EP0270646A1

EP0270646A1 - Adaptive control systems

Info

Publication number: EP0270646A1
Application number: EP19870904074
Authority: EP
Inventors: Michael Leonard Woodhouse; Michael Garth Notley; Raymond John Wales
Original assignee: APPROVED PRODUCT TECHNOLOGY Ltd
Current assignee: APPROVED PRODUCT TECHNOLOGY Ltd
Priority date: 1986-06-20
Filing date: 1987-06-22
Publication date: 1988-06-15
Also published as: DK88888D0; AU7542987A; GB8615057D0; JPH01500068A; DK88888A; WO1987007967A1

Abstract

Systèmes de commande adaptatifs, notamment des réseaux de contrôle et de commande auto-réparateurs pour ces systèmes commandés par ordinateur. Toute panne de l'ordinateur dans les systèmes de commande informatisés connus entraîne inévitablement le non-fonctionnement du système de commande en soi. La solution proposée est un agencement hierarchique de contrôleurs secondaires, dont chacun comprend un élément nodal programmable (1, 2, 3, 4, 5), préprogrammé, par exemple par une boîte de programmation séparée déconnectable (14), de sorte que pendant le fonctionnement, les liaisons (6) en panne entre des éléments nodaux sont automatiquement réacheminées via d'autres éléments nodaux et les éléments nodaux en panne sont remplacés par des éléments nodaux qui exécutent les tâches des éléments nodaux en panne. Cette aptitude programmable à auto-réparation est rendue possible par l'utilisation d'un agencement hierarchique particulier comprenant au moins une boucle de contrôleur secondaire (2...3), chacun desquels est également relié à un contrôleur secondaire (5) de rang plus élevé. La présente invention est décrite en fonction d'un réseau de communications (sans toutefois s'y limiter). Un processeur central (10) peut être utilisé pour superviser ou contrôler le fonctionnement global du réseau, mais il ne constitue pas une partie critique du système de commande.Adaptive control systems, including self-healing control and command networks for these computer-controlled systems. Any failure of the computer in known computerized control systems inevitably leads to the non-functioning of the control system per se. The proposed solution is a hierarchical arrangement of secondary controllers, each of which comprises a programmable node element (1, 2, 3, 4, 5), preprogrammed, for example by a separate disconnectable programming box (14), so that during the in operation, the failed links (6) between nodal elements are automatically redirected via other nodal elements and the failed nodal elements are replaced by nodal elements which execute the tasks of the failed nodal elements. This programmable ability to self-repair is made possible by the use of a particular hierarchical arrangement comprising at least one loop of secondary controller (2 ... 3), each of which is also connected to a secondary controller (5) of rank higher. The present invention is described in terms of a communications network (without being limited thereto). A central processor (10) can be used to supervise or control the overall operation of the network, but it is not a critical part of the control system.

Description

TITLE: 'ADAPTIVE CONTROL SYSTEMS

Field gf Invention

The present invention relates to adaptive control systems and in particular to self-repairing monitoring and control networks of such systems. Although control systems are used in numerous technological fields and may be operated by a variety cf power sources such as electricity, mechanical means or fluid pressure, the invention is not restricted to any one of these. Background Art A control system is a means by which a variable quantity or set of variable quantities is made to conform to a prescribed norm. Control systems may either hold the values of the controlled quantities constant or may cause them to vary in a prescribed way. Known sophisticated control systems use a technique known as adaptive control which is the capability of the system to modify its own operation to achieve the best possible mode of operation. An adaptive system is able to provide continuous information about the present state of the system, compares the present system performance to a desired, optimum, performance and acts to change the system accordingly.

Computers have been applied to industrial control systems in a number of ways. The computer may be used in a secondary supervisory role to change the set points in a primary plant control system either directly or by initiating manual intervention. A malfunction of the computer used in this way cannot harm the plant per se. Alternatively, a computer may replace a group of single-loop analogue controllers or computers may be applied to all the plant-control situations simultaneously in a system which gives priority to certain actions according to some hierarchy of controllers and sub-controllers.

The advantages of using computers in such control systems are well known. The computer can be programmed readily to carry out a wide variety of separate tasks and it is relatively simple to re-programme the computer to carry out a revised set of tasks or to respond to given situations in alternative ways. Such re-programming does not usually involve any change of the physical equipment of the control system.

In all but the simplest supervisory " use of a computer in a control system described above the computer is central to the control system and is a critical part of the network. Failure of the computer in such known computerised control systems will inevitably lead to failure of the control system itself with potentially serious financial and safety consequences. If for example the control system is monitoring and controlling the operation of a nuclear power plant failure of the system could have catastrophic world-wide effects. Technical Problems to be solved by (Objectives of) the Invention

It is an object of the present invention to provide a monitoring and control network suitable for a computer controlled adaptive control system which is self-repairing and in which the computer is not a critical part of the control system.

It is a further object of the present invention to provide a control system in which essentially similar circuits, or building blocks, are used at nodes of the network and of which networks of greater complexity may readily be constructed.

It is a further object of the present invention to provide said building blocks in a form and interconnected in such a manner that they and__their interconnections may be located within a hazardous environment whilst the computer and other more vulner- able parts of the control system may be safely located outside said hazardous environment. Disclosure of the Invention

According to the invention, in one aspect thereof an adap¬ tive control system network includes a loop of sub-controllers each of which is also connected to a sub-controller of higher order in a hierarchical network. Such a network structure may be termed a loop-and-star structure.

According to the present invention in a further aspect thereof there is provided a programmable adaptive control system network comprising programmable nodal elements and links there¬ between programmed so that in operation failed links between nodal elements are automatically re-routed via other nodal elements and nodal elements are substituted for failed nodal elements and carry out the failed nodal elements' communications, monitoring or control tasks.

According to the present invention in a more specific aspect thereof a monitoring and control network for a computer controlled adaptive control system includes at the nodes of said network a plurality of essentially similar programmable sub-controller circuits arranged in a loop and star structure permitting communication between a programmable master network controller and a plurality of control devices such as sensors, switches and actuators, each sub-controller circuit including a program store, a microprocessor and means for communicating with the master network controller directly or via a higher order sub-controller, a lower order sub-controller directly or via a lower order sub-controller, and two adjacent sub- controllers in a loop of sub-controllers of the same hierarchical order and wherein the master network controller and the sub- controllers are programmed to respond to a failure of a link between any sub-controller and the master network controller by re-routing said link via another sub-controller and re-programming the sub-controllers accordingly, and to respond to a failure of a sub-controller by activating a sub-controller adjacent the failed sub-controller and in the same loop thereby to take over its monitoring, control or communications functions as appropriate. Preferably, the master network controller communicates directly with only one sub-controller. The master network controller may be connected to a main frame computer and may be temporarily connected to a programming box by which site engineers may initially program the network. Preferably, too, the network master controller and the sub- controllers are connected together by a fibre-optic communications link so that they are electrically isolated from each other. In the latter case if each sub-controller has an efficient power converter designed to operate from a low voltage supplied by a common d.c. power source via a Zener diode barrier rather than incorporate its own storage battery then the power source, Zener diode barrier, master network controller, main frame computer and programming box, may be located in a safe area, whilst the sub-controller network and the sensors, actuators and switches can be located in a relatively hazardous environment. Continued operation in the hazardous environment whill be assured as the ultra -low power sub-controllers may then be housed in small housings without undue temperature rise provided all components of the sub-controllers are chosen with ratings such that none runs at a temperature much higher than local ambient. It will be obvious that although the majority of the sub-controllers may be of identical construction those that are required to connect directly to the sensors, switches and actuators of the control system, hereinafter referred to as type A sub-controllers, will differ in some respect from those which communicate with lower order sub-controllers, which are hereinafter referred to as type B sub-controllers.

Type A sub-controllers are capable of being attached to a number of electronic sensors, and of operating a number of actuators. Typical sensors would be panel switches, vibration sensors, smoke detectors, flammable gas detectors, heat detectors, Doppler proximity detectors etc. Typical actuators would be indicator lamps, control valves, sprinklers, emergency shut-down devices, klaxons, door closers etc.

It will now be clear to those skilled in the art that known control εystem networks constructed such that there are many paths between any two nodes would, theoretically, continue to operate even if a large number of the paths were interrupted, nevertheless if those paths lead to a central computer, or any other singular node, and that central computer or single node failed, the whole network would fail. In the invention, however, the nodal elements, i.e. the sub-controllers, have a level of local intelligence with executive capability, in the form of a programmable microprocessor, such that the loss of one sub-controller will affect the local area, but not the operation of the network as a whole.

A communications network will now be described, by way of example only of one application of the adaptive control εystem network according _o the invention. It will be understood that the invention may be applied to many other technological fields in which control systems are required and the invention is by no means limited to communications networks. In the example to be described reference will be made to the accompanying drawings of which: Brief Description of the Figures of the Drawings

Figure 1 is a block schematic circuit diagram of an adaptive control system network according to the invention;

Figure 2 is a block schematic circuit diagram of a type A sub-controller used in the network of Figure 1; Figure 3 is a block schematic circuit diagram of a type B sub-controller used in the network of Figure 1, and

Figure 4 is a block schematic circuit diagram of the power supply arrangements of the network of Figure 1. Best Mode of Applying the Invention to a Communications Network known to Applicant

In Figure 1 a communications network is shown comprising a number of sub-controllers which communicate with each other and a master network controller via fibre-optic data links. Each sub-controller, whether a type A such as shown at 1, 2 or 3, or a type B such as shown at 4 or 5 has at least three optical transmitter and receive pairs to constitute a loop-and- star-structure. One pair communicates over a fibre-optic data link 6 with a type B sub-controller, 4 or 5, or the master network controller 7, above it. The other .two pairs communicate over a fibre-optic data link 8 with two adjacent sub-controllers which form part of a loop of sub-controllers.

All type B sub-controllers act purely as communications nodes in the network and have no capability for connection to external electrical equipment. Type B sub-controller 4, being the highest order sub-controller in the network hierarchy, has a fibre-optic data link 9 to the master network controller 7 containing all three main (one upward, two sideways) data link elements of the loop-and-star structure. The master network controller 7 is wire-connected to a main-frame computer 10 via an interface card 11, e.g. an RS-232 interface card.

Type A sub-controllers 1, 2 and 3 are wire-connected to various control devices such as sensors and switches 12 or actuators 13. Control devices crucial to the successful operation of the system are connected to two or more type A sub-controllers. The input sensors are electrically isolated from each other. In the example shown each type A sub-controller can sense current flowing in up to 16, 20mA loops and can switch up to 16 low current loops. A programming box 14 may be temporarily connected to the master network controller 7.

In this example all the sub-controllers are designed to withstand, and are situated in , a hazardous area 15 indicated by the area below the dividing line 16. The computer 10, master network controller 7 and programming box 14 are in a safe area 17, which may for example be a control room. The disk drives and printers, displays etc. (not shown) associated with the computer will also be located in the safe environment of the control room. The only connections between the safe area 17 and the hazardous area 15 are fibre-optic data links, which are not electrically conducting, or low-voltage lines carrying d.c. power from the terminals of a Zener diode barrier as will be described below with reference to Figure 4.

One form of type A sub-controller is shown in more detail in Figure 2. The sub-controller comprises a series of printed circuit cards assembled^" into a standard racking system, and built into an enclosure, shown schematically as 18, together with such terminals as are required for the connection of power and external circuits. The circuit cards include a central processor card 19, a power converter card 20, a current/voltage card 21, a communications receive card 22', 22", 22*", a communi¬ cation transmitter card 23', 23", 23'", a fibre-optic preamplifier card 24 and an LED card 25.

The power converter card 20 is fed with d.c. power from the terminals of a Zener diode barrier 28 (see Figure 4) located in the safe area 17. The voltage delivered to the card 20 depends on the amount of current drawn and varies between 28V, when the load is small, down to 12V when maximum power is being delivered by the Zener diode barrier 28. The card 20 incorporates a switch mode forward converter (not shown) to compensate for these variations in input voltage and to transform the power into a stabilised 5V supply which is fed to each of the other cards of the system, 19, 21, 22, 23, 24 and 25. The central processor card (CPU) 19 is a standard CMOS microprocessor circuit incorporating a 16-channel analogue-to- digital (A to D) converter 19' which has inputs connected to the current/voltage converter card 21. The A to D converter 19' measures the loop current flowing in each of 16 input circuits. The outputs 19" of the CPU 19 are via a parallel interface adaptor driving an array of VMOS transistors (not shown). In Figure 2 the CPU 19 is shown connected to the communications transmitter and receiver cards 22 and 23 by a bus-line 29 which represents schematically the means whereby the CPU 19 communicates with, controls and monitors these cards in accordance with program instructions held in a memory (not shown) of the CPU 19.

The current/voltage card 21 converts current sensed in external sensors 12 to a linearly related voltage suitable for A to D conversion by the CPU 19. The input terminals are electrically isolated by any suitable means from the sensors

^'12.

The communications transmitter and LED card 23 and 25 forms a three-channel encoder and fibre-optic data launch system. In Figure 2 the three channels CHI, CH2 and CH3 have been shown separately and with separate transmit and receive paths. Consequently the portions of the transmitter and LED card driving each transmitter channel have been drawn as separate units 23', 23" and 23'" with separate transmitter optical heads 27', 27" and 27"' . In practice these units may be combined on a single card 23. All three transmitter circuits are similar and each contains a microprocessor bus interface 30, a first-in-first-out

(FIFO) memory 31, in which messages can be assembled prior to transmission, and a serialiser 32 and encoder 33. For clarity, these units are shown only in respect of transmitter 23' asso¬ ciated with optical head 27* and CHI. Data is transmitted at 167 K bits/sec over the fibre-optic link. The LEDS are transformer coupled (not shown) to the 5 V supplied by converter 20. CHI is linked to a type B sub-controller of higher orderin the network hierarchy, whilst CH2 and CH3 are linked to other type A or type B sub-controllers in a loop of sub-controllers of the same order in the network hierarchy.

The communications receiver 22 and pre-amplifier 24 card form a three-channel fibre-optical receiver system complementary to the transmission system. Again in Figure 2, as the three channels CHI, CH2 and CH3 have been shown separately, so too have the associated receivers 22', 22" and 22"' and their associatsd optical receiver heads 26', 26" and 26"', but, as with the transmitter circuits, in practice these may be combined on a single printed circuit card. The pre-amplifier 24, in the three similar receiver circuits, detects currents generated by a PIN photodiode 34 in response to PPM light pulses arriving down the three channel fibre-optic data link CHI, CH2 and CH3. These currents are amplified to CMOS logic levels, decoded in decoder 35, converted to parallel form in serial to parallel converter 36 and fed into the receiver FIFO memories 37 so that the CPU19 can retrieve the messages on command -via the bus interface 38. The pre-amplifier is optimised to provide just sufficient bandwidth for the pulse-width employed to minimise power consumption.

Type B sub-controllers, an example of which is shown in Figure 3, is a variant of the type A sub-controller design.

In Figure 3 type B components identical to type A components of Figure 2 have been given common reference numbers therewith. Type B sub-co trcllers cannot accept electrical signal inputs from sensors, switches and actuators but are required to communi- eate over fibre-optic links with other lower order sub-controllers. Hence, it will be seen from Figure 3 that the type B sub- controllers do not contain a current/voltage card 21 but instead

4 4 5 5 contain many more transmitter/receiver cards 22 23 , 22 23 ,

2223 ....22ⁿ23ⁿ and associated receive - and - transmit optical heads 26 27⁴, 26⁵27⁵, 26⁶27⁶...26ⁿ27ⁿ. The extra transmit/receive cards communicate with the CPU 19 via appropriate data bus interface units and the data bus line 29.

Figure 4 shows the manner in which each type A and type B sub-controller, such as 1 and 4 respectively is powered by a 24V d.c. power supply 36 located in the safe area 17 via a 28 V 300 ohm Zener diode barrier 28, also in the safe area. An example of such a barrier 28 is the MTL 128 manufactured by Measurement Technology Ltd. Input circuits to the type A sub-controllers, such as the 20mA sensor 12', the switch sensor 12" or specially designed input circuits represented by 12"' are fed to sub-controllers, such as 1, via the Zener barrier 28 as shown. More than one input circuit may be connected to each barrier subject to permiss- ible barrier loading. An input circuit may be connected to any type A sub-controller in the loop of lower order sub- controllers provided its priority in that loop is correct.

Output loads 13 connected to the type A sub-controllers, such as 1, may be lamps, LEDs with current limiting resistors, controlled current LEDs, mimic indicators, relays or opto-couplers etc. The output circuits are also fed via the barrier 28 and again more than one such circuit may be connected to each barrier subject to permissible barrier loading.

Fibre-optic data links between sub-controllers have been omitted from Figure 4 for clarity.

The operation of the illustrated network will now be briefly described with reference to all the accompanying drawings where appropriate.

The CPUs 19 of the sub-controllers are initially programmed to contain executive rules of operation^' to be determined by measured system parameters. These rules are compiled from information supplied by system site engineers and are specific to the particular site and system to which the network is connected. The information is captured by means of a special interface (not shown) and stored in the programming box 14. The programming box 14 is temporarily attached to the network master controller 7. It constructs executive rules for each of the sub-controllers from the stored information and transmits these to the designated sub-controllers via the fibre-optic data links 6, 8 and 9. In this way an operational strategy is dispersed throughout the network which then contains a large number of local intelligent nodes in the form of the sub-controllers. It is therefore unnecessary to send engineers to each sub-controller and errors are minimised. The sub- controllers are programmed almost simultaneously so that problems due to parts of the network being out of step are avoided.

Under normal conditions the type A sub-controllers such as 1 monitor the locally attached sensors 12. When any change occurs, the sub-controllers do two things:-

(a) They launch a message to the network master controller 7 informing it of the change.

(b) They inspect their locally held executive rules tables to see if any action is required.

The required actions resulting from a change, or a logical combination of changes defined by the executive rules, may result in either:

(a) Initiating a change to a local actuator 13 such as an alarm klaxon or a halon deluge etc., or

(b) Launching a message to the network master controller 7 or to some other sub-controller in the network. When a sub-controller receives a message from another sub-controller, this will also be treated as a change which may cause it to take further action depending on the contents of its executive rules.

Thus any sensor 12 in the network can, via a series of logical steps as complex as may be desired, cause the activation of any actuator in the network. This will operate without any intervention from the site main computer or the master network controller 7.

Meanwhile, the master network controller 7 is constantly accepting messages from all sub-controllers- in the network, and maintaining a complete picture of the state of every actuator 13 and sensor 12 in the network. This information is made avail¬ able to the main site computer 10.

This system is extremely difficult to disrupt. Each sub-controller is also constantly monitoring all the communications links to which it is attached, even when no messages are being passed, by passing network status tokens of various types. Therefore a failure in any link is immediately detected.

Such a failure is, of course, an event to be reported and, like any other change, could give rise to further corrective actions.

Also, when a failure occurs, each sub-controller automati¬ cally arranges for messages to be re-routed through the network to avoid the failed path. Given the high level of redundancy in the network structure the system will continue to operate correctly under conditions where many of the links have been destroyed.

When one sub-controller, or one sub-section of the network becomes isolated from the master network controller 7 by the destruction of every single possible communications path, it will finally become impossible to continue to report status to the master network controller. However, the sub-section of the network will itself continue to operate in an appropriate manner, depending on its executive rules, with the knowledge of what links in the system are not operating. If one or more network links are subsequently repaired, the isolated sub-section of the network may become non-isolated. This will be immediately detected, and the previously isolated section will then take special action by transmitting messages describing its status in full, thus allowing correct full operation of the network to resume. Thus it will be seen that in normal operation, only the 'star' part of the network will be used, for communication and reporting, with each sub-controller talking directly or indirectly to the master network controller. The 'loop' part of the network will be used for the automatic transmission of messages between the sub-controllers about the operational status of the sub-controllers, links, sensors and actuators in the network. Thus each sub-controller will be kept informed of the operational status of other relevant parts of the network. If a failure occurs, each sub-controller will then be in a position either to act as an intermediary for transmission of messages between other sub-controllers and the master network controller, or to select the appropriate other sub-controller as an intermediary for itself to talk to the master network controller. This status information will also enable each sub- controller to know when it must take over responsibility for a critical sensor or actuator normally controlled by an adjacent sub-controller.

Many other applications of the network structure according to the invention will now suggest themselves to those skilled in the control system art. The invention is not limited to communications networks such as that described above by way of example and may be applied to control systems in many techno¬ logical fields and using various power sources and signalling phenomena e.g. hydraulic or pneumatic systems.

Claims

1. An adaptive control system network including a hierarchical arrangement of controllers and sub-controllers characterised in that said hierarchical arrangement includes at least one loop of sub-controllers (2...3) each of which is also connected to a sub-controller (5 ) of higher order.

2. An adaptive control system network as claimed in claim 1, characterised in that said network is programmable in that each sub-controller (1, 2, 3 , 4 , 5 ) comprises a programmable nodal element.

3. An adaptive control system network as claimed in claim 2, characterised in that said network is programmed so that in operation failed links ( 6 ) between nodal elements are automatically re-routed via other nodal elements and nodal elements are substituted for failed nodal elements and carry out the failed nodal elements' rorr-munications, monitoring or control tasks.

4. An adaptive control system network as claimed in claim 2, characterised in that said prograπunable nodal elements in said network are essentially similar and said network further includes, and permits communication between, a programmable master network controller (7) and a plurality of control devices (12, 13) such as sensors, switches or actuators.

5. An adaptive control system network as claimed in claim 4, characterised in that each programmable nodal element includes a program store, a microprocessor (19) and, means (22, 23 ) for communicating with the prograirttrable master network controller (7) directly or via a higher order nodal element, with a lower order nodal element directly or via a lower order nodal element, and with two adjacent nodal elements of the same hierarchical order.

6. An adaptive control system network as claimed in claim 4 or claim 5, characterised in that the master network controller (7) and the nodal elements (1, 2, 3, 4, 5) are programmed to respond to a failure of a link (6, 9) between any nodal element and the master network controller by re-routing said link via another nodal element and re-programming the nodal elements accordingly, and to respond to a failure of a nodal element by actuating a nodal element adjacent the failed nodal element and in the same loop thereby to take over its monitoring, control or cx__nτunications functions as appropriate.

7. An adaptive control system network as claimed in claim 6, characterised in that the master network controller (7) communicates directly with only one nodal element (4) , is connected via an input and a suitable interface unit (11) to a computer (10) and has a further input for temporary connection to programming means (14 ) for initially programming said programmable master network controller and said programmable nodal elements of said network.

8. An adaptive control system network as claimed in claim 4, characterised in that the links (9) between the master network controller (7) and the nodal elements (4) and between nodal elements (6, 8) are fibre-optic cc-iirunications links.

9. An adaptive control system network as claimed in claim 4, characterised in that said programmable nodal elements, whilst essentially similar, are of two types; typeA (1, 2, 3) having means for attachment to a plurality of sensors, switches or actuators (12, 13), and type B (4, 5) having means for connection or communication with lower order nodal elements, and wherein each nodal element, whether type A or type B, has a power converter designed to operate from a low voltage supplied by a common d.c. power source via a Zener diode barrier so that said power source and master network controller (7) may be located in a relatively safe area whilst the nodal elements and the sensors. switches or actuators may be located in a relatively hazardous area.