The Missing Link A generic process control model

Transcription

1 1 of 1 The Missing Link A generic process control model Spiro Georgakopoulos and Robert Price Quem Associates Pty Ltd. Melbourne, Victoria 3078 Australia Automation vendors are releasing more and more sophisticated control tools into the marketplace. Object orientated, encapsulation, compatibility, integration are the catch words, but without an adequate process control model, the new automation tools can mask the underlying process leaving a legacy of poorly structured code that is decoupled from the process and becomes a validation and maintenance nightmare. The S88.01 Batch Control Standards introduces high level concepts and terminology, but makes no attempt to prescribe programming structures. Vendors themselves typically ask the customer how they want the process structured, rather than imposing a solution. However, even if vendors stipulated a structure, the degree of portability between automation hardware platforms may be compromised. What is missing is a conceptual process control model that will structure the detail in a consistent way, so that configuring the system will not be a one off exercise. Instead, configuration becomes a matter of populating a structure, which introduces consistency across a site and from job to job. This paper outlines such a structure, and the presentation includes a simulation model of a four unit plant using MSExcel and VB. The approach is firmly based in S88 principles and is independent of vendor solutions that is, it can be implemented on a variety of hardware platforms. It is tailored towards batch process solutions, but could easily be modified to cope with continuous processes. The structure offers quicker development time, individual programmer idiosyncrasies are minimised, code maintenance made simpler and (the biggest benefit of all), the control system exhibits robust, predictable behaviour. INTRODUCTION The emphasis on computer programming concepts such as Object Oriented Programming, Encapsulation, Information Hiding etc. in process control literature often obscures what process control engineering is about process control. ISA S88.01[1] for all its real advantages, introduces layers of abstractions and terminology which often distract attention away from the underlying processes. In this paper, we will focus on the very foundations of a S88 modelled plant S88 plant decomposition, in particular the Unit and Equipment modules. Decomposition and the associated process modelling is crucial to the successful operation of the plant and is the foundation of the higher level benefits of S88. Curiously, the S88.01 standard is silent on decomposition process, excluding it from its ambit. We present a model and methodology that permits the modelling of any process in a consistent and reproducible format. For illustration, we then apply the methodology to the example process used by Fleming and Schreiber [2] in their 1998 paper to illustrate S88.01 concepts. The first part of the paper looks at the limitations of the S88 standard and how the proposed methodology addresses those limitations. The second part describes the model and the methodology; the third part works through the example.

2 S88.01 LIMITATIONS AND SOLUTIONS The S88.01 standard explicitly excludes offering any specific guidance in the area of low level decomposition. It expressly draws a line above the protective layer - total explanation of process segmentation is beyond the scope of this standard. At the same time, the standard recognises the difficultly and importance of decomposition to the whole modelling exercise - Effective subdivision of the process cell into well defined equipment entities is a complex activity, highly dependent on the specific environment in which the batch process exists. A poor decomposition can be recognised by a high number of dangling control modules that the batch server must monitor and manage. In addition, methodologies which treat the protective layer separately from the process result in a large number of interlocks that need to be enabled or defeated with each phase. Either way, the modularity aspect of S88 which promises so much is compromised in a tangle of special cases. The proposed methodology arrives at the same destination of S88 i.e. a process decomposed into objects to which OOP can be applied. The model is specified in terms of commonly used terms and uses concepts understood by most practicing process engineers. neither new vocabulary nor a specialised notation system must be learned in order to begin using the methodology. In addition to providing a tight specification, the methodology is transparent and offers many hooks for formal design qualification. This model differs from the S88.01 model in that The protective safety layer is included The procedural and physical models are supplemented by consideration of equipment purpose and performance (constraints) from the bottom up. A CONSTRAINTS BASED MODEL Process equipment is selected and installed with a clear expectation of the purpose it will serve in terms of the physical and chemical processes it is to encounter. A process modelling exercise must recognise those constraints and incorporate them. The most fundamental of all constraints is the requirement that material be constrained with in the process boundary. The identity of the boundary is often dynamically changing as material is transported through the process from unit to unit. One of the key performance measures of an operating process plant is how well material is contained with in the process. In selecting the equipment a number of physical and safety constraints are imposed, beyond which it cannot operate. In a plant as a whole additional constraints derived from the interaction of equipment come in to play. These constraints can be categorised as equipment based or downstream derived. Equipment based constraints may be physical things like maximum operating temperature, pressure and volume. Or they may be a chemical (material) constraint a vessel must never process material with ph less than 5, or there may be constraints on what materials may be mixed in a vessel, etc. Downstream constraints include things such as transfer rates (pump capacities), temperature at which material may be transported at etc. A successful model incorporates all the constraints

3 THE METHODOLOGY 1) Break the plant equipment network into functional modules. We will refer to them as Equipment Entities - EEs. These EE later become classed as units or equipment modules. An EE will typically centre on a vessel or a pipe junction. 2) Identify the boundaries of the EEs. If it is not clear, use a virtual device to help clarify the boundary 3) Identify the flow direction as seen by the entity under consideration for each of its connections. Is flow coming in, going out or may it flow in both directions through the connection? Boundary Devices Each EE s boundary devices play a special role in this model. They form the basis of the protective layer. The operation of each boundary device may be constrained by flow, material compatibility and temporal considerations. ie., the boundary devices enforce the equipment and downstream constraints. 1) Allowable flow directions (one or two). Does the device act to allow flow in or out? If bi-directional flow is allowed, flow direction will need to be nominated before the EE is used. 2) An input isolating device can only be opened if a) The EE capacity to receive is not exceeded (e.g. tank level below limit) b) EE equipment state entered by opening input device is a valid state (e.g. Drain valve must be closed before addition of reagent) c) The material upstream is compatible with the material with in (Batch ID, Batch Status) 3) An output isolating device can only be opened if a) The downstream input isolating device is open b) The material contained is approved for transfer (tested, mixed, at temperature etc ie some quality constraints satisfied ) 4) A locked isolation device, may be locked open or locked closed (eg a relief/vent header should not be isolated or if a device is present must be locked open ). 5) An additional boundary classification is based on whether the connection to another EE is Fixed, (a permanent connection such as pipe), or must be Fitted ( when a connection is to be made before transfer eg hoses) Identify the Permitted States of the Boundary Devices 1) Determine whether the EE may be have more than one input/output simultaneously active 2) Develop a flow constraints Matrix, showing which input can be directed to which output 3) Every EE will have defined allowed equipment states. In many cases, the flow constraint matrix shows all of these, in other cases, additional non-flow constraints need to be imposed. 4) These allowed equipment states are the equipment Phases that may be actioned. 5) Flow interruption is transmitted from neighbour to neighbour. Each entity maintains a Can Receive Status and a Can Supply Status. These States manage entity boundary behaviour. (See Status Tags, below) 6) Propagation of attributes is in flow direction. If flow path established the material attributes (Batch/quality) are inherited by the down stream entity. Status Tags Every entity will have a number of status tags, showing the current state of the entity with respect to different aspects.

4 Each status tag represents the EE seen as a finite state machine. Rules specific to that state machine apply to consistently all EEs in the plant. States may propagate upwards to higher levels and down to lower levels according to defined rules. The status Tags can be visualised as flip boards or post it notes stuck to the equipment. At any time, a new operator can walk up to the EE and determine the exact state it is in. Typical Status Tags are as follows: Equipment Related. Status Tags Procedural Status [Running, Held, Paused, Stopped] Hygiene Status [Clean, Exposed, Dirty] Owner (Who has acquired the equipment Recipes, batches, operators, maintenance) Phase (e.g. [Heat, Fill]) Coupling Status [Can supply/ Cannot Supply], [Can receive / Cannot receive] Material Related Status Tags Batch Material ID Batch Material Quality State (Tested / Approved / Quarantined). Note that material properties are inherited from the upstream entity. Where one material is pooled with another and new material created, a status flag to identify the new material is required. States and interlocks The Owner status provides a simple mechanism to ensure product integrity. The upstream boundary device looks to the downstream device s Owner status tag. Flow is allowed only when both parties have a common owner. Once common ownership status is confirmed, the Coupling status tag is checked. The upstream tag must be Can Supply and the downstream tag Can Receive before any process fluids can flow. Note that this simple protective mechanism is universal and will still function if the higher level supervisor layers fail.

5 EXAMPLE The methodology outlined above is applied to an example as shown in Figure 1. The example chosen is the Two Premix, Two Reactor example from Fleming, D.W., and Schreiber, P.E. (1998) paper. Figure 1 - Example P&ID: Two premix tanks and two reactors The salient process information: two premix tanks two reactors four reagents All the vessels have some unique attributes The four reagents may be fed to some or all the tanks All four reagents may be simultaneously in use, A vessel may have more than one reagent being added at the same time

6 How do we start to decompose? Start by consideration of an idealised process. In the ideal process each reagent header would have the ability to isolate flow into it and out of it as shown in Figure 2. The idealised reagent header would have: An upstream isolation device A flow meter A flow regulating device An isolation device at each downstream take off. Figure 2 - Idealised Reagent Header Similarly, each vessel can be idealised as having a reagent addition header as shown in Figure 3. A vessel reagent addition header consists of : an isolating device for each reagent an isolating device at the vessel. Figure 3 - Idealised Vessel Reagent Header Likewise, the flow branching manifold can be idealised to a simple three way junction. The next step is to redraw the P&ID, showing the identified EEs as Idealised devices. Then draw the EE s boundaries as shown in Figure 4.

7 Drawing in virtual devices (in this case virtual valves) can help visualisation of process flows. Figure 4 - P&ID with Virtual devices shown Vessel reagent header EE - example For example, taking the vessel reagent header EE based on Reactor 1 (refer to figure 3). Process constraints shall determine how many simultaneous additions may be in progress simultaneously. For example, the simultaneously addition of reagent 1 and 3 may be prohibited for chemical compatibility reasons whilst the simultaneous addition of reagent 1 and 2 may be prohibited because of physical reasons such as the possibility of back flow of reagent 1 into the reagent 2 header. Reagent 2 and 3 are also chemically incompatible. Thus out of 10 possible addition combinations 3 are disallowed The material compatibility maps directly on to the boundary device. The combination of selecting the active inputs and outputs uniquely identifies the phases to be executed. The permitted equipment states (remaining after constraint imposition) for the vessel addition header define the procedural phases that the entity may execute eg Adding #1, Adding #1&#2, Adding #2 etc. In addition no input may open unless the vessel isolation is open. The design of low level interlocks can then be derived directly from the constraints matrix and checks on the presence of a common status either side of the boundary (common owner, quality, capacity limits etc.)

8 Transfer lines EEs - example Now look at the transfer lines between Premix vessel and Reactor vessels The transfer lines connecting the premix vessels to the reactors need to support the following: Both premix vessels transferring One premix crossing over to the reactor The need to support parallel operation necessitates defining two EE out of the transfer lines Figure 5: Diagram of transfer lines with added virtual valves between vessels Virtual valves are added as an aid to design and process visualisation (TR1V1, TR1V3, TR1V1, TR1V2, TR1V3) as shown in Figure 5. Bi-directional flow is permitted through TR1V2 and TR2V2. Flow direction is critical in consideration of interlock design. From flow direction considerations and the imposition of the constraint that a premix vessel s contents can be transferred to one destination at a time. (Parallel flows are not permitted). This uniquely identifies the permitted states for the equipment and permitted states for the equipment and permitted operations phases ie Premix 1 to Reactor 1, Premix 1 to Transfer 2 and Transfer 2 to Reactor 1. The state/phase selected determines whether a valve may be open (Quality/Capacity constraints ignored) This suggests that consideration of owner is tied up with the permitted state. Transfer 1 having the same owner as Premix 1 and Transfer 2 is the condition to be satisfied for transition from the boxed in state to the Premix 1 to Reactor 1 state For a transfer to occur the premix vessel and destination reactor must be acquired, owned by the same batch

9 In addition one or more transfer EE will also need to be acquired by the batch. Why go to all this apparent complexity? Won t the supervisory logic look after security? Yes but we want security even if the process is not automated. If premix 1 and premix 2 are transferring to their respective reactors and the material must not be mixed there is a need for some safety interlock. The virtual valves introduced are used for design of protective logic to be utilised in interlock design and for phase state definitions. The above methodology is implemented in Excel /VB for specification of constraints status. In order to design an effective interlock strategy Ownership status needs consideration. The same principle applies when carrying out a maintenance operation on plant. Equipment to be worked on is isolated from the surrounding plant. Where physical isolation devices are present they are closed and tagged slip plates added etc. Slip plates can be viewed as the isolating device controlled by the entity that does not want fluid transferred into it. The purpose of this exercise is to demonstrate that the processing that is to be carried out on a piece of equipment needs to be considered during the design of the low level protective systems that are expected to operate independently of the procedural layer. But in preparing the procedural layer the same considerations need to be taken into account in generating the recipe procedures. Conclusion, boundary S88 model is arbitrary and unhelpful. CONCLUDING REMARKS Under the model proposed the number of entities that must be referenced by the Co-ordinating logic has been reduced from 16 to 10. In addition, the approach taken can be relied upon to generate a consistent and reproducible outcome an any process it is applied to. An additional benefit is that the design of the low level safety layer is incorporated into the plant model. Note that thus far we have not introduced a high level supervisory structure or postulated that such an entity should exist, or where it may reside. This is an important part of the methodology s design philosophy that control must be kept as local as possible. The rationale is to reduce the complexity of the supervisory layers. This results in a robust and versatile system, more easily specified and validated. Note also that a complete record of the progress of a processing activity can be maintained by looking only at the Status Tags. REFERENCES 1 ANSI/ISA S Batch Control, Part 1:Models and Terminology 2 Fleming, D.W., and Schreiber, P.E. (1998), Batch Processing Design Example Or Why The Time To Change Was Yesterday, presented at the World Batch Forum, 1998 ( /publications)