Logic Solver Analog Voter function block execution

Basic Block Operation

Voting in the Analog Voter function block is an M out of N function. That is, M inputs of the total N inputs must vote to trip. For example, the block can be configured as a 2oo3 (two out of three) voter, where two of the three inputs must exceed the trip limit before the output is tripped. The output of the block (OUT_D) is typically wired to an LSCEM (Cause and Effect Matrix) block or to a LSMON (Monitor) block, which interpret the value as either a safe or dangerous process state. OUT_D is either Normal or Tripped. For CSLS major revision 2, the actual value (TRUE or FALSE) depends on the value of the LOGIC_TYPE parameter.

The LSAVTR block has three inputs by default. The number of inputs is extensible from 1 to 16. The M value corresponds to the parameter NUM_TO_TRIP (default value is 2). Common voting schemes include 2oo3, 1oo2, and 2oo2. Other features of the block make it useful for single transmitter applications as a 1oo1 voter.

To determine whether an input is a vote to trip the value is compared to the limit value (TRIP_LIM). The configuration parameter DETECT_TYPE determines whether the comparison is Greater Than (high limit) or Less Than (low limit).

In addition to trip limit detection the block also compares the inputs to a common PRE_TRIP_LIM and applies voting to determine a pre-tripped condition.Pre-trip voting is typically used as a pre-alarm condition, but it is possible to expose the PRE_OUT_D parameter as a block output so that a single voter block can initiate trip demand logic for two different trip points.

A vote to trip must remain a vote to trip for a configured time (TRIP_DELAY) before the output changes to tripped. When the vote to trip clears, it must remain clear for NORMAL_DELAY before the output changes to the normal state. The delays apply to both the OUT_D and PRE_OUT_D outputs. The default value for both delays is 0.0 seconds. The TRIP_STATUS and PRE_TRIP_STATUS parameters indicate the state of the vote to trip. For example, the possible values for TRIP_STATUS are:

• Normal

• Tripped

• Voted to Trip, Delayed

• Voted Normal, Delayed.

• Trip Inhibited (when applicable)

Startup and Maintenance Bypass Options

It is often necessary to force a voter block's output to remain at the Normal value during plant startup to prevent a trip caused by inputs that have not stabilized at their normal operating values. You may also want to bypass inputs to allow for sensor maintenance. By default, you can bypass only one input of the block at a time. The bypassed input cannot vote to trip.

The following sections explain how to use the BYPASS_OPTS options to implement startup and maintenance bypasses.

Bypassing Inputs

If you have voter blocks with 1oo2 or 1oo1 voting schemes you may want the ability to bypass inputs to allow for maintenance. Voters that require multiple votes to trip can benefit from bypass functions as well, resulting in more predictable behavior during transmitter maintenance. Default block behavior requires that BYPASS_PERMIT be true to bypass inputs. You can configure BYPASS_PERMIT to be set by a display button or physical switch (discrete input to the SIS module). 

If your application does not require permission before inputs can be bypassed you can select the BYPASS_OPTS option Bypass permit is not required to bypass.

Reducing the Number to Trip

By default, a block configured as an MooN voter becomes an Moo(N-1) block (a 2oo3 voter becomes a 2oo2 voter) when an input is bypassed because the bypassed input cannot vote to trip. Selecting the BYPASS_OPTS option A maintenance bypass reduces the number to trip causes an MooN voter to become an (M-1)oo(N-1) voter (reduces the number required to trip by one when an input is bypassed).

The following table shows the effect the BYPASS_OPTS option A maintenance bypass reduces the number to trip has on the actual number to trip (A_NUM_TO_TRIP) for several voting schemes. Note that in no case is A_NUM_TO_TRIP less than one.

Allowing Multiple Bypasses 

If your application requires, you can enable bypassing multiple inputs simultaneously by selecting the BYPASS_OPTS option Multiple maintenance bypasses are allowed.

If multiple bypasses are set, deselecting the BYPASS_OPTS option Multiple maintenance bypasses are allowed prevents further bypasses being set but existing bypasses remain set. Additional bypasses cannot be set until all existing bypasses are cleared.

Maintenance Bypass Timeout

You can configure a maintenance bypass to be active for a finite time using BYPASS_TIMEOUT. Its default value is 0.0 seconds, which means no timeout is applied (maintenance bypasses remain active until BYPASSn parameters become False, either by changing True BYPASSn parameters to False or changing BYPASS_PERMIT to False).

When BYPASS_TIMEOUT is non-zero, BYPASS_TIMER is preset to BYPASS_TIMEOUT seconds when the first BYPASSn parameter becomes True (not when BYPASS_PERMIT becomes True). Each module scan thereafter BYPASS_TIMER is decremented until it times out (unless all BYPASSn parameters become False, in which case the block resets BYPASS_TIMER to 0.0).

BYPASS_TIMER is common to all inputs. The value of BYPASS_TIMER does not change when a second BYPASSn parameter is changed to True (if multiple bypasses are allowed). When BYPASS_TIMER times out, the block default behavior changes all True BYPASSn parameters to False. If you use bypass timeouts, do not expose BYPASSn parameters as block inputs and wire to them. Doing so will prevent the block from removing bypasses upon timeout. If you need to manipulate BYPASSn parameters from SIS module logic, use an LSCALC block to conditionally assign them.

Optionally, you can use the bypass timer for indication only by selecting the BYPASS_OPTS option Maintenance bypass timeout is for indication only.This causes the timeout of BYPASS_TIMER to activate a notification alarm (AVTR_ALERTS Expiration Reminder), but does not undo bypasses.

Bypass Timeout Reminder

You can configure the block to remind operators that a bypass timeout is imminent. By default, the block does not notify. There are two ways you can cause a notification:

• For bypasses with a configured timeout, you can cause notification in advance of the timeout by setting REMINDER_TIME to a non-zero value. When BYPASS_TIMER is non-zero but less than or equal to REMINDER_TIME, the alarm condition (AVTR_ALERTS Expiration Reminder) is active.

The bypass timer is re-armed only after the first bypass. However, BYPASS_TIMER is a writeable parameter. After notification that a timeout is about to happen, BYPASS_TIMER can be incremented using a display button or some other suitable technique to extend the time.

• A second approach is available when you are using the bypass timeout for indication only, that is, bypasses are not removed when BYPASS_TIMER expires (the BYPASS_OPTS option Maintenance bypass timeout is for indication only is selected). In this case the reminder alarm condition becomes active when BYPASS_TIMER times out even if REMINDER_TIME is 0.0. If REMINDER_TIME is non-zero, the reminder occurs prior to timeout. If BYPASS_TIMER times out, the reminder is active and remains active until all bypasses have been removed.

The following table describes the behavior of the bypass timeout and reminder function for three different configuration setups.

Startup Bypass Trip Inhibit

It is often necessary to force a voter block's output to remain at the Normal value during plant startup to prevent a trip caused by inputs that have not stabilized at their normal operating values. This startup bypass allows the process to reach normal operating conditions without tripping. Use the STARTUP and associated parameters for startup bypasses. Do not use maintenance overrides for this purpose.

Timed Startup Bypass (the BYPASS_OPTS option Startup bypass duration is event based is not selected)

On a rising edge of the parameter STARTUP the block forces OUT_D and PRE_OUT_D to the normal state value for a configurable length of time defined by STARTUP_TIME. When the countdown timer STARTUP_TIMER times out, the block resumes normal trip detection. The default behavior of the block is such that a subsequent rising edge of STARTUP does not affect the startup time while STARTUP_TIMER is timing down. To avoid a pending trip on timeout, you can allow each rising edge of STARTUP to re-arm STARTUP_TIMER (by selecting the BYPASS_OPTS option Startup bypass preset is allowed while active).

A reminder becomes available to STARTUP bypasses by selecting the BYPASS_OPTS option Reminder applies to startup bypass. When STARTUP_TIMER is greater than 0.0 but less than REMINDER_TIME, the reminder alarm condition (AVTR_ALERTS Expiration Reminder) is active. The reminder alarm condition is common to the timeout of maintenance and startup bypasses.

Another option is to have the startup timer expire when inputs have stabilized, that is, when there have not been enough votes to trip for a configurable period of time. When the BYPASS_OPTS option Startup bypass expires upon stabilization is selected, the bypass timer expires when the process stabilizes. While STARTUP_TIMER is timing down, STABLE_TIMER times up whenever there are not enough votes to trip and resets whenever the trip votes equal or exceed the number required to trip.

If STABLE_TIMER reaches the configured STABLE_TIME, STARTUP_TIMER resets to 0.0 and normal trip detection resumes. While STARTUP_TIMER is timing down, the block increments TIME_TO_STABLE and stops as soon as the STABLE_TIMER is triggered. TIME_TO_STABLE indicates the total number of seconds during the startup bypass until the inputs become and remain stable (assuming STARTUP_TIME is sufficiently long).

STABLE_TIMER does not reset at the end of the startup time period, but is reset at the beginning of a startup and at any time during the startup when there are enough trip votes. TIME_TO_STABLE is reset at the beginning of a startup bypass. STABLE_TIMER and TIME_TO_STABLE are processed even when the stabilization option is not used (the BYPASS_OPTS option Startup bypass expires upon stabilization is not selected). You can use the value of TIME_TO_STABLE to optimize the configured STARTUP_TIME.

Event-Based Startup Bypass (the BYPASS_OPTS option Startup bypass duration is event based is selected)

When the startup bypass expires based on an event rather than a fixed time period, select the BYPASS_OPTS option Startup bypass duration is event based. This ends the startup bypass when the parameter STARTUP becomes False. STABLE_TIMER and TIME_TO_STABLE are not processed. They are set to 0.0 when STARTUP becomes True.

Bypass Permit Control

When the BYPASS_OPTS option Bypass permit control should be visible in operator interface is selected, the block faceplate contains a button which operators can use to set BYPASS_PERMIT. Do not select this option if logic in the SIS module is writing to BYPASS_PERMIT (for example, a keyswitch is used to permit bypassing).

The following table summarizes the BYPASS_OPTS options and their effects.