US5428769A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Process control interface system having triply redundant remote field units
Assignee: Dow Chemical Co
•
Filing: 1992-03-31
•
Granted: 1995-06-27
•
Expires: 2012-03-31
Abstract
Abstract A process control interface system having a network of distributed triply redundant input/output field computer units. The system includes a plurality of self-contained remotely located triply redundant field computer units connected to decision making redundant process control computers through a bi-directional communication network having at least two concurrently active communication channels. Each of the field computer units include a set of at least redundant field computers for arbitrating both input and output signals. The input arbitration method enables a plurality of selectable default input conditions, such as select HIGH and select LOW, in the event that a majority agreement cannot be reached among valid input signals. The output arbitration method includes a plurality of selectable default output conditions, such as fail SAFE and fail LAST. Each of the default input and output conditions may be rapidly adjusted through software selection. The field computer units also include individual abort circuits for each output signal to be transmitted to a device which affects the operation of the physical process. These abort circuits effectively enforce the output value signals arbitrated independently through each of the three redundant field computers using a voting procedure.
Inventors
- 👤 Robert S. Glaser
- 👤 Robert S. Hoy
- 👤 G. Paul Fernandez
- 👤 Timothy J. Grai
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-05 20:57
CPC Classifications
G; G05; G05B; G05B23/00; G05B23/02; G05B19/00; G05B19/02; G05B19/04; G05B19/042; G05B19/0423; G05B19/0425; G05B9/00; G05B9/02; G05B9/03; G05B2219/00; G05B2219/10; G05B2219/14; G05B2219/14123; G05B2219/20; G05B2219/24; G05B2219/24184; G05B2219/24187; G05B2219/24189; G05B2219/24192; G05B2219/25; G05B2219/25428
Claims Analysis
Total Claims: 42
Claim 1
Independent Claim
202 words
In a process control system having process computer means for making process control decisions which affect a physical process, a distributed interface system, comprising: a plurality of self-contained remotely located triply redundant computer units connected to said computer means through a communication network having at least two active bi-directional communication channels, each of said triply redundant computer units including means for receiving raw analog and digital input signals from sensors associated with said physical process, means for arbitrating each of said input signals. means for transmitting said arbitrated input signals to said process computer means via said network, means for receiving output value signals from said process computer means, means for providing independent triply redundant arbitration of said output value signals received from said process computer means, and means for processing each of said triply redundantly arbitrated output value signals through a set of individual abort circuits which are connected to a device associated with said physical process, such that each of the outputs from the set of abort circuits for a particular arbitrated output value signal are coupled together to provide a common output to a device associated with said physical process and allowed to drive said device unless specifically inhibited.
Claim 2
Dependent Claim
202 words
In a process control system having process computer means for making process control decisions which affect a physical process, a distributed interface system, comprising: a plurality of self-contained remotely located triply redundant computer units connected to said computer means through a communication network having at least two active bi-directional communication channels, each of said triply redundant computer units including means for receiving raw analog and digital input signals from sensors associated with said physical process, means for arbitrating each of said input signals. means for transmitting said arbitrated input signals to said process computer means via said network, means for receiving output value signals from said process computer means, means for providing independent triply redundant arbitration of said output value signals received from said process computer means, and means for processing each of said triply redundantly arbitrated output value signals through a set of individual abort circuits which are connected to a device associated with said physical process, such that each of the outputs from the set of abort circuits for a particular arbitrated output value signal are coupled together to provide a common output to a device associated with said physical process and allowed to drive said device unless specifically inhibited.
Claim 3
Dependent Claim
25 words
The invention according to claim 1, wherein said means for providing arbitration of said output value signals includes a plurality of software selectable default conditions.
Claim 4
Dependent Claim
34 words
The invention according to claim 1, wherein said network includes controller means for individually changing a direction of communication signal flow on at least one signal distribution level over each of said communication channels.
Claim 5
Dependent Claim
34 words
The invention according to claim 3, wherein said network includes a plurality of interconnected breakout circuits for directing bi-directional serial communications between said process computer means and each of said triply redundant computer units.
Claim 6
Dependent Claim
77 words
The invention according to claim 4, wherein a first of said breakout circuits is connected to said process computer means to direct communication from said process computer means to predetermined groups of said triply redundant computer units, and a plurality of second breakout circuits are connected to said first breakout circuit to direct communication to specific triply redundant computer units, each of said second breakout circuits being connected to a plurality of said triply redundant computer units.
Claim 7
Dependent Claim
30 words
The invention according to claim 5, wherein each of said breakout circuits includes means for enabling any of said breakout circuits to be configured as first or second breakout circuits.
Claim 8
Dependent Claim
30 words
The invention according to claim 6, wherein each of said breakout circuits includes means for enabling any of said breakout circuits to repeat received signals at a predetermined signal strength.
Claim 9
Dependent Claim
34 words
The invention according to claim 1, wherein said network includes means for broadcast downloading of updated software from said process computer means to a plurality of said triply redundant computer means through said network.
Claim 10
Dependent Claim
34 words
The invention according to claim 3, wherein each of said communication channels forms a physical fiber optic ring connected to said process computer means on a first level of signal distribution for said network.
Claim 11
Dependent Claim
170 words
In a field computer unit, a set of at least three redundant computers, means associated with said redundant computers for receiving and independently arbitrating analog and digital signals for each input and output channel of said field computer unit, and means for processing said independently arbitrated output signals from each of said redundant computers through a set of output circuits associated with each of said output channels, each output circuits associated with each of said output channels, each of said output circuits having abort means for preventing the transmission of a field output value signal from one of said redundant computers to a process control device connected to said output circuits, wherein each of said redundant computers transmits an output signal value to one of said abort circuits in said set of abort circuits for each of said output channels, and each of said redundant computers also transmits a individual abort signal value to any remaining abort circuits in said set of abort circuits for each of said output channels.
Claim 12
Dependent Claim
170 words
In a field computer unit, a set of at least three redundant computers, means associated with said redundant computers for receiving and independently arbitrating analog and digital signals for each input and output channel of said field computer unit, and means for processing said independently arbitrated output signals from each of said redundant computers through a set of output circuits associated with each of said output channels, each output circuits associated with each of said output channels, each of said output circuits having abort means for preventing the transmission of a field output value signal from one of said redundant computers to a process control device connected to said output circuits, wherein each of said redundant computers transmits an output signal value to one of said abort circuits in said set of abort circuits for each of said output channels, and each of said redundant computers also transmits a individual abort signal value to any remaining abort circuits in said set of abort circuits for each of said output channels.
Claim 13
Dependent Claim
37 words
The invention according to claim 10, including dedicated neighbor to neighbor communication means between each of said redundant computers for enabling any two of said redundant computers to hold the remaining redundant computer in a reset condition.
Claim 14
Dependent Claim
58 words
The invention according to claim 10, wherein each of said redundant computers includes a computer processor and serial input circuit means for enabling said computer processor to receive serial input signals from a plurality of analog and digital signal sources over a single conductor, including individual neighbor communication signals from each of the other of said redundant computers.
Claim 15
Dependent Claim
58 words
The invention according to claim 10, wherein each of said output circuits includes an individual abort circuit for each of said output channels, output conductors for each of said individual abort circuits for a particular output channel being connected together so that a set of at least three individual abort circuits are provided for each process control device.
Claim 16
Dependent Claim
21 words
The invention according to claim 10, wherein said arbitration means includes a plurality of software selectable default input and output conditions.
Claim 17
Dependent Claim
70 words
The invention according to claim 10, further including at least one analog output circuit interposed between each of said redundant computers and one of said abort circuits, each of said analog output circuits having self-regulating means for causing an arbitrated analog output signal to reach a desired output level commanded by the redundant computer for said analog output circuit in a manner which is independently determined by said self-regulating means.
Claim 18
Dependent Claim
67 words
The invention according to claim 10, further including at least one analog input circuit for each of said redundant computers, each of said analog input circuits having selectable mode means for reporting a plurality of different input pulse signals over a predetermined time period, said selectable mode means including a first mode for reporting a pulse count and a second mode for reporting an average frequency value.
Claim 19
Dependent Claim
27 words
The invention according to claim 10, wherein each of said output circuits includes means for permitting said redundant computers to perform non-intrusive testing of said output circuits.
Claim 20
Independent Claim
201 words
A method of controlling an analog device from a field computer system having at least three redundant computers, comprising the steps of: providing an analog output circuit for each of said redundant computers whose output signals are coupled to a common control input of said analog device; independently determining at each of said analog output circuits whether a summed output of said analog output circuits sent to said analog device deviates from an analog level of their control input to said analog device by a predetermined limit; any of said analog output circuits finding such a deviation independently forcing their analog outputs to a level which does not enable it to contribute to the analog level supplied to the control input to said analog device; determining if more than one of said analog output circuits have forced their analog output signals to said non-contribution level; and if more than one of said analog output circuits have forced their analog output signals to said non-contribution level, then restoring the analog output signals of such analog output circuits to the level commanded by their respective redundant computers, and forcing the analog output signal of a remaining analog output circuit to said non-contribution level.
Claim 21
Independent Claim
201 words
A method of controlling an analog device from a field computer system having at least three redundant computers, comprising the steps of: providing an analog output circuit for each of said redundant computers whose output signals are coupled to a common control input of said analog device; independently determining at each of said analog output circuits whether a summed output of said analog output circuits sent to said analog device deviates from an analog level of their control input to said analog device by a predetermined limit; any of said analog output circuits finding such a deviation independently forcing their analog outputs to a level which does not enable it to contribute to the analog level supplied to the control input to said analog device; determining if more than one of said analog output circuits have forced their analog output signals to said non-contribution level; and if more than one of said analog output circuits have forced their analog output signals to said non-contribution level, then restoring the analog output signals of such analog output circuits to the level commanded by their respective redundant computers, and forcing the analog output signal of a remaining analog output circuit to said non-contribution level.
Claim 22
Dependent Claim
16 words
The invention according to claim 18, wherein said non-contribution level is a substantially zero output level.
Claim 23
Dependent Claim
33 words
The invention according to claim 18, wherein each of said analog output circuits independently makes said determination of whether it is generating an analog output signal whose level deviates beyond said predetermined limit.
Claim 24
Dependent Claim
83 words
The method according to claim 20, wherein each of said analog output circuits periodically performs a non-intrusive testing procedure which includes the step of: forcing its analog output to at least one testing level which does not enable the analog output circuit to materially contribute to the analog level of the control input to said analog device; determining if its analog output signal has achieved said testing level; and restoring its analog output signal back to the level commanded by its redundant computer.
Claim 25
Independent Claim
201 words
A method of controlling a physical process with substantial tolerance to faults, comprising the steps of: receiving a plurality of raw analog and digital signal inputs from sensors associated with said physical process at a field unit, said field unit having a set of at least three redundant field computers for converting at least some of raw said input signals into arbitrated input value signals at predetermined times, concurrently transmitting at least some of said arbitrated input value signals to a set of redundant process computers over a plurality of bi-directional communication channels, concurrently transmitting output value signals from at least two of said redundant process computers to said field unit over said plurality of communication channels, independently arbitrating said output value signals at each of said redundant field computers such that each of said redundant field computers generates an individual arbitrated output signal for each of said output value signals received by said field unit, processing said arbitrated output signals through an output enforcement arrangement which allows each of said arbitrated output signals to drive a common process control device unless the transmission of at least one of said arbitrated output signals to said process control device is specifically inhibited.
Claim 26
Independent Claim
201 words
A method of controlling a physical process with substantial tolerance to faults, comprising the steps of: receiving a plurality of raw analog and digital signal inputs from sensors associated with said physical process at a field unit, said field unit having a set of at least three redundant field computers for converting at least some of raw said input signals into arbitrated input value signals at predetermined times, concurrently transmitting at least some of said arbitrated input value signals to a set of redundant process computers over a plurality of bi-directional communication channels, concurrently transmitting output value signals from at least two of said redundant process computers to said field unit over said plurality of communication channels, independently arbitrating said output value signals at each of said redundant field computers such that each of said redundant field computers generates an individual arbitrated output signal for each of said output value signals received by said field unit, processing said arbitrated output signals through an output enforcement arrangement which allows each of said arbitrated output signals to drive a common process control device unless the transmission of at least one of said arbitrated output signals to said process control device is specifically inhibited.
Claim 27
Dependent Claim
70 words
The method according to claim 22, wherein each of said redundant field computers includes an analog output circuit which compares its arbitrated analog output signals with the analog output signals actually transmitted to each process control device, and if a deviation beyond a predetermined limit is detected by one of said analog output circuits, then said analog output circuit will force its arbitrated analog output signal to a non-contribution level.
Claim 28
Dependent Claim
32 words
The method according to claim 22, wherein any two neighboring redundant field computers are capable of inhibiting the transmission of the arbitrated output signals of a third of said redundant field computers.
Claim 29
Dependent Claim
68 words
The method according to claim 24, wherein said output enforcement arrangement includes a set of abort switches for each arbitrated output signal of a redundant field computer, each of said abort switches being controlled by a neighboring redundant field computer, such that a combined opening of said abort switches for a specific output channel operates to inhibit the transmission of the arbitrated output signal for that output channel.
Claim 30
Dependent Claim
26 words
The method according to claim 25, including a step of opening the abort switches for any output channel which has an arbitrated output value of zero.
Claim 31
Dependent Claim
35 words
The method according to claim 25, wherein any of said redundant field computers is capable of requesting that its neighboring redundant field computers open their abort switches for at least one of said output channels.
Claim 32
Independent Claim
114 words
A method of processing input and output signals in a field computer unit having at least three redundant computers, comprising the steps of: arbitrating a plurality of corresponding input data signals independently at each of said redundant computers by majority voting and employing one of a plurality of predetermined software selectable input value conditions in the event that a majority agreement cannot be reached among corresponding input signals; and arbitrating a plurality of corresponding output data signals independently at each of said redundant computers by majority voting and employing one of a plurality of predetermined software selectable output value conditions in the event that a majority agreement cannot be reached among corresponding output signals.
Claim 33
Independent Claim
114 words
A method of processing input and output signals in a field computer unit having at least three redundant computers, comprising the steps of: arbitrating a plurality of corresponding input data signals independently at each of said redundant computers by majority voting and employing one of a plurality of predetermined software selectable input value conditions in the event that a majority agreement cannot be reached among corresponding input signals; and arbitrating a plurality of corresponding output data signals independently at each of said redundant computers by majority voting and employing one of a plurality of predetermined software selectable output value conditions in the event that a majority agreement cannot be reached among corresponding output signals.
Claim 34
Dependent Claim
25 words
The method according to claim 28, including steps of validating said input and output data signals, and permitting only valid data signals to be arbitrated.
Claim 35
Dependent Claim
21 words
The method according to claim 28, wherein said software selectable input value conditions include a Select-High condition and a Select-Low condition.
Claim 36
Dependent Claim
21 words
The method according to claim 28, wherein said software selectable output value conditions include a Fail-Safe condition and a Fail-Last condition.
Claim 37
Dependent Claim
23 words
The method according to claim 28, wherein said software selectable input and output value conditions may be changed with each process control cycle.
Claim 38
Dependent Claim
40 words
The method according to claim 28, including the steps of subjecting pairs of corresponding analog input data signals to at least one tolerance test, and permitting the arbitration of only those analog input data signals which pass said tolerance test.
Claim 39
Dependent Claim
72 words
The method according to claim 33, wherein pairs of corresponding analog input data signals are subjected to both a wide and narrow tolerance test, passing of said narrow tolerance test being required to qualify corresponding analog input data signals for arbitration during an initial process control cycle, and passing of said wide tolerance test being required to continue qualifying corresponding analog input data signals for arbitration during a subsequent process control cycle.
Claim 40
Dependent Claim
45 words
The method according to claim 28, wherein a difference value is determined between each of the corresponding analog input signals, and corresponding difference value for an immediately preceding process control cycle is summed to the arbitrated analog input value for the current process control cycle.
Claim 41
Dependent Claim
26 words
The method according to claim 31, wherein the analog output value closest to a last arbitrated analog output value will be selected during a Fail-Last condition.
Claim 42
Dependent Claim
25 words
The method according to claim 28, wherein a signal indicative of a specific disagreement between both corresponding input and output data signals will be generated.
References Cited (Backward Citations)
US3377623A
Cited
US3636331A
Cited
US3665173A
Cited
US3593307A
Cited
US3681578A
Cited
US3735356A
Cited
US4049957A
Cited
US3783250A
Cited
US3845356A
Cited
US3895223A
Cited
US3921149A
Cited
US3898621A
Cited
US4032757A
Cited
US4015246A
Cited
US4153198A
Cited
US4817091A
Cited
US4228496A
Cited
US4099234A
Cited
US4198678A
Cited
US4105900A
Cited
US4358823A
Cited
US4101958A
Cited
US4133027A
Cited
US4159444A
Cited
US4251873A
Cited
US4270715A
Cited
US4345327A
Cited
US4270168A
Cited
US4412280A
Cited
US4347564A
Cited
US4271505A
Cited
US4276648A
Cited
US4392199A
Cited
US4277832A
Cited
US4656475A
Cited
US4304001A
Cited
US4352103A
Cited
US4342083A
Cited
US4347563A
Cited
GB2079997B
Cited
US4530045A
Cited
US4375683A
Cited
US4371754A
Cited
US4424559A
Cited
US4443861A
Cited
US4532630A
Cited
US4517673A
Cited
US4616312A
Cited
US4472806A
Cited
US4580248A
Cited
US4517639A
Cited
US4644538A
Cited
US4583224A
Cited
US4631693A
Cited
DE3310585C2
Cited
US4872106A
Cited
US4667284A
Cited
US4562575A
Cited
US4634110A
Cited
US4610013A
Cited
GB2149939B
Cited
US4639852A
Cited
US4685053A
Cited
US4617475A
Cited
US4823256A
Cited
US4695952A
Cited
US4748594A
Cited
US4622667A
Cited
US4663704A
Cited
US4635184A
Cited
US4672530A
Cited
EP0186613A2
Cited
US4665522A
Cited
US4692932A
Cited
US4726026A
Cited
US4752869A
Cited
DE3522220A1
Cited
US4683105A
Cited
US4794601A
Cited
US4799140A
Cited
US4967347A
Cited
US4713832A
Cited
US4797884A
Cited
US4774709A
Cited
US4933940A
Cited
US4916695A
Cited
US4897640A
Cited
US4858101A
Cited
US4868826A
Cited
US4916612A
Cited
US4965745A
Cited
US4868851A
Cited
US4998194A
Cited
US4872213A
Cited
US4841232A
Cited
US4926364A
Cited
US5276823A
Cited
US4975931A
Cited
US4959768A
Cited
US4958270A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 1998-06-26 | 1998-12-26 | 1999-06-27 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2002-06-26 | 2002-12-26 | 2003-06-27 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2006-06-26 | 2006-12-26 | 2007-06-27 | $7700.00 | Window Closed / Lapsed |