includes, comprising, including, having, etc.), it should be understood that additional elements, terms, etc. may be present without departing from the scope of the corresponding claim or description. As used herein, the phrase "at least," when used as a transitional term, for example, in a claim preamble, is open-ended in the same manner that the terms "comprises" and "comprises" are open-ended. For example, the term "and / or" when used in the form A, B, and / or C, etc., refers to any combination or subset of A, B, C, such as (1) A only, (2) B only, (3) C only, (4) A and B, (5) A and C, (6) B and C, and (7) A, B, and C. As used herein in the context of describing a structure, component, item, object, and / or thing, the phrase "at least one of A and B" is intended to refer to an implementation that includes any of (1) at least one A, (2) at least one B, and (3) at least one A and at least one B. Similarly, as used herein in the context of describing a structure, component, item, object, and / or thing, the phrase "at least one of A or B" is intended to refer to an implementation that includes any of (1) at least one A, (2) at least one B, and (3) at least one A and at least one B. As used herein in the context of describing the implementation or execution of a process, instruction, action, activity, and / or step, the phrase "at least one of A and B" is intended to refer to an implementation that includes any of (1) at least one A, (2) at least one B, and (3) at least one A and at least one B.Similarly, as used herein in the context of describing the implementation or performance of a process, instruction, action, activity, and / or step, the phrase “at least one of A or B” is intended to refer to implementations that include any of: (1) at least one A; (2) at least one B; and (3) at least one A and at least one B.

[0053] As used herein, singular references (e.g., "a," "an," "first," "second," etc.) do not exclude a plurality. As used herein, the term "a" or "an" entity refers to one or more of that entity. The terms "a" (or "an"), "one or more," and "at least one" may be used interchangeably herein. Furthermore, multiple means, elements, or method actions, although individually listed, may be implemented by, for example, a single unit or processor. Furthermore, although individual features may be included in different examples or claims, these may in some cases be combined, and inclusion in different examples or claims does not imply that a combination of features is not feasible and / or advantageous.

[0054] 5 begins at block 502, where the example configuration controller 406 determines whether the I / O scanner 304 is communicatively coupled to the configuration tool 134. If so, control proceeds to block 504, where the example external communication interface 402 determines whether a request to modify a current safety application has been received. If so, control proceeds to block 506, where the example configuration controller 406 determines whether a configuration address plug 326 is present in the safety trip device 110. If so, control proceeds to block 508, where the example configuration controller 406 provides available safety applications to the user for selection. Upon receiving a user selection, at block 510, the example configuration controller 406 determines whether the selected safety application is already installed on the I / O scanner 304. If not, control proceeds to block 512, where the example configuration controller 406 prompts the user to download and install the selected safety application. In some examples, a user may download a safety application individually without being prompted to do so (e.g., before beginning the process for setting up a particular safety application. In some such examples, a user may simply indicate that the user wants to install a new safety application in the I / O scanner 304.

[0055] Once the application is installed, control proceeds to block 514. Returning to block 510, if the selected safety application is already installed, control proceeds directly to block 514. At block 514, the example configuration controller 406 prompts the user to specify values ​​for configuration settings associated with the selected safety application. At block 516, the example configuration controller 406 prompts the user to specify communication port settings associated with the selected safety application. Control then proceeds to block 518.

[0056] Returning to block 502, if the I / O scanner 304 is not communicatively coupled to the configuration tool 134, control proceeds directly to block 518. Similarly, returning to block 504, if the external communication interface 402 has not received a request to modify the current safety application, control proceeds directly to block 518. Similarly, returning to block 506, if the example configuration controller 406 determines that the configuration address plug 326 is not present (e.g., a runtime address plug is in the safety trip device 110), control proceeds directly to block 518. At block 518, the example IO analyzer 408 determines whether to implement the safety application. In some examples, this determination is made based on feedback from a user indicating that configuration of the application is complete and / or that the user desires to implement the application after proceeding to blocks 508-516. This determination may additionally or alternatively be made based on a status of the system, considering that blocks 508-516 are skipped based on a determination in any one of blocks 502-506. If a safety application is not implemented, control proceeds to block 524. If a safety application is implemented, control proceeds to block 520 where the example configuration controller 406 again determines whether a configuration address plug 326 is present in the safety trip device 110. This determination was made in block 506 to prevent unintentional changes to the selection and / or configuration of a safety application, but this same determination is made in block 520 to prevent unintentional implementation of a currently selected and configured safety application. If the configuration address plug 326 is present, a safety application is not implemented and control proceeds to block 524. If the configuration address plug 326 is not present (e.g., if a runtime address plug is in the safety trip device 110), control proceeds to block 522 where the example I / O analyzer 408 executes instructions associated with the safety application. Control then proceeds to block 504 where it is determined whether to continue the process.If so, control returns to block 502. Otherwise, the example process of Figure 5 ends.

[0057] Figure 6 is a block diagram of an exemplary processor platform 600 configured to execute the instructions of Figure 5 to implement the I / O scanner 304 of Figure 3 and / or Figure 4. The processor platform 600 may be, for example, a server, a personal computer, a workstation, a self-learning machine (e.g., neural networks), a mobile device (e.g., a mobile phone, a smartphone, a tablet such as an iPad®), or any other type of computing device.

[0058] The processor platform 600 of the illustrated example includes a processor 612. The processor 612 of the illustrated example is hardware. For example, the processor 612 may be implemented by one or more integrated circuits, logic circuits, microprocessors, GPUs, DSPs, or controllers from any desired family or manufacturer. A hardware processor may be a semiconductor-based (e.g., silicon-based) device. In this example, the processor implements the example configuration controller 406 and the example I / O analyzer 408.

[0059] The processor 612 of the illustrated example includes a local memory 613 (e.g., a cache). The processor 612 of the illustrated example is in communication with a main memory, including a volatile memory 614 and a non-volatile memory 616, via a bus 618. The volatile memory 614 may be implemented by Synchronous Dynamic Random Access Memory (SDRAM), Dynamic Random Access Memory (DRAM), RAMBUS® Dynamic Random Access Memory (RDRAM®), and / or any other type of random access memory device. The non-volatile memory 616 may be implemented by flash memory and / or any other desired type of memory device. Access to the main memory 614, 616 is controlled by a memory controller. In this example, the non-volatile memory 616 includes memory 410.

[0060] The processor platform 600 of the depicted example also includes an interface circuit 620. The interface circuit 620 may be implemented with any type of interface standard, such as an Ethernet interface, a Universal Serial Bus (USB), a Bluetooth interface, a Near Field Communication (NFC) interface, and / or a PCI Express interface.

[0061] In the illustrated example, one or more input devices 622 are connected to the interface circuitry 620. The input device(s) 622 allow a user to input data and / or commands to the processor 612. The input device(s) may be implemented, for example, by an audio sensor, a microphone, a (still or video) camera, a keyboard, buttons, a mouse, a touch screen, a track pad, a track ball, an isopoint device, and / or a voice recognition system.

[0062] One or more output devices 624 are also connected to the interface circuitry 620 of the illustrated example. The output device(s) 624 may be implemented by, for example, a display device (e.g., a light emitting diode (LED), an organic light emitting diode (OLED), a liquid crystal display (LCD), a cathode ray tube display (CRT), an in-place switching (IPS) display, a touch screen, etc.), a tactile output device, a printer, and / or a speaker, etc. Thus, the interface circuitry 620 of the illustrated example typically includes a graphics driver card, a graphics driver chip, and / or a graphics driver processor.

[0063] The interface circuitry 620 of the illustrated example also includes communications devices such as a transmitter, receiver, transceiver, modem, home gateway, wireless access point, and / or network interface to facilitate data exchange with external machines (e.g., any type of computing device) over the network 626. Communications may be via, for example, an Ethernet connection, a digital subscriber line (DSL) connection, a telephone line connection, a coaxial cable system, a satellite system, a site wireless system, a cellular phone system, etc. In this example, the interface circuitry 620 implements an exemplary external communications interface 402 and an exemplary I / O communications interface 404.

[0064] The processor platform 600 of the illustrated example also includes one or more mass storage devices 628 for storing software and / or data. Examples of such mass storage devices 628 include floppy disk drives, hard drive disks, compact disk drives, Blu-ray disk drives, redundant array of independent disks (RAID) systems, and digital versatile disk (DVD) drives. In this example, the mass storage device 628 includes the memory 410.

[0065] The machine-executable instructions 632 of FIG. 5 may be stored on the mass storage device 628, the volatile memory 614, the non-volatile memory 616, and / or a removable non-transitory computer-readable storage medium such as a CD or DVD.

[0066] From the above, it will be appreciated that exemplary methods, apparatus, and products have been disclosed that allow for the setup and configuration of safety trip devices with much less time and effort than is required to use existing fully programmable logic solvers, since the examples disclosed herein provide users with the ability to select pre-programmed instructions that correspond to a particular safety application. Such pre-programmed instructions may be certified by relevant safety compliance authorities, thereby giving end users greater confidence in the reliability of such safety applications and / or reducing the complexity and cost of developing their own applications and seeking their own certification for such applications. Furthermore, some exemplary safety trip devices may be configured and set up only when a configuration module is inserted, and may be implemented only after the configuration module is removed, thereby providing greater security than existing fully programmable logic solvers that are prone to tampering. While the examples disclosed herein provide a much easier end user experience based on pre-programmed instructions, the exemplary safety trip devices disclosed herein may also provide much more flexibility than other dedicated safety trip devices and / or safety relays, since they may store multiple different sets of instructions associated with different types of safety applications. This flexibility is made possible by implementing the exemplary safety trip device with selectively removable termination modules capable of handling different types of I / O signals, such that any particular safety application can be implemented simply by inserting the appropriate termination module that corresponds to the I / O signals involved in the particular safety application of interest.

[0067] Example 1 includes an apparatus comprising: a configuration controller for providing a plurality of available safety applications to a user for selection by a safety trip device associated with a process control system, where a first one of the safety applications is associated with a first set of I / O signals and a second one of the safety applications is associated with a second set of I / O signals, the first set of I / O signals being different from the second set of I / O signals, the first safety application being implemented based on first preprogrammed instructions stored in a memory of the safety trip device and the second safety application being implemented based on second preprogrammed instructions stored in a memory of the safety trip device; and in response to a user selection of the first safety application, prompting a user to specify values ​​for configuration settings associated with the first safety application, the first preprogrammed instructions defining the configuration settings; and an I / O analyzer for implementing the first safety application based on the values ​​for the configuration settings specified by the user and based on the first preprogrammed instructions.

[0068] Example 2 includes the apparatus of example 1, wherein the first set of I / O signals corresponds to a first I / O number and the second set of I / O signals corresponds to a second I / O number, the first I / O number being different from the second I / O number.

[0069] Example 3 includes the apparatus of example 1, wherein the first set of I / O signals corresponds to a first subset of I / O signals of different types, the second set of I / O signals corresponds to a second subset of I / O signals of different types, and the first subset of I / O signals of different types is different from the second subset of I / O signals of different types.

[0070] Example 4 includes the apparatus of Example 3, wherein a first set of I / O signals is communicated between a processor of the safety trip device and the field device via a first set of termination modules carried by a housing of the safety trip device, the first set of termination modules including different types of termination modules corresponding to a first subset of the different types of I / O signals.

[0071] Example 5 includes the apparatus of Example 4, wherein some of the first set of termination modules are selectively interchangeable within the housing with some of the second set of termination modules, the second set of termination modules including different types of termination modules corresponding to a second subset of different types of I / O signals.

[0072] Example 6 includes the device of example 1, wherein the plurality of available safety applications includes a first set of applications stored in the memory and a second set of downloadable applications.

[0073] Example 7 includes the apparatus of example 1, where some of the plurality of available safety applications are certified by a safety compliance authority before being offered to a user for selection.

[0074] Example 8 includes the apparatus of Example 1, wherein the configuration controller, in response to the configuration address plug being inserted into a slot in the housing of the safety trip device, provides a plurality of available safety applications to a user for selection and enables the user to specify a value for a configuration setting associated with a first safety application, and, in response to the runtime address plug being inserted into the slot in the housing of the safety trip device, prevents the user from changing the configuration settings or switching from the first safety application to a second safety application.

[0075] Example 9 is a non-transitory computer-readable medium comprising instructions that, when executed, cause a safety trip device to provide a plurality of available safety applications for implementation by the safety trip device associated with at least a process control system to a user for selection, wherein a first safety application of the safety applications is associated with a first set of I / O signals and a second safety application of the safety applications is associated with a second set of I / O signals, the first set of I / O signals being different from the second set of I / O signals, and the first safety application is associated with a first set of I / O signals stored in a memory of the safety trip device. The present invention includes a non-transitory computer-readable medium that causes: providing, in response to a user selection of the first safety application, a second safety application implemented based on first pre-programmed instructions, and a second safety application implemented based on second pre-programmed instructions stored in a memory of the safety trip device; prompting a user to specify values ​​for configuration settings associated with the first safety application, the first pre-programmed instructions defining the configuration settings; and implementing the first safety application based on the values ​​for the configuration settings specified by the user and based on the first pre-programmed instructions.

[0076] Example 10 includes the non-transitory computer-readable medium of example 9, wherein the first set of I / O signals corresponds to a first I / O number and the second set of I / O signals corresponds to a second I / O number, the first I / O number being different from the second I / O number.

[0077] Example 11 includes the non-transitory computer-readable medium of Example 9, wherein the first set of I / O signals corresponds to a first subset of I / O signals of different types, the second set of I / O signals corresponds to a second subset of I / O signals of different types, and the first subset of I / O signals of different types is different from the second subset of I / O signals of different types.

[0078] Example 12 includes the non-transitory computer-readable medium of Example 11, wherein the first set of I / O signals is communicated between a processor of the safety trip device and the field device via a first set of termination modules carried by a housing of the safety trip device, the first set of termination modules including different types of termination modules corresponding to a first subset of the different types of I / O signals.

[0079] Example 13 includes the non-transitory computer-readable medium of Example 12, wherein some of the first set of termination modules are selectively interchangeable within the housing with some of the second set of termination modules, the second set of termination modules including different types of termination modules corresponding to a second subset of the different types of I / O signals.

[0080] Example 14 includes the non-transitory computer-readable medium of example 9, wherein the plurality of available safety applications includes a first set of applications stored in the memory and a second set of downloadable applications.

[0081] Example 15 includes the non-transitory computer-readable medium of example 9, wherein some of the plurality of available safety applications are certified by a safety compliance authority before being offered to a user for selection.

[0082] Example 16 includes the non-transitory computer-readable medium of Example 9, where the instructions further cause the safety trip device to, in response to the configuration address plug being inserted into a slot in the housing of the safety trip device, provide a plurality of available safety applications to a user for selection and allow the user to specify a value for a configuration setting associated with a first safety application, and in response to the runtime address plug being inserted into the slot in the housing of the safety trip device, prevent the user from changing the configuration settings or switching from the first safety application to a second safety application.

[0083] Example 17 includes a method comprising: providing a plurality of available safety applications for implementation by a safety trip device associated with a process control system to a user for selection, where a first safety application of the safety applications is associated with a first set of I / O signals and a second safety application of the safety applications is associated with a second set of I / O signals, the first set of I / O signals being different from the second set of I / O signals, the first safety application being implemented based on first preprogrammed instructions stored in a memory of the safety trip device and the second safety application being implemented based on second preprogrammed instructions stored in a memory of the safety trip device; in response to a user selection of the first safety application, prompting the user to specify values ​​for configuration settings associated with the first safety application, the first preprogrammed instructions defining the configuration settings; and implementing the first safety application based on the values ​​for the configuration settings specified by the user and based on the first preprogrammed instructions.

[0084] Example 18 includes the method of example 17, wherein the first set of I / O signals corresponds to a first I / O number and the second set of I / O signals corresponds to a second I / O number, the first I / O number being different from the second I / O number.

[0085] Example 19 includes the method of example 17, wherein the first set of I / O signals corresponds to a first subset of I / O signals of different types, the second set of I / O signals corresponds to a second subset of I / O signals of different types, and the first subset of I / O signals of different types is different from the second subset of I / O signals of different types.

[0086] Example 20 includes the method of example 19, wherein a first set of I / O signals is communicated between a processor of the safety trip device and the field device via a first set of termination modules carried by a housing of the safety trip device, the first set of termination modules including different types of termination modules corresponding to a first subset of the different types of I / O signals.

[0087] Example 21 includes the method of Example 20, wherein some of the first set of termination modules are selectively interchangeable within the housing with some of the second set of termination modules, the second set of termination modules including different types of termination modules corresponding to a second subset of the different types of I / O signals.

[0088] Example 22 includes the method of example 17, wherein the plurality of available safety applications includes a first set of applications stored in the memory and a second set of downloadable applications.

[0089] Example 23 includes the method of example 17, wherein some of the plurality of available safety applications are certified by a safety compliance authority before being offered to the user for selection.

[0090] Example 24 includes the method of Example 17, and further includes, in response to the configuration address plug being inserted into a slot of the housing of the safety trip device, providing a plurality of available safety applications to a user for selection and allowing the user to specify a value for a configuration setting associated with a first safety application, and in response to the runtime address plug being inserted into the slot of the housing of the safety trip device, preventing the user from changing the configuration settings or switching from the first safety application to a second safety application.

[0091] Example 25 includes a safety trip device comprising: a housing including a backplane; a terminal block including respective slots, the slots receiving a first set of termination modules to communicate with a first set of field devices associated with a first safety application associated with the process control system and the slots receiving a second set of termination modules to communicate with a second set of field devices associated with a second safety application associated with the process control system; and an I / O scanner for communicating with the termination modules in the slots of the terminal block via the backplane, the I / O scanner including a memory for storing first pre-programmed instructions defining the operation of the first safety application and for storing second pre-programmed instructions defining the operation of the second safety application.

[0092] Although certain exemplary systems, methods, apparatus, and articles of manufacture have been disclosed herein, the scope of coverage of this patent is not limited thereto. Rather, this patent covers all systems, methods, apparatus, and articles of manufacture that fall fairly within the scope of the claims of this patent.

[0093] The following claims are hereby incorporated by reference into this Detailed Description, with each claim standing on its own as a separate embodiment of this disclosure.

Claims

1. A configuration controller, providing, in response to insertion of a configuration address plug into a slot of a housing of a safety trip device associated with a process control system, a plurality of available safety applications for implementation by the safety trip device, for selection by a user, where a first safety application of the safety applications uses a first set of I / O signals and a second safety application of the safety applications uses a second set of I / O signals, the first set of I / O signals being different from the second set of I / O signals, the first safety application being implemented based on first pre-programmed instructions stored in a memory of the safety trip device, and the second safety application being implemented based on second pre-programmed instructions stored in the memory of the safety trip device; a configuration controller for prompting, in response to a user selection of the first safety application, the user to specify values ​​for configuration settings associated with the first safety application, the first pre-programmed instructions defining the configuration settings; an I / O analyzer for implementing the first safety application based on values ​​for the configuration settings specified by the user and based on the first pre-programmed instructions.

2. 2. The apparatus of claim 1 , wherein the first set of I / O signals corresponds to a first I / O number and the second set of I / O signals corresponds to a second I / O number, the first I / O number being different from the second I / O number.

3. 3. The apparatus of claim 1 or claim 2, wherein the first set of I / O signals corresponds to a first subset of I / O signals of a different type and the second set of I / O signals corresponds to a second subset of I / O signals of the different type, the first subset of I / O signals of the different type being different from the second subset of I / O signals of the different type.

4. 4. The apparatus of claim 3, wherein the first set of I / O signals are communicated between the processor of the safety trip device and a field device via a first set of termination modules carried by a housing of the safety trip device, the first set of termination modules including different types of termination modules corresponding to the first subset of the different types of I / O signals.

5. 5. The apparatus of claim 4, wherein some of the first set of termination modules are selectively interchangeable within the housing with some of a second set of termination modules, the second set of termination modules including different types of termination modules corresponding to the second subset of the different types of I / O signals.

6. 6. The apparatus of claim 1, wherein the plurality of available safety applications includes a first set of applications stored in the memory and a second set of downloadable applications.

7. 7. The apparatus of claim 1, wherein some of the plurality of available safety applications are certified by a safety compliance authority before being offered to the user for selection.

8. The configuration controller: enabling the user to specify values ​​for configuration settings associated with the first safety application in response to the configuration address plug being inserted into the slot of the housing of the safety trip device; The apparatus of any one of claims 1 to 7, further comprising: if another type of address plug that is in a configuration mode for implementing but not modifying the safety application is defined as a runtime address plug, the apparatus prevents the user from changing the configuration settings or switching from the first safety application to the second safety application in response to the runtime address plug being inserted into the slot of the housing of the safety trip device.

9. 1. A non-transitory computer-readable medium comprising instructions that, when executed, cause a safety trip device associated with a process control system to: providing, in response to insertion of the configuration address plug into a slot in a housing of the safety trip device, a plurality of available safety applications for implementation by the safety trip device, for selection by a user, where a first safety application of the safety applications uses a first set of I / O signals and a second safety application of the safety applications uses a second set of I / O signals, the first set of I / O signals being different from the second set of I / O signals, the first safety application being implemented based on first pre-programmed instructions stored in a memory of the safety trip device, and the second safety application being implemented based on second pre-programmed instructions stored in the memory of the safety trip device; in response to a user selection of the first safety application, prompting the user to specify values ​​for configuration settings associated with the first safety application, the first pre-programmed instructions defining the configuration settings; and implementing the first safety application based on values ​​for the configuration settings specified by the user and based on the first pre-programmed instructions.

10. 10. The non-transitory computer-readable medium of claim 9, wherein the first set of I / O signals corresponds to a first I / O number and the second set of I / O signals corresponds to a second I / O number, the first I / O number being different from the second I / O number.

11. 11. The non-transitory computer-readable medium of claim 9 or 10, wherein the first set of I / O signals corresponds to a first subset of I / O signals of a different type and the second set of I / O signals corresponds to a second subset of I / O signals of a different type, the first subset of I / O signals of a different type being different from the second subset of I / O signals of the different type.

12. 12. The non-transitory computer-readable medium of claim 11, wherein the first set of I / O signals are communicated between a processor of the safety trip device and a field device via a first set of termination modules carried by a housing of the safety trip device, the first set of termination modules including different types of termination modules corresponding to the first subset of the different types of I / O signals.

13. 13. The non-transitory computer-readable medium of claim 12, wherein some of the first set of termination modules are selectively interchangeable within the housing with some of a second set of termination modules, the second set of termination modules including different types of termination modules corresponding to the second subset of the different types of I / O signals.

14. 14. The non-transitory computer-readable medium of claim 9, wherein the plurality of available safety applications includes a first set of applications stored in the memory and a second set of downloadable applications.

15. 15. The non-transitory computer-readable medium of claim 9, wherein some of the plurality of available safety applications are certified by a safety compliance authority before being offered to the user for selection.

16. The instructions to the safety trip device include: enabling the user to specify values ​​for configuration settings associated with the first safety application in response to the configuration address plug being inserted into the slot of the housing of the safety trip device; A non-transitory computer-readable medium as described in any of claims 9 to 15, wherein if another type of address plug that is in a configuration mode for implementing but not modifying the safety application is defined as a runtime address plug, in response to the runtime address plug being inserted into the slot of the housing of the safety trip device, the user is prevented from changing the configuration settings or switching from the first safety application to the second safety application.

17. Where a configuration address plug is defined as a type of address plug that places a safety application in a configuration mode for modifying but not implementing the safety application, in response to the configuration address plug being inserted into a slot in a housing of a safety trip device associated with a process control system, providing a user with a plurality of available safety applications for implementation by the safety trip device for selection, wherein a first safety application among the safety applications uses a first set of I / O signals and a second safety application among the safety applications uses a second set of I / O signals, the first set of I / O signals being different from the second set of I / O signals, the first safety application being implemented based on first pre-programmed instructions stored in a memory of the safety trip device, and the second safety application being implemented based on second pre-programmed instructions stored in the memory of the safety trip device; in response to a user selection of the first safety application, prompting the user to specify values ​​for configuration settings associated with the first safety application, the first pre-programmed instructions defining the configuration settings; and implementing the first safety application based on values ​​for the configuration settings specified by the user and based on the first pre-programmed instructions.

18. 20. The method of claim 17, wherein the first set of I / O signals corresponds to a first I / O count and the second set of I / O signals corresponds to a second I / O count, the first I / O count being different from the second I / O count.

19. 19. The method of claim 17 or 18, wherein the first set of I / O signals corresponds to a first subset of I / O signals of a different type and the second set of I / O signals corresponds to a second subset of I / O signals of a different type, the first subset of I / O signals of a different type being different from the second subset of I / O signals of the different type.

20. 20. The method of claim 19, wherein the first set of I / O signals are communicated between the processor of the safety trip device and a field device via a first set of termination modules carried by a housing of the safety trip device, the first set of termination modules including different types of termination modules corresponding to the first subset of the different types of I / O signals.

21. 21. The method of claim 20, wherein some of the first set of termination modules are selectively interchangeable within the housing with some of a second set of termination modules, the second set of termination modules including different types of termination modules corresponding to the second subset of the different types of I / O signals.

22. 22. The method of any of claims 17 to 21, wherein the plurality of available safety applications includes a first set of applications stored in the memory and a second set of downloadable applications.

23. 23. The method of any of claims 17 to 22, wherein some of the plurality of available safety applications are certified by a safety compliance authority before being offered to the user for selection.

24. enabling the user to specify values ​​for configuration settings associated with the first safety application in response to the configuration address plug being inserted into the slot of the housing of the safety trip device; The method of any of claims 17 to 23, further comprising: if another type of address plug that is in a configuration mode for implementing but not modifying the safety application is defined as a runtime address plug, preventing the user from changing the configuration settings or switching from the first safety application to the second safety application in response to the runtime address plug being inserted into the slot of the housing of the safety trip device.

Images