Process control interface system having triply redundant remote field units

A method of controlling an analog device from a field computer system having at least three redundant computers, comprising the steps of:

• providing an analog output circuit for each of said redundant computers whose output signals are coupled to a common control input of said analog device;
• independently determining at each of said analog output circuits whether a summed output of said analog output circuits sent to said analog device deviates from an analog level of their control input to said analog device by a predetermined limit;
• any of said analog output circuits finding such a deviation independently forcing their analog outputs to a level which does not enable it to contribute to the analog level supplied to the control input to said analog device;
• determining if more than one of said analog output circuits have forced their analog output signals to said non-contribution level;
• and
• if more than one of said analog output circuits have forced their analog output signals to said non-contribution level, then restoring the analog output signals of such analog output circuits to the level commanded by their respective redundant computers, and forcing the analog output signal of a remaining analog output circuit to said non-contribution level.

A method of controlling a physical process with substantial tolerance to faults, comprising the steps of:

• receiving a plurality of raw analog and digital signal inputs from sensors associated with said physical process at a field unit, said field unit having a set of at least three redundant field computers for converting at least some of raw said input signals into arbitrated input value signals at predetermined times,
• concurrently transmitting at least some of said arbitrated input value signals to a set of redundant process computers over a plurality of bi-directional communication channels,
• concurrently transmitting output value signals from at least two of said redundant process computers to said field unit over said plurality of communication channels,
• independently arbitrating said output value signals at each of said redundant field computers such that each of said redundant field computers generates an individual arbitrated output signal for each of said output value signals received by said field unit,
• processing said arbitrated output signals through an output enforcement arrangement which allows each of said arbitrated output signals to drive a common process control device unless the transmission of at least one of said arbitrated output signals to said process control device is specifically inhibited.