WO2015000499A1

WO2015000499A1 - Distributed control system with a location management unit and location aware field devices

Info

Publication number: WO2015000499A1
Application number: PCT/EP2013/063813
Authority: WO
Inventors: Frederik Blank; Josef Bicik
Original assignee: Abb Technology Ag
Priority date: 2013-07-01
Filing date: 2013-07-01
Publication date: 2015-01-08

Abstract

A location management unit belonging to a distributed control system comprises at least a data processing unit (21) and a data network interface (23) and is arranged to receive via the data network interface (23) from at least one remotely located stationary field device (1) a unique identification and a current geographic location and to store them in a database (22); and to transmit at least the current geographic location to at least one external data processing device (61, 62, 63) which is arranged to perform a location sensitive data processing application. A stationary field device (1) belonging to the same distributed control system (5) comprises among others a passive memory chip (12) arranged to store the current geographic location of the field device (1) as well as a unique identification of the field device (1) with respect to other field devices (1) of the distributed control system (5). A data processing unit (11) of the field device (1) is arranged to transmit at least the unique identification and the current geographic location via a first communication interface (13) to the location management unit (2).

Description

Distributed control system with a location management unit and location aware field devices Description

The invention relates to the field of distributed control systems (DCS) or supervisory control and data acquisition systems (SCADA) using locally installed field devices which are distributed across the commonly extensive area of a large-scale industrial production facility or industrial transmission or distribution network. The term field device covers sensors, actuators, control devices as well as communication devices, such as network gateways and switches, which are permanently installed and thereby stationary outside of a central control room somewhere "in the field". Industrial production facilities may for example be power generation plants, manufacturing plants, or plants belonging to the heavy process industries such as oil & gas and petrochemical. Industrial transmission or distribution networks include networks conveying electricity, water, oil or gas.

Due to different reasons, there has been an increased demand in tracking personnel moving in the field, from field device to field device, in order to be able to inform the control center accordingly. For example, during emergencies, it may become critical to know exactly where everyone currently is. The tracking of personnel is usually achieved by tracking their handheld devices and/or vehicle, making use of known positioning techniques such as Global Positioning System (GPS). Compared to GPS, a less cost efficient approach for tracking personnel and moving assets in an industrial environment is presented in the paper by Zhu et al.: "RoamingHART: A

Collaborative Localization System on WirelessHART"; Real-Time and Embedded

Technology and Applications Symposium (RTAS) 2012 IEEE 18^th, Beijing, pp. 241 -250. In this paper, it is described how mobile WirelessHART devices can be tracked by adding a roaming functionality to a WirelessHART network so that the mobile WirelessHART device can move freely within the network, and by improving the accuracy of localization

mechanisms which are based on distance measurement techniques. The distance estimation functions require the installation of special anchor nodes, which are devices that are not WirelessHART devices.

Opposed to mobile devices, the tracking of stationary devices has so far been of less interest, as their location is supposed to be stable and known over a considerable period of time. However, from US 7,940,169 B2, a system and method is known for tracking stationary systems for the purpose of installed base data management, i.e. maintaining of an accurate list of installed systems, such as medical systems, aircraft engines or computer equipment. The installed systems each carry an identification device with a memory medium for holding identification data and with a transmitter. When a reading device carried by a field employee is brought into proximity to the identification device, it automatically receives the identification data of the corresponding system, stores them internally and transmits them via a

transmission network to a database. In addition, a movable position sensing system can be installed in the field employee's vehicle, which in turn can be placed close to the system in question. The position sensing system may then continuously report its own location together with a date and time to the database. In the database, the location data is then associated with the corresponding identification data. Alternatively, the position sensing system may be directly coupled to the identification device of the installed system. In this case, the identification device may communicate the location data together with the identification data to the reading device.

The solution with the external position sensing system is naturally less accurate than the solution with the position sensing system directly coupled to the identification device. On the other hand, it is less costly.

The inventors have recognized that in distributed control systems (DCS) or supervisory control and data acquisition systems (SCADA), it may be desirable to track the stationary field devices in order to overcome problems in the central control room with location data inconsistencies, where the data inconsistencies may result for example from discrepancies between the planned and the finally installed locations of the field devices or from an unacknowledged moving of field devices to a different location. The inconsistencies in the location data of the field devices may cause various difficulties, since calibration information may be sent out to the wrong actuator in the field, or measurement results from sensors may be associated with the wrong position inside a facility or network, so that performing root cause analysis or fault localization may deliver the wrong results, for example in case of a leakage in a distribution network. The consequences of using incorrect sensor data following a sensor removal might be particularly severe in scenarios where real-time control mechanisms are in place or data is used in simulation environments.

It is therefore an object of the present invention to provide a solution with which the location data used in a central control room of the DCS can be kept up-to-date.

According to the invention, the DCS or SCADA is provided with a central location

management unit and with a specific memory chip in at least those stationary field devices which are of special interest for localization purposes in the central control room. These stationary field devices may each be equipped with a passive memory chip, such as RFID or flash memory, which is arranged to store the current geographic location of the field device as well as a unique identification (ID) of the field device with respect to other field devices of the DCS, e.g. a MAC address. The geographic location is preferably an identification of the longitude and latitude of the respective field device, i.e. a representation of the coordinates in a two-dimensional world map. However, for specific purposes, the geographic location may as well contain the altitude of the field device, resulting in the coordinates of a three- dimensional world map.

In addition, these stationary field devices are each equipped with a first communication interface for communication with a central location management unit, wherein the data processing unit of the respective field device is arranged to transmit at least the unique identification and the current geographic location via the first communication interface to the central location management unit. The location management unit, which as mentioned above is also part of the DCS and which may either belong to a stand-alone device or be integrated in a central server of the DCS, comprises at least a data processing unit and a data network interface and is arranged to receive via the data network interface from at least one of the above described stationary field devices the unique identification and current geographic location and to store them in a database, and to transmit at least the current geographic location to at least one external data processing device.

The external data processing device preferably is positioned in the central control room of the DCS and is arranged to perform location sensitive tasks such as commonly provided or required by a Geographic Information System (GIS) or a Computerized Maintenance

Management System (CMMS); or to manage location data of the field devices and to provide them to the GIS or CMMS. The external data processing device may specifically request the location management unit to transmit the current geographic locations and IDs, or the location management unit may send them out automatically. In this way, the external data processing device or devices is kept up-to-date of any changes in the location of the field devices, so that its location sensitive applications become able to understand where a particular field device is currently located when it transmits its data to the external data processing device.

The inventors recognized that a DCS may easily contain several hundred to several thousand field devices, and that it would not be viable for a field employee to approach all or enough of them with a position reading device. On the other hand, it would be too costly to provide the required extra installations for distance measurement solutions and also to equip the field devices with their own position sensing system, e.g., GPS module, or GSM module. Moreover, field devices are often installed below the surface level, e.g., in buried chambers, or within buildings, where the determination of their precise location via GPS or GSM might be impossible.

Instead, the field devices are made aware of their location in a very cost-effective way by storing the location information in a passive memory chip which is accessed by the data processing unit of the field device; and a central location management unit is provided which interacts with the field devices as well as with the other devices and applications in a central control room of the DCS so that the location information needed by these other devices and applications are always kept up-to-date.

In order to overcome the particular problem with an unacknowledged or unauthorized replacement or movement of a field device, it is suggested that the field device cannot be moved without invalidating its location. To this end, the field device may further comprise a locking mechanism which is in operational contact with the data processing unit, meaning that a locking state of the locking mechanism can be recognized by the data processing unit in order to initiate corresponding reactions. The locking mechanism is arranged to be in a locked state under normal operating conditions of the field device. In this embodiment, the data processing unit is arranged to react to a change from the locked state to an unlocked state by invalidating the current geographic location, thereby indicating that the field device may be about to be removed, and by transmitting to the central location management unit and/or by storing in the memory chip at least one corresponding invalidation timestamp indicating the point in time when the change occurred. The change from the locked to the unlocked state can be achieved by mechanically and/or electronically operating the locking mechanism using a key device with a locking element, as described further below. The timestamp may be the one belonging to the key device or to the field device itself. The invalidation could be indicated by a specific invalidation entry in relation to the invalidated geographic location; or by just adding the timestamp or timestamps to the stored geographic locations, so that a database entry or memory entry with just a geographic location and no timestamp is understood as a valid current geographic location.

The location management unit is accordingly arranged to receive from the at least one field device the identification together with the at least one invalidation timestamp and to store them in the database, and to notify the external data processing device about which one of the at least one field devices has been invalidated. The notification is preferably performed using push/pull mechanisms. In this way, the location sensitive applications and devices of the DCS are being kept informed of any unreliable location information, so that they may take it into account accordingly.

In particular situations, it may be sufficient for the GIS or CMMS to get an update of the locations of only specific ones of the field devices. Accordingly, the location management unit may be arranged to communicate with several of the at least one field devices and to notify the at least one external data processing device only in case of the invalidation of a field device belonging to a pre-defined subset of the several field devices.

When a field device is removed with the necessary authorization and - after the required maintenance for example - is placed again at the same or a different location, it is desirable to enter a new valid current location in its memory chip. To this end, the field device may be arranged so that a locking element of a portable key device is required to be brought into direct physical contact with the locking mechanism, before a valid current geographic location of the field device can be stored in the memory chip. The locking element of the portable key device can be a mechanical key which mechanically interacts with the locking mechanism of the field device, or an electronic key stored on the locking element, like a smartcard or USB stick, where the locking element also has to have direct physical contact with the locking mechanism but where the actually locking and unlocking is performed electronically. In order to increase safety, it could be required that the locking element stays in physical contact with the locking mechanism throughout the storing of the valid current geographic location. The current geographic location of the field device may be entered manually by field personnel, or it may be determined by an external position sensing device placed in proximity to the field device or by the portable key device itself. In the latter case, the field device may comprise a second communication interface for data communication with the portable key device, wherein the portable key device is arranged to determine the valid current geographic location and to transmit it to the second

communication interface. Accordingly, the portable key device may contain a location identification unit, which - while being brought into direct physical contact with the locking mechanism of the field device - may measure or determine the current geographic location via known systems and methods, such as GPS, Galileo, Glonass, GSM network triangulation or triangulation using Wifi hotspot. The second communication interface may provide a direct access for the portable key device to the memory chip of the field device, or it may provide a communication connection to the data processing unit of the field device which then takes care of storing the received information in the memory chip.

Alternatively, or additionally, the portable key device may be arranged to transmit the updated geographic location to the central location management unit. In this case, the location management unit would be arranged to communicate with at least one portable key device, since each field device is allocated either its own key device or at least its own locking element. As already described above, each of the at least one portable key device would comprise at least one locking element for changing the locking mechanism of a corresponding field device from an unlocked to a locked state and vice versa, and a location identification unit for determining the current geographic location of the key device. In addition, it would contain at least one communication interface for transmitting the current geographic location to the location management unit, instead of the field device.

In addition to storing a current geographic location, the memory chip of the field device may be arranged to store all, or at least the latest ones of previous time stamps and/or of previous geographic locations, i.e. those time stamps and/or those geographic locations which have been invalidated earlier. In this way, the history of the locations of the respective field device is maintained.

The data processing unit of the field device can be arranged to transmit at least the identification and the at least one invalidation timestamp via the first communication interface to the central location management unit in at least one of the situations: • as soon as the current geographic location is invalidated, which may mean in particular as soon as the at least one timestamp has been stored in the memory chip,

• as soon as a new valid current geographic location is stored in the memory chip, thereby indicating the point in time when the field device is reactivated,

· as soon as further data has to be transmitted to the central location management unit, such as common operational data, or

• as a response to an inquiry by the central location management unit.

In these cases, the field device may further transmit to the central location management unit, in addition to the identification and the timestamp of the geographic location which was last invalidated, previous timestamps, in case a history of previous geographic locations, or at least their timestamps, is available. If required, the previous locations may be transmitted as well. An inquiry by the location management unit may be sent out in a point-to-point

communication to single field devices only. As an alternative, the location management unit may also be arranged to broadcast an inquiry message to all connected field devices, to receive in response to the inquiry message the unique identification as well as the current geographic location from the field devices, to recognize if the location of a field device has changed and/or if a new field device has been added to the system, and to update the database accordingly.

For safety reasons, the data processing unit of the field device may be further arranged to reduce functionality of the field device to a predefined level and/or to transmit an alert to the central location management unit in case the change from the locked to the unlocked state occurred without the locking element of the key device being in direct physical contact with the mechanical locking mechanism, thereby clearly indicating that the field device may have been moved without authorization. For some applications or for certain types of field devices, such as sensors measuring relative pressure, it may be of particular interest to not only know exactly the two-dimensional position of the field device, i.e. longitude and latitude, but to know its altitude or elevation as well. Accordingly, the memory chip would then be arranged to store the current geographic location including the altitude of the field device. The altitude may be measured by the portable key device as well, for example by measuring the atmospheric pressure at the current location of the field device. The portable key device may provide an additional advantage except for just keeping the central location management unit informed of invalidated and/or updated geographic locations. In the case where not all field devices of a DCS are equipped with a first communication interface, or where they may not be permanently connected to the central location management unit, the portable key device may additionally be used as a means to remotely actuate or configure such a field device having no permanent data connectivity, in particular an actuator. For this purpose, the portable key device may additionally be equipped with an actuating element; and the field device requires additional means with which physical or operational settings of the field device can be changed. The actuating element of the portable key device is then to be arranged to operate these means. In this way, non-automated actuators, such as valves, may be operated in a defined way as if they were connected to the DCS.

The location management unit may then be further arranged to create and transmit to a Work Management System a work order, also called job description, for a field technician to attach the locking element having an electrical actuator to the locking mechanism of the

corresponding field device. The location management unit may then interact with the corresponding key device to remotely change a physical setting of the field device by operating the electrical actuator of the locking element accordingly. For example, once the locking element is inserted, the key device may inform the central location management unit accordingly and may then receive actuating data, in particular set points, indicating for example by which angle the actuator of the locking element is to be rotated or by which length it is to be moved. Once the actuation is performed, a corresponding feedback may be sent to the key device and from there to the central location management unit.

The invention and its embodiments will become more apparent from the examples described below in connection with the appended drawings which illustrate:

Fig. 1 the elements of a field device, a location management unit and a portable key device according to the invention,

Fig. 2 an overview of a DCS with location-aware field devices,

Fig. 3 interaction of the elements of the DCS of Fig. 2 in case of repositioning of one of the field devices.

In Fig. 1 , a field device 1 of a distributed control system (DCS) is shown, which may be a sensor, an actuator, a control device, such as a PLC, or a communication device, such as a network gateway or a network switch. The field device 1 contains a data processing unit 1 1 , a memory chip 12 for storing at least an ID and the current geographic location of the field device 1 , a first communication interface 13 for data communication with a location management unit (LMU) 2, a second communication interface 14 for data communication with a portable key device 3 and a locking mechanism 15. By means of the memory chip 12, the field device 1 is made location-aware. The location-aware field devices of Figs. 1 , 2 and 3 are each symbolized by a two circular edging lines.

The locking mechanism 15 of field device 1 corresponds to a locking element 35 of the portable key device 3. The portable key device 3 further comprises a data processing unit 31 , a location identification unit 32, a data interface 34 for direct access to the memory chip 12 of the field device 1 and an interface 33 to a data network 4 for communication with the location management unit 2.

The location management unit 2 comprises again its own data processing unit 21 , a database 22 for storing the geographic locations and/or the information about the validity of the geographic locations of the DCS, and a data network interface 23 for communication with the field device 1 and the portable key device 3 across data network 4. Data network 4 may be wireless or wire-bound.

In Fig. 2 a DCS or SCADA 5 is shown containing several of the field devices 1 , indicated by three elements with circular edging lines; their corresponding key devices 3 being arranged to determine their own geographical location via satellite system 7 or triangulation using GSM system 8; and one central location management unit 2 with its database 22. In a central control room 6 of the DCS, together with the central location management unit 2 further location aware data processing devices or applications, respectively, may be installed, which is here illustrated by a Geographic Information System (GIS) 61 . Apart from that, further location aware data processing devices or applications may be present in the control room 6, e.g. a Computerized Maintenance Management System (CMMS) 62 and a Workforce Management System (WMS) 63. The location management unit 2 is arranged to transmit at least the current geographic location of field device 1 to at least one of the external data processing devices 61 , 62, 63. The location management unit 2 may in particular provide a service API to which the applications requiring the location information, also called geo- information, of the external data processing devices 61 , 62, 63 can subscribe in order to get automatically informed about position changes of certain field devices of interest, or through which the external data processing devices 61 , 62, 63 can access the required geo- information or possibly read or write geo-information from or to the field devices. The devices and applications in control room 6 may be operated and/or monitored by operations personnel 10 and the portable key devices 3 may be carried and their locking elements 35 be brought into physical contact with the locking mechanism 15 of the field devices 1 by field personnel 9.

The possible interactions of the elements of Figs. 1 and 2 will now become more apparent from the following description.

As was described above, the field devices 1 are made aware of their location via a passive memory chip 2, e.g., RFID, Flash, etc., with sufficient capacity to store its unique ID, e.g., a MAC address, pre-programmed during manufacturing, and a limited set of locations as well as corresponding timestamps. Additional field device details, such as its type, units, time zone, etc., as well as a list of authorized portable key devices 3 and/or locking elements 35 that are allowed to access this data might also be stored in the memory chip 2. Accessing the data may be restricted through digital certificates, passwords, encryption or other authentication mechanism.

The information stored in the memory chip can be accessed by the data processing unit 1 1 of the field device itself as well by the portable key device 3 via the second communication interface 14 using a contact or contact-less technology.

The field device 1 is equipped with the locking mechanism 15 that can be opened only using the specialized key device 3. For enhanced security, the field device 1 may be attached to some stationary object in such a way that it cannot be removed without opening the locking mechanism 15 first. The locking mechanism 15 may be mechanical or electronic. In order to prove that a removal of the field device 1 is authorized, the locking mechanism 15 has to be unlocked using key device 3 and its locking element 35 first.

Opening the locking mechanism 15 with or without authorization will automatically invalidate the location of the device to indicate that it is being moved. Recent as well as historic timestamps received from the key device 3 and generated by the field device 1 itself at the time of the removal may be stored in the memory chip 12 and may be transmitted either immediately upon the insertion of the locking element 35 into locking mechanism 15, or when the field device 1 is next reactivated or when it next transmits data to the location

management unit 2. The purpose of the locking mechanism 15 is to ensure that the field device 1 cannot be moved to another location without the new location being updated in its internal memory, in the location management unit 2 as well as, consequently, in all IT systems (61 , 62, 63) which have subscribed to receive location updates from the field device 1 .

The specialized key device 3 is arranged to precisely determine its location by using any suitable method, e.g., GPS, Galileo, Glonass, GSM network triangulation, manual entry of coordinates, selection of the location on a digitized map, triangulation via Wifi hotspot, etc.. In cases where the satellite-based methods may be not accurate enough or even fail, due to shadowing effects, for example, it may also be possible that key device 3 receives precise location data from an external source.

For certain applications, it is suggested to provide the key device 3 with the ability to determine the location of a field device 1 not only in terms of longitude and latitude, but as well in terms of altitude, also called elevation. This is, for example, very important for pressure sensors used in water distribution networks since they only measure relative pressure in the water pipe. For the purpose of determining the exact altitude of a field device, accurate sensors based on the measurement of atmospheric pressure may be utilized by location identification unit 32 of the key device 3. The data processing unit 31 of key device 3 can also be arranged to fuse altitude information from several sources in order to determine the accurate altitude of a specific field device 1 .

In addition, the key device 3 may be equipped with an internal memory for storing the determined location internally, for example in order to later transmit this data to the location management unit which might be of interest during an engineering or installation phase of the DCS or SCADA when field devices, in particular sensors and actuators, are already located at their final destination but are not yet operational to send any information on their own. The location of a device can be verified by the location management unit 2 every time the locking element 35 has been or still is attached to the device. In case of discrepancies between the currently measured geographic location and a previously stored geographic location, the field device's location entry in database 22 can be updated to reduce errors resulting in applications being executed by any of devices 61 , 62, 63 based on the location information. If a significant discrepancy is revealed, an alarm may be generated in order to signal potentially invalid data, either on the field device's memory chip 12 or in the database 22 of location management unit 2, and a work order may be generated automatically for correcting the location information of the field.

The key device 3 is basically composed of a mechanical locking element 35 and a portable computer device, wherein the mechanical locking element 35 is attached to and/or communicating with the portable computer device. The portable computer device is responsible for acquiring the geographic location. The mechanical locking element 35 may additionally include electronic parts, as in the case of a smartcard. Further, the key device 3 may be equipped with an electric actuating element, e.g., based on a motor, where the actuating element is arranged to be attached to an actuating part of a field device 1 and may be used to change its physical setting, e.g., by rotating a shaft to modify an opening of a valve.

The changing of a physical setting of an actuating part of a field device 1 may be achieved by sending actuating data to the key device 3, where the actuating data are based on at least one of the following: manual input to the key device 3, input received by key device 3 from other nearby field devices, or instructions received from the location management unit 2 - either generated by the location management unit 2 or any other IT system (61 , 62, 63) of the distributed control system, or manually input to the location management unit 2.

As an example, it is possible, that as soon as the actuating element of key device 3 is installed on the actuating part of a field device 1 , it appears as active in the central control room 6 of the distributed control system 5. In a next step, the ID of the field device 1 may be read from memory chip 12 in order to validate that the correct device will be actuated and the current settings of the field device 1 may be retrieved. Then, an operator 10 can perform an action on it using standard faceplate dialogs, or the actuating element may perform an action that has been programmed in advance, for example via such a control system faceplate.

Feedback information about how far the actuation has progressed, e.g. how many times a valve has been turned, is sent back to the location management unit 2, or in general to the distributed control system 5, and may in addition be visualized to field personnel by a local actuation monitor which is an integrated part of key device 3. The actuation monitor may be any means for visual, acoustic or haptic feedback, e.g. LEDs, beepers, small graphical display etc. The actuation using the actuating element attached to the field device 1 has the potential to carefully change the settings of a field device on a time-by-time basis, e.g., slow opening of a valve to reduce the risk of triggering pressure transients. This way of actuating a field device 1 is best applied in situations where fixed real-time connectivity and device automation is uneconomical, e.g., due to the field device's location, or its unavailable power supply, or its infrequent operation. In situations where the communication connection between field device 1 and location management unit 2 via data network 4 is too slow to receive any feedback information promptly enough to not overdrive the actuating part of field device 1 , it may be more appropriate to perform the actuation by an intelligent device in close and direct connection with the field device 1 , instead of via the location management unit 2 or the distributed control system 5. The intelligent device may send the actuating data itself and may in particular be arranged to read measurements and status information of the actuating part of the field device 1 directly, without involving any network communication.

For automatic actuation, a bi-directional interaction between the actuator attached to locking element 35 and the location management unit 2 is required. The field device 1 will only allow an authorized locking element 35 to change its settings using the actuator.

The key device 3 may also be used to validate asset data owned by a utility company.

Typically, every field device 1 of the utility company has a unique asset number and a corresponding record in a corporate GIS system 61 or other IT system, in order to track its lifetime. Even passive field devices that do not transmit data can be tagged using the memory chip 12 and the assigned unique ID only. The memory chip 12 of a passive field device 1 may still contain the current geographic location for cross-validation purposes. To use the key device 3 in this context, it is suggested that the communication capability of the key device 3 with location management unit 2 is made use of. After bringing the key device 3 into proximity of the passive field device and/or establishing a contact between the locking element 35 and locking mechanism 15, the unique ID and the current location of the field device 1 are retrieved by the key device 3 from the memory chip 12 and transmitted to the location management unit 2 for further transmission to GIS system 61 . There, the data may be cross-checked with the asset data in the corporate GIS. In case a discrepancy is discovered, it can be rectified automatically or manually.

In addition to centrally updating the location of a passive field device, the unique tagging may also be utilized for storing the current state and possibly also previous states of a physical setting of the field device internally in the memory chip 12, where the physical setting may be for example the opening of a valve in a water distribution network. By applying the same mechanism as described above, changes of the physical setting which are logged locally in the passive field device, may be transferred from time-to-time to a central data management system (61 , 62, 63). In this way, asset management is automated without requiring each field device to be equipped with extra data communication means. The field device 1 may optionally contain an internal security mechanism that will restrict its functionality if it was removed using an unauthorized locking element 35. In that case, the field device 1 may also be able to send an alarm message to the location management unit 2 which consequently notifies any other IT system (61 , 62, 63). The field device 1 may automatically transmit changes in its location and/or configuration, e.g., measurement units, time zone, etc., to the location management unit 2. The field device 1 may alternatively transmit the information about its location periodically. Additional information transmitted by the field device 1 may include self-diagnostics and other data, besides the measurement data and/or control data commonly required by a field device 1 to communicate in a distributed control system 5.

Accordingly, the communication protocol used by the field device 1 for communication on the data network 4 needs to enable at least the transmission of the location of a device together with other event data, in particular the timestamp when the field device was moved. This information may be transmitted in the form of additional meta-data that can be appended to the usual information transmitted using a proprietary or standardized communication protocol.

In case that a bi-directional channel is available between a field device 1 and the location management unit 2, the communication protocol may also enable field devices to enquire details of other field devices in their proximity, where the enquiry may be sent to and responded by the location management unit 2 or by the other field devices. In other words, a field device 1 may request additional data and the location of field devices within a certain distance from its current geographic location.

The location management unit 2 may also be able to modify a configuration of a field device 1 stored in its memory chip 12, e.g., remotely update the current geographic location, or remotely update or revoke a list of locking elements 35 that are allowed to manipulate the field device 1 .

The communication protocol may further include encryption mechanisms, e.g., Secure Socket Layers, to prevent unauthorized access to the transmitted data. For a field device 1 that uses a binary communication protocol, a gateway device may be used as a mediator to connect the field device 1 to the location management unit 2 and to and handle the translation of geographic location data across the various communication protocols, e.g., a proprietary binary protocol between the field device and the gateway and a different standardized or proprietary protocol between the gateway and the location management unit 2. The gateway device may itself be treated as a location-aware field device 1 , i.e. may be equipped with a memory chip 12 for storing its current geographic location.

The location management unit 2 generally acts as a data gatherer and a data manager of the location information of the various field devices 1 . In addition to its coordinating functionality, it may also provide a location synchronization service that collects data regularly transmitted from the field devices 1 and that is able to extract the respective location information from the communication protocol. Internally, the location synchronization service will maintain a master database of sensor locations as received from the field devices 1 including their location history.

Applications executed by external data processing devices 61 , 62, 63 may subscribe to receive notifications about location changes as soon as these are provided by the field devices 1 . The subscription may for example be possible using a number of Application Programming Interfaces (API). The location management unit may in particular provide the means for the IT systems (61 , 62, 63) to subscribe to individual field devices or groups of field devices defined either by a set of their unique identifiers or alternatively using a location, e.g., subscribe to all field devices within a 100 meters of Device X.

Any location change update can be transmitted to subscribers as notifications via a push technology, e.g., web services, however, it may also be possible to pull the information on demand, e.g., using polling. A mechanism may be in place to ensure that a notification cannot be missed when a subscriber is offline and unable to receive it when initially distributed.

The geographic location information of the field devices 1 received by the location

management unit 2 may be stored in database 22 in an Open Geospatial Consortium (OGC) compliant format to ensure standard compliance and compatibility. Operators 10 of the distributed control system 5 may be able to actuate a field device 1 that does not have permanent connectivity by using the location management unit 2. If such a field device 1 is to be controlled, the location management unit 2 may create a work order, i.e., a job or task description for a field technician, and dispatch it to the Work Management System 63 (WMS). The WMS then instructs field personnel 9, e.g., via SMS or E-Mail, to reach the particular field device 1 in a specified time window and to attach the locking element 35 equipped with an actuator so that the field device 1 can then be set from the central control room 6. The location management unit 2 as well as the communication protocol for communication on data network 4 provide the necessary interfaces to facilitate this kind of manually-assisted remote control.

When changing the settings of a field device 1 using the actuator, the current field device's setting, in particular its current geographic location, can be obtained from the field device itself, or it can be provided by the location management unit 2 based on the known unique ID of the field device.

The location management unit 2 may interact with the other IT systems (61 , 62, 63) over a computer network, e.g., Ethernet, using a family of protocols, such as TCP/IP, UDP, or other. It will provide redundancy mechanisms to enable its uninterrupted operation to avoid any data losses.

Apart from a number of APIs that can be used by the IT systems, the location management unit 2 may provide a graphical user interface that can be used to:

• Visualize the current as well as historical locations of all configured field devices

using a GIS-based Graphical User Interface (GUI).

· Display alarms or alerts originated from field devices that were removed from their original location without an authorized locking element 35, also called key.

Another service possibly provided by the location management unit 2 may be responsible for an automatic addition of newly recognized field devices 1 into its database 22. To this end, the location management unit 2 may be equipped with a device discovery service based on broadcasting messages to all field devices 1 , where the location management unit 2 will be able to receive messages from new field devices in a secure manner that will prevent the association of unauthorized devices or device types with the location management unit 2. This approach is similar to a plug-and-play mechanism in a way that newly added field devices can be automatically registered with the location management unit 2 so that, consequently, other IT systems (61 , 62, 63) that use the API provided by the location management unit 2 can receive corresponding notifications. For this approach, the presence of a unique device identifier in each memory chip 12, which is for example set during the manufacturing process, is vital.

The diagram of Fig. 2 captures the principal data flows in a DCS with location-aware field devices 1 and a location management unit 2. However, it displays only one of many possible scenarios described above. Typically, a key device 3 with its locking element 35 is used to activate a field device 1 allocated to the respective locking element 35 and to determine its current geographic location and transmit it to the field device, if the field device does not have a built-in functionality to determine its location automatically. The field device 1 then transmits the newly set current geographic location by way of the above described enhanced communication protocol that can transmit real-time data as well as location and other metadata to the location management unit 2.

The location management unit 2 stores the current geographic location as well as any later updates of it in an internal database 22, also called geo-database, so that a history of location changes of a given field device 1 is maintained. The information stored in the database 22, i.e., the location of all location-aware field devices 1 at a given point in time, is made available to an operator 10 through a GIS-based GUI. Other IT systems, also called external data processing devices 61 , 62, 63, are notified of any location updates using push/pull programming interfaces thanks to the location synchronization service provided by location management unit 2. As can be seen from Fig. 2, the field devices 1 may also able to communicate with each other and to benefit from knowing their exact location.

As a particular advantage, the above described solution may significantly facilitate temporary collection of short-term field data. In water distribution networks, for example, a relatively large number of pressure sensors are temporarily deployed at strategic locations within a District Metered Area (DMA) to obtain measurements for the development and calibration of hydraulic models using a modeling and/or simulation software package, e.g., Infoworks WS, Aquis, SynerGEE. Another example is the temporary deployment of acoustic sensors within a certain zone of the water distribution network in order to identify the exact location of a leak. The field devices in form of the sensors are typically deployed for a limited period of time, like 1 to 7 days, and then moved to other DMAs or - in the case of the acoustic sensors - removed. With the above described solution, the data collected from the sensors may be associated not only with a particular sensor but also with its precise location. Such information allows for an automatic association of field device locations with measurement points in a hydraulic model while minimizing potential scope for errors. This will reduce the effort of model building and furthermore enable to carry out the calibration of the hydraulic model with a smaller number of pressure sensors that can be moved during the data collection period within one DMA. Thanks to the position determination functionality of the key device 3, the location management unit 2 is always notified when a field device is removed or activated at its new location, and the external data processing units 61 , 63, 64 are made aware of it, too.

Fig. 3 illustrates the above described use case of real-time hydraulic modeling or model- building activities. An operator 10 instructs field personnel 9 to move a field device 1 from a current geographic location A to a new geographic location B. As soon as the field device 1 is invalidated using the key device 3 with its locking element 35, the location management unit 2 is notified by the field device 1 or, alternatively, by the key device 3, e.g., via an alarm. The location management unit 2 in turn flags incoming data accordingly, and stores invalidation information in database 22. Then the field device 1 is removed from its current geographic location A, and moved to and deployed at the new location B, where it is activated using again the key device 3 and its locking element 35. Directly after its activation, the field device 1 , or alternatively the key device 3, transmits its new geographic location, i.e., latitude, longitude, and if required altitude, to the location management unit 2. Using an API, the location management unit 2 then notifies any subscribed services of the new location, and flags the field device's data as coming from a valid location. Any subscribed or location polling IT system, such as a hydraulic modeling package 64, can then automatically update the field devices' location, stored for example in a modeling database 65, and correctly assign any incoming real-time data sent by the field device 1 to the new location. The field data from the new location can then be immediately utilized for real-time modeling tasks, during model calibration or leakage detection and leakage location exercises.

In summary, the solutions described above add position or even spatial awareness to common stationary field devices and offer a way to eliminate data inconsistencies when field devices are moved to other areas by propagating these changes to receiving IT systems (61 , 62, 63). The location-aware stationary field devices automatically notify the location management unit when they are moved. The location management unit pushes the location changes to third party applications of the IT systems so that these systems understand where a field device is located when it transmits its data to them. Further, a key device is used to program the location in the field devices and to activate the location. If the key is additionally equipped with an actuating element, it may also be used to change a set-point of a field device.

Claims

1 . Location management unit belonging to a distributed control system or a supervisory control and data acquisition system (5), the location management unit (2) comprising at least a data processing unit (21 ) and a data network interface (23) and being arranged to

• receive via the data network interface (23) from at least one remotely located, stationary field device (1 ) a unique identification and a current geographic location of the field device (1 ) and to store them in a database (22),

• transmit at least the current geographic location to at least one external data processing device (61 , 62, 63) which is arranged to perform a location sensitive data processing application.

2. Location management unit according to claim 1 , being further arranged to

• receive from the at least one field device (1 ) the unique identification together with at least one invalidation timestamp and to store them in the database (22), and

• notify the at least one external data processing device (61 , 62, 63) about which one of the at least one field devices (1 ) has been invalidated using push/pull mechanisms.

3. Location management unit according to claim 1 or 2, being further arranged to

• broadcast an inquiry message to all connected field devices (1 ),

• receive in response to the inquiry message the unique identification as well as the current geographic location from the field devices (1 ),

• recognize if the geographic location of one of the field devices has changed and/or if a new field device has been added to the distributed control system (5), and

• update the database (22) accordingly.

4. Location management unit according to claim 1 or 2, being further arranged to

communicate with several of the at least one field devices (1 ) and to notify the at least one external data processing device (61 , 62, 63) only in case of the invalidation of one of the field devices (1 ) belonging to a pre-defined subset of the several field devices.

5. Stationary field device (1 ) belonging to a distributed control system or a supervisory control and data acquisition system (5) comprising a data processing unit (1 1 ),

characterized in that the field device (1 ) further comprises

• a passive memory chip (12) arranged to store the current geographic location of the field device (1 ) as well as a unique identification of the field device (1 ) with respect to other field devices (1 ) of the distributed control system (5); and

• a first communication interface (13) for communication with a central location management unit (2), wherein the data processing unit (1 1 ) is arranged to transmit at least the unique identification and the current geographic location via the first communication interface (13) to the central location management unit (2).

6. Field device according to claim 5, further comprising a locking mechanism (15) which is in operational contact with the data processing unit (1 1 ) and which under normal operating conditions of the field device (1 ) is arranged to be in a locked state; and wherein the data processing unit (1 1 ) is arranged to react to a change from the locked state to an unlocked state by invalidating the current geographic location, by transmitting to the central location management unit (2) and/or by storing in the memory chip (12) at least one corresponding invalidation timestamp indicating the point in time when the change occurred.

7. Field device according to claim 6, being arranged so that a locking element (35) of a portable key device (3) is required to be brought into direct physical contact with the locking mechanism (15), before a valid current geographic location of the field device (1 ) can be stored in the memory chip (12).

8. Field device according to claim 7, further comprising a second communication interface (14) for data communication with the portable key device (3), wherein the portable key device (3) is arranged to determine the valid current geographic location and to transmit it to the second communication interface (14).

9. Field device according to any of claims 6 to 8, wherein the passive memory chip (12) is arranged to store previous time stamps and/or previous geographic locations of those geographic locations which have been invalidated earlier.

10. Field device according to any of claims 6 to 9, wherein the data processing unit (1 1 ) is arranged to transmit at least the unique identification and the at least one invalidation timestamp via the first communication interface (13) to the central location

management unit (2) in at least one of the situations:

• as soon as the current geographic location is invalidated,

• as soon as a new valid current geographic location is stored in the memory chip (12),

• as soon as further data have to be transmitted to the central location management unit (2), or

• as a response to an inquiry from the central location management unit (2).

1 1 . Field device according to any of claims 6 to 10, wherein the data processing unit (1 1 ) is arranged to reduce functionality of the field device (1 ) to a predefined level and/or to transmit an alert to the central location management unit (2) in case the change from the locked to the unlocked state occurred without the locking element (35) of the key device (3) being in direct physical contact with the locking mechanism (15).

12. Field device according to any of the previous claims, wherein the passive memory chip (12) is arranged to store the current geographic location including the altitude of the field device (1 ).

13. Portable key device (3) comprising

• a locking element (35) for changing the locking mechanism (15) of a corresponding field device (1 ) from an unlocked to a locked state and vice versa,

• a location identification unit (32) for determining the current geographic

location of the key device (3),

• a communication interface (33) for transmitting the current geographic location to the location management unit (2).

14. Portable key device (3) according to claim 13, further comprising an electric actuating element arranged to be attached to an actuating part of a corresponding field device (1 ), wherein the portable key device (3) is arranged to receive actuating data and the actuating element is arranged to interact with the actuating part of the field device (1 ) to remotely change a physical setting of the field device (1 ) in correspondence with the actuating data.

15. Distributed control system comprising a location management unit (2) according to any of claims 1 to 4, at least one stationary field device (1 ) according to any of claims 5 to 12 and at least one portable key device (3) according to any of claims 13 or 14.