Apparatus for Providing Configurable Safe-State Outputs in a Failure Mode

This invention relates to a data processing system, and more particularly, to an apparatus for providing safe-state outputs in a failure mode of a process control system.

In a process control system, a process is controlled which generally involves the monitoring and controlling of fluid flow, fluid flow rate, fluid levels, temperature, pressure, position, levels (e.g. tank or vat levels), . . . These parameters are resultants of a process and are measured by a variety of field devices including such devices as valves, flow meters, position indicators, motors, . . . As the process continues, the parameters are being monitored by a main controller, and output signals are generated for controlling the various field devices (or field equipment) or interposing control relays that connect to the field devices. An apparatus, referred to herein as an output device, interfaces with the field devices and outputs control signals (or command signals) to the field devices. In the event of a failure in the system, there is a need to output signals to the field devices which define a predetermined, selectable (i.e., configurable) default condition for the devices. The apparatus of the present invention provides a predetermined output signal to the field devices, including a way of "online" testing the apparatus.

Therefore, there is supplied by the present invention, an apparatus for providing safe-state outputs in a failure mode of a process control system. The process control system includes a processor which outputs command signals to a plurality of field devices via the apparatus. The apparatus, an interface unit, comprises a primary output unit, operatively connected to the processor, for outputting a first set of the command signals to the field devices in response to a first control signal. The first set of command signals are command signals for normal operation of the process control system. A secondary output unit, operatively connected to the processor, outputs a second set of the command signals to the field devices in response to a second control signal. The second set of command signals are command signals for a failure mode of operation of the process control system. The second set of the command signals are temporarily stored by the secondary output unit.

Accordingly, it is an object of the present invention to provide an apparatus for providing safe-state outputs.

It is another object of the present invention to provide an apparatus for providing safe-state outputs in a failure mode.

It is a further object of the present invention to provide an apparatus for providing safe-state outputs in a failure mode which can be tested on-line.

These and other objects of the present invention will become more apparent when taken in conjunction with the following description and attached drawing, which drawing forms a part of the present application.

FIG. 1, the sole drawing of the present application, shows a functional block diagram of the apparatus of the preferred embodiment of the present invention.

Referring to FIG. 1, there is shown a block diagram of the apparatus of the preferred embodiment of the present invention. The apparatus of the preferred embodiment of the present invention is essentially an interface device 10 for interfacing a controller (not shown) to field devices (or field equipment, not shown) such as motors, valves, . . . The interface device 10 (sometimes referred to herein as an output device) provides output signals to the field equipment or field devices (not shown).

The output device 10 includes a primary latch 20, and a backup latch 30. Both the primary latch 20 and the backup latch 30 are coupled to the processor (not shown), the primary latch 20 of the preferred embodiment of the present invention having a plurality of individual digital inputs, and the backup latch 30 having a plurality of inputs corresponding to the primary latch 20. Associated with the primary latch 20 is a primary driver 40, and associated with the backup latch 30 is a backup driver 50. The outputs of the primary latch 20 are coupled to the inputs of corresponding drivers 40, and similarly the outputs of backup latch 30 are coupled to corresponding inputs of the backup driver 50. The outputs of the primary drivers 40 are coupled to predetermined field equipment (not shown). The corresponding outputs of the backup drivers 50 are also coupled to the corresponding outputs of the primary drivers 40. Thus, output 51 of backup driver 50 is coupled to the output 41 of primary driver 40, output 52 of backup driver 50 is coupled to the output 42 of primary driver 40, . . . Further, for example purposes only, output 41 may be operatively connected to a predetermined valve (not shown), output 42 may be operatively connected to a motor (not shown), . . . In the preferred embodiment of the present invention, the primary latch 20 and the backup latch 30 each comprise an integrated circuit chip type 74273, an Octal-D Type Flipflop. In the preferred embodiment of the present invention the primary drivers 40 and the backup drivers 50 each comprise an integrated circuit chip ULQ2803, an Octal Peripheral Driver Array.

In operation, the processor outputs the digital values to the primary latch 20 via a bidirectional bus 60, the digital values to be received by the corresponding field equipment (not shown). Along with outputting the digital values, the processor also outputs a control signal PLCONT which clocks the digital values (or digital data) into the primary latch 20. In normal operation a monitor circuit 70 outputs a control signal, PDCONTROL which enables the primary drivers 40. As the process continues in a normal operating mode, the processor (not shown) continues to output the digital data to the primary latch 20, thereby providing the necessary control signals to the field equipment via the primary latch and the primary driver 40. At the start of the operation, the processor also outputs the safe digital values (also referred to as safe-state values or outputs) to the backup latch 30 via the bidirectional bus 60. For that particular transmission or output, the processor outputs a control signal, BLCONT, to the backup latch, thereby allowing the safe digital values to be stored in backup latch 30.

At that time the control signal to the primary latch PLCONT is not outputted. An enable signal BDCONTROL which is coupled from the monitor circuit 70 to the backup driver 50 is such that the backup drivers are not enabled, thereby inhibiting the safe outputs stored in backup latch 30 from being outputted to the field equipment. The monitor circuit 70 receives status information from the processor; namely, the monitor circuit monitors a watchdog timer coupled from the processor to insure that the processor is still operating correctly. Also the monitor 70 receives power input from a local power regulator (not shown) and monitors the power available to the circuitry of the interface device 10, thus insuring that the interface device 10 has the necessary power to provide the output signals to the field equipment. The monitor circuit 70 also includes a backup power in order to insure the ability of the monitor circuit 70 to drive the output signals of the interface device. The monitor circuit 70 of the preferred embodiment of the present invention includes an integrated circuit chip, National Semiconductor LM140L-5, a 3-terminal regulator, and some supporting circuitry. The circuitry which performs the monitoring functions is well known to those skilled in the art and will not be discussed further herein.

In the event an error or a malfunction is detected by the monitor circuit 70, the monitor circuit 70 outputs the BDCONTROL control signal to the backup driver 50 and removes the PDCONTROL enable signal to the primary driver 40, thereby enabling the safe-state output signals stored in backup latch 30 to be outputted to the field equipment. The control enable signals PDCONTROL and BDCONTROL to the primary driver 40 and the backup driver 50, respectively, are either/or signals, such that one and only one control enable signals is outputted as a function of the monitoring function, i.e. if everything is determined to be operating normally the primary driver is enabled, and if any malfunction or anomaly is detected by the monitor circuit the backup driver is enabled.

The operation described above utilizes an approach in which predetermined safe-state outputs are stored in the backup latch 30; however, the safe-state may be determined to be the same state prior to detecting the failure. In that case, it will be understood that the processor operation in that mode enables the control signals to both the primary latch 20 and the backup latch 30 each time a digital value is outputted from the processor, PLCONT and, BLCONT are enabled. However, in the normal mode, only PDCONROL is enabled.

The interface device 10 of the present invention provides a way of testing the outputs by including a switch 80. The switch 80 basically receives status information from the field equipment, which essentially reflects the output information from the primary drivers 40 or the backup drivers 50. The output of the switch 80 is coupled to corresponding bus lines of bidirectional bus 60. In a test mode, the processor enables the switch 80 via a control enable signal, SWCONTROL, and reads the information transmitted from the field equipment to verify that the information received is as expected. The processor can also enable the backup latches and read the information stored in the backup latches via the information received from the field equipment through switch 80, to verify that the backup latches contain the safe-state data as expected. This can be done even in a normal operating mode since the field devices are generally slow devices and will not be effected by any variation in the outputs transmitted via the primary driver 40 or backup driver 50. In this fashion the total loop between the interface device 10 and the field devices can be verified. If the processor does not receive the expected data, the processor can initiate a failure mode by notifying the monitor circuit 70 that it has detected an error.

It will be understood by those skilled in the art that the output data to the field equipment can be analog data in digital form. The switch 80 of the preferred embodiment of the present invention is an integrated circuit chip, octal buffers and line drivers with 3-state output, type 74/244. Although the backup latch of the preferred embodiment is set by the processor, it will be understood by those skilled in the art that the backup latch 30 can be set manually. Further, it will also be understood that the output to be field equipment is not limited to eight (8), as described herein.

While there has been shown what is considered the preferred embodiment of the present invention, it will be manifest that many changes and modifications can be made therein without departing from the essential spirit and scope of the invention. It is intended, therefore, in the annexed claims to cover all such changes and modifications which fall within the true scope of the invention.