Data processing: generic control systems or specific application – Generic control system – apparatus or process – Having protection or reliability feature
Reexamination Certificate
2000-01-12
2003-11-11
Gordon, Paul P. (Department: 2121)
Data processing: generic control systems or specific application
Generic control system, apparatus or process
Having protection or reliability feature
C700S020000, C700S021000, C700S174000, C700S108000, C700S110000, C714S006130, C714S006130, C714S006130, C714S015000, C714S024000, C714S031000, C714S047300
Reexamination Certificate
active
06647301
ABSTRACT:
FIELD OF THE INVENTION
This invention relates to control systems where safety features are of special interest.
BACKGROUND
A number of process control systems use both a general process control system and a second attached safety shutdown computer system to comply with safety requirements in an apparatus controlled by the process control system. Such safety requirements are formalized in documented standards such as IEC 61508 (International Electrotechnical Commission Standard 61508) Parts 1 through 7; VDE 0801 (German Technical Standard 0801) AK 1 through 6; DIN (German Normalizing Institute Standard) 0116, Chapter 8.7; DIN V 19250, AK 1 through 6; EN (European Standard) 298, Chapters 9 and 10; EN 61010-1; EN 50081-2; EN 55011; and EN 55022. Process control safety requirements are also formalized in regulations such as 29 C.F.R. §1910.119 in the United States of America.
Respective to formalized requirements, a process known as “certification” is used in determining formalized acceptability of a system. The certification process examines conformance between (a) design of the system, (b) practices by organizations in construction, modification, and use of the system, and (c) the formalized requirements. Respective to “certification” and IEC 61508, four levels of acceptability are defined which are known as SILs (Safety Integrity Levels), with SIL 1 appropriate for processes having some minor risk and SIL 4 appropriate for processes having high potential risk (for example, public transportation systems under automatic control or nuclear power plants under automatic control). “Certification” is usually done by a trained “certifying agency” with credibility for such review in the society in which the “certified” system is used; an example of such a “certifying agency” is TÜV Bäyern having main offices in Munich, Germany.
In providing an acceptable control solution, there is frequently a need in higher-risk processes for the safety shutdown system to have robustness and real-time diagnostic sophistication superior to comparable attributes in the general process control system. The safety shutdown system is also usually more secure than the general process control system in the ability of an operating technician to modify critical parameters; in this regard, access to the data space of a safety shutdown computer uses a physical lock and key kept in secure custody. Safety shutdown computer system design has taken a somewhat different course from general process control system design; this has resulted in divergence in operational and programming attributes of the systems. While the concurrent use of such systems with their divergent operational and programming attributes has been generally effective, there are drawbacks. Engineers, supervisors, and operating technicians must be versant in the accompanying divergent operational and programming attributes; and, in certain situations, a comprehensive understanding of the manner in which the two systems as a whole effect control is confounded as features respective to the divergent operational and programming attributes interact. Process control systems incorporating the use of a safety shutdown computer system also enable compilation of affiliated potentially variant control-computer-executed logic sets used in the two different systems at different times: a situation which does not characterize the control system logically unified at one point in time under a unified authority. “Potentially variant” references that portion of the logic which could reasonably be expected to undergo change at the level of security access permitted to the programming engineer; a Read Only Memory chip (ROM), while frequently providing logic derived from a compile process, is not “potentially variant” in this regard unless routine incremental modifications to the control computer logic includes the process of new ROM creation and ROM component change. A control system logically unified at one point in time (that is, where all potentially variant source code for the general control of the apparatus and all potentially variant source code for the safety shutdown system of the apparatus are compiled to Machine Operation Code in the same compile instance) under a unified authority is ideally desirable in managing complex facilities. Finally, provision of a support base for two different systems is usually more expensive than for one system; such extra expense confounds efficient use of resources.
What is needed in resolving the above concerns is to provide a single unified system for executing both the safety related aspects of process control and the general aspects of process control. A rapid solution to this is to use a safety-capable system for all control needs; however, the use of a safety-capable system (frequently triply-redundant physically) in generally controlling a facility as well as in providing for its safety shutdown is expensive because of the higher capital needed per I/O point. So, while providing a technical solution to the problem of a single unified system, use of a safety shutdown system for all control is not usually an efficient resolution to the problem. What is truly needed and desired, therefore, in resolving the above concerns is to provide an economically viable single unified system capable of executing both (a) safety-related process control and (b) general process control. The present invention provides a solution to this need by providing a unified system which can execute general process control of an apparatus while also providing features used (a) in implementing burner and fired equipment safety shutdown and (b) in implementing safety management and safety integrity system solutions for achieving at least Safety Integrity Level 3 (SIL1, SIL2, and SIL3) conformance (when further coupled with organizational and engineering processes respective to construction, modification, and use of the control system which are acceptable to the certifying agency).
The following incorporated documents describe embodiments in a general process control system prior to modification into the unified control system described in this specification:
One embodiment of a control computer used in a general process control system is described in U.S. Pat. No. 5,555,424 (24Sederlund et al.) issued on Sep. 10, 1996 and entitled “Extended Harvard architecture computer memory system with programmable variable address increment” to Sederlund, Edward R.; Lindesmith, Robert J.; Root, Larry A.; Dupree, Wayne P.; and Thomas, Lowell V. This patent is expressly incorporated herein by reference in the present application for showing the status of the prior art and a manner of use respective to the present invention.
An embodiment of a redundant control computer system in a general process control system using two control computers such as the control computer described in 24Sederlund et al. is described in U.S. Pat. No. 5,583,757 (Baca, Jr. et al.) issued on Dec. 10, 1996 and entitled “Method of input signal resolution for actively redundant control computers” to Baca, Jr., Eloy; Dupree, Wayne P.; Grinwis, Donald J.; Kanse, Johannes C.; Pelletier, Douglas P.; and Schulze, Oscar E. This patent is expressly incorporated herein by reference in the present application.
An embodiment of a system for achieving data access for the control computer described in 24Sederlund et al. is described in U.S. Pat. No. 5,568,615 (15Sederlund et al.) issued on Oct. 22, 1996 and entitled “Stealth interface for control computers” to Sederlund, Edward R.; Thomas, Nadene T.; Lindesmith, Robert J.; and Cowles, Russell W. This patent is expressly incorporated herein by reference in the present application for showing the status of the prior art and a manner of use respective to the present invention.
An embodiment of a system providing a Remote Field Unit (also referenced in abbreviated form as a “Remote”, an “RFU”, or a “Remote unit”) for use with the control computer described in 24Sederlund et al. is described in U.S. Pat. No. 5,428,769 (69Glaser et al.) issued on Jun. 27, 1995 and
Baca, Jr. Eloy
Bezecny Helmut A.
Clement John L.
Dunlap Dennis J.
Frank Brent M.
Dow Global Technologies Inc.
Gordon Paul P.
Pham Thomas
LandOfFree
Process control system with integrated safety control system does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Process control system with integrated safety control system, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Process control system with integrated safety control system will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3139223