Process control interface system having triply redundant remote field units

In a computer implemented process control device having means for receiving input signals,

• a set of at least three controllers including a first controller, a second controller, and a third controller;
• means associated with each of said controllers for independently arbitrating output values to define an arbitrated output value signal, said output values being respective to a device within a physical process;
• means for processing each said arbitrated output value signal through an abort means;
• means for coupling together to said device the arbitrated output value signal from said first controller unless specifically inhibited by the abort means in processing said arbitrated output signal from the first controller, the arbitrated output value signal from said second controller unless specifically inhibited by the abort means in processing said arbitrated output signal from the second controller, and the arbitrated output value signal from said third controller unless specifically inhibited by the abort means in processing said arbitrated output signal from the third controller;
• means for normally concurrently driving the arbitrated output value signals from said first, second, and third controllers as a common output signal to the device except when any arbitrated value output signal is specifically inhibited;
• means for effecting, to each controller, a feedback signal measuring said common output signal;
• means, respective to each controller, for generating an inhibiting signal from said feedback signal, a predefined condition, and the arbitrated output value signal of that controller;
• and
• means for selectively activating said abort means to selectively decouple said arbitrated value output signal from said device in response to said inhibiting signal.

A computer implemented method of controlling a physical process with substantial tolerance to faults, comprising the steps of:

• concurrently transmitting output values from at least two out of a set of redundant process computers to a redundant computer unit over a plurality of communication channels, said redundant computer unit having at least three controllers including a first controller, a second controller, and a third controller;
• independently arbitrating said output values at each of said controllers such that each of said controllers generates an arbitrated output value signal for each of said output values received by said redundant computer unit;
• coupling together and normally concurrently driving, as a common output signal to a device in said physical process, the arbitrated output value signal from said first controller, the arbitrated output value signal from said second controller, and the arbitrated output value signal from said third controller;
• effecting, to each controller, a feedback signal measuring said common output signals;
• determining, through comparison of said feedback signal, said arbitrated output value signal, and a predefined condition, any of said arbitrated output value signals which does not sustain the value of the common output signal as essentially equivalent to the value of the arbitrated output value signal;
• and
• inhibiting said non-sustaining arbitrated output value signal from being driven to said device.

A computer implemented method of processing output values into a common output signal to a device in a physical process using at least three controllers including a first controller, a second controller, and a third controller, comprising the steps of:

• determining an output value for the device in each controller so that a set of output values is established;
• communicating each determined output value from its determining controller to each of the other controllers so that the set of output values is resident within each controller;
• independently arbitrating the set of output values in each of said controllers to first define an arbitrated output value signal and to further define either an associated acceptable majority agreement status or an associated unacceptable majority agreement status respective to the set of output values;
• employing one of a plurality of selectable output value conditions to be the arbitrated output value signal for any controller where an unacceptable majority agreement status is defined;
• coupling together and concurrently driving as a common output signal to said device the arbitrated output value signal from said first controller, the arbitrated output value signal from said second controller, and the arbitrated output value signal from said third controller;
• effecting, to each controller, a feedback signal measuring said common output signal;
• determining, through comparison of said feedback signal, said arbitrated output value signal, and a predefined condition, any of said arbitrated output value signals which does not sustain the value of the common output signal as essentially equivalent to the value of the arbitrated output value signal;
• and
• inhibiting said non-sustaining arbitrated output value signal from being driven to said device.

A process control system having process computer means for receiving input signals from a physical process and for deriving output values for controlling the physical process, comprising:

• at least one triply redundant computer unit, each said triply redundant computer unit including a first controller, a second controller, and a third controller, each of said first, second, and third controllers including means for providing independent arbitration of the output values to define an arbitrated output value signal, said output values being respective to a device within said physical process, each controller having means for processing said arbitrated output value signal through an abort circuit connected to the controller;
• means for coupling together to said device the arbitrated output value signal from said first controller unless specifically inhibited by the abort circuit processing said arbitrated output signal from the first controller, the arbitrated output value signal from said second controller unless specifically inhibited by the abort circuit processing said arbitrated output signal from the second controller, and the arbitrated output value signal from said third controller unless specifically inhibited by the abort circuit processing said arbitrated output signal from the third controller;
• means for effecting, to each controller, a feedback signal measuring said common output signal;
• means, respective to each controller, for generating an inhibiting signal from said feedback signal, a predefined condition, and the arbitrated output value signal in that controller;
• and
• means for normally concurrently driving the arbitrated output value signals from said first, second, and third controllers as a common output signal to the device except when any arbitrated value output signal is specifically inhibited by use of said inhibiting signal.

A computer implemented method with substantial tolerance to faults for receiving input signals from a physical process and for deriving output values for controlling the physical process, comprising the steps of:

• providing a redundant computer unit having at least three controllers including a first controller, a second controller, and a third controller;
• independently arbitrating output values respective to a device and each of said controllers, respectively, such that each of said controllers generates an arbitrated output value signal for said device;
• coupling together and normally concurrently driving, as a common output signal to a device in said physical process, the arbitrated output value signal from said first controller, the arbitrated output value signal from said second controller, and the arbitrated output value signal from said third controller;
• effecting, to each controller, a feedback signal measuring said common output signal;
• determining, through comparison of said feedback signal, said arbitrated output value signal, and a predefined condition, any of said arbitrated output value signals which does not sustain the value of the common output signal as essentially equivalent to the value of the arbitrated output value signal;
• and
• inhibiting said non-sustaining arbitrated output value signal from being driven to said device.

A computer implemented method of processing output values into a common output signal to a device in a physical process using at least three controllers including a first controller, a second controller and a third controller, comprising the steps of:

• determining an output value for the device in each controller so that a set of output values is established of all of the output values determined by all of the controllers;
• communicating all output values so that the set of output values is resident within each controller;
• independently arbitrating the set of output values in each of said controllers to first define an arbitrated output value signal and to further define either an associated acceptable majority agreement status or an associated unacceptable majority agreement status respective to the set of output values;
• employing one of a plurality of selectable output value conditions to be the value of the arbitrated output value signal for any controller where an unacceptable majority agreement status is defined;
• coupling together and concurrently driving as a common output signal to said device, the arbitrated output value signal from said first controller, the arbitrated output value signal from said second controller, and the arbitrated output value signal from said third controller;
• effecting, to each controller, a feedback signal measuring said common output signal;
• determining, through comparison of said feedback signal, said arbitrated output value signal, and a predefined condition, any of said arbitrated output value signals which does not sustain the value of the common output signal as essentially equivalent to the value of the arbitrated output value signal;
• and
• inhibiting said non-sustaining arbitrated output value signal from being driven to said device.

A method of implementing at least triply-redundant control of an automated device through deriving an electrical control signal which controls said automated device according to a predetermined control scheme, the method comprising the steps of:

• continuously deriving at least three independently variable electrical control signals each of which is capable of independently providing the electrical control signal which controls said automated device according to said predetermined control scheme;
• and
• continuously impressing said independently variable control signals on a common electrical conducting means to derive said electrical control signal which controls said automated device, whereby the control signal which controls said automated device according to said predetermined control scheme has attributes derived from all of said at least three independently variable electrical control signals, respectively;
• monitoring the value of said electrical control signal;
• and
• using the monitored electrical control signal value in said control scheme.

In a computer method of providing at least triply-redundant control of a device according to a predetermined control scheme through an electrical control signal which controls the device, the method comprising the steps of:

• using redundant computers to derive at least three independent electrical signals each of which is capable of independently providing the electrical control signal which controls said device according to said predetermined control scheme;
• concurrently transmitting each independent electrical signal to a common output line to derive, based on a contribution from all said at least three independent electrical signals, the electrical control signal which controls said device;
• measuring the actual value of said electrical control signal in each redundant computer;
• comparing the measured actual value of the electrical control signal and the desired value of the electrical control signal based on the predetermined control scheme;
• and
• discontinuing the transmission of the independent electrical signal from at least a select one of said redundant computers to the common output line when said comparing defines an undesirable deviation between the measured actual value of the electrical control signal and the desired value of the electrical control signal based on the predetermined control scheme.

In a computer method of providing at least triply-redundant control of a device according to a predetermined control scheme through an electrical control signal which controls the device, the method comprising the steps of:

• using redundant computers to derive at least three independent electrical signals each of which is capable of independently providing the electrical control signal which controls said device according to said predetermined control scheme;
• concurrently transmitting each independent electrical signal through a separately controllable, normally-conducting switching means to a common output line to derive, based on a contribution from all said at least three independent electrical signals, the electrical control signal which controls said device;
• measuring the actual value of said electrical control signal in each redundant computer;
• comparing the measured actual value of the electrical control signal and the desired value of the electrical control signal in the predetermined control scheme;
• and
• operating the switching means to discontinue the transmission of the independent electrical signal from at least one of said redundant computers to the common output line when the value of that independent electrical signal is determined, by at least two other of the redundant computers, to create an undesirable deviation between the measured actual value of the electrical control signal and the desired value of the electrical control signal based on the predetermined control scheme.

Computer unit having a set of at least three redundant computers for controlling an analog device, each of said redundant computers comprising:

• means for arbitrating a set of output signals to derive a desired value of a control signal for driving said analog device via a common line;
• analog output circuit means for generating an analog output signal having said desired value to achieve said control signal;
• means for measuring the actual value of said control signal in each redundant computer;
• means, respective to each controller, for generating at least one abort means control signal from said actual value, said desired value, and a predefined condition;
• and
• abort means adapted to inhibit transmission of said analog output signal via said common output line to said analog control device in accordance with abort means control signals of the other redundant computers;
• wherein, during normal operating conditions, all abort means allow the transmission of the respective analog output signal via said common output line, said output line delivering said control signal as an electrically summed output of all analog output signals to said analog control device, and said analog output circuit means generates the respective analog output signal in response to a deviation between said desired value and the actual value of the control signal.

Method of triply redundant control of an analog control device by three redundant computers comprising the steps of:

• deriving a desired value of a control signal for driving the analog control device in each of said three redundant computers;
• generating at least one independent analog output signal to achieve said control signal with said desired value in each of said three redundant computers;
• concurrently transmitting, during normal operating conditions, at least three independent analog output signals from said redundant computers via a common output line to said analog control device to deliver said control signal as an electrically summed output of all independent analog, output signals to said analog control device;
• measuring the actual value of said control signal in each redundant computer;
• comparing said actual value and said desired value to determine a deviation between the desired value of said control signal and the actual value of said control signal and to generate the respective independent analog output signals in response to said deviation in each of said three redundant computers;
• and
• discontinuing the transmission of any independent analog output signal from any respective redundant computer to said common output line when that independent analog output signal is determined to create an undesirable said deviation.

Computer unit having a set of at least three redundant computers for controlling a digital device, each of said redundant computers comprising:

• means for arbitrating a set of output signals to derive a desired value of a control signal for driving said digital device via a common line;
• digital output circuit means for generating a digital output signal having said desired value to achieve said control signal;
• means for measuring, in each redundant computer, the actual value of said control signal;
• means, in each redundant computer, for generating an abort means control signal from said actual value, a predefined condition, and said desired value in that computer;
• means for generating at least one said abort means control signal;
• and
• abort means adapted to inhibit transmission of said digital output signal via said common output line to said common digital control device in accordance with abort means control signals of the other redundant computers;
• wherein, during normal operating conditions and when said desired value will drive said digital device into an ON state, all abort means allow the transmission of the respective digital output signal via said common output line, said output line delivering said control signal as a summed output of all digital output signals to said common digital control device.

Method of triply redundant control of a digital control device by three redundant computers comprising the steps of:

• deriving a desired value of a control signal for driving the digital control device in each of said three redundant computers;
• generating at least one independent digital output signal to achieve said control signal with said desired value in each of said three redundant computers;
• concurrently transmitting, during normal operating conditions and when said desired value will drive said digital device into an ON state, at least three independent digital output signals from said redundant computers via a common output line to said digital control device to deliver said control signal as a summed output of all independent digital output signals to said digital control device;
• measuring, in each redundant computer, the actual value of said control signal;
• and
• using said actual value, said desired value, and a predefined condition in said deriving step.