WO2010008701A2

WO2010008701A2 - Apparatus and method for fault-tolerant presentation of multiple graphical displays in a process control system

Info

Publication number: WO2010008701A2
Application number: PCT/US2009/046555
Authority: WO
Inventors: Adam Gibson; Ian Duncanson; Ashley Noble
Original assignee: Honeywell International Inc.
Priority date: 2008-06-11
Filing date: 2009-06-08
Publication date: 2010-01-21
Also published as: WO2010008701A3; US8312384B2; US20090313569A1

Abstract

A method includes executing first processes (216) to generate graphical displays. At least one graphical display includes a user interface associated with a process system. The method also includes executing a separate second process (208) to generate a window for presentation to an operator. The method further includes inserting the graphical displays into the window and presenting the window with the graphical displays to the operator. The method could also include executing a separate third process (202) to control the first and second processes. The third process could represent a watchdog that terminates and restarts processes in response to detecting a fault or that prioritizes the processes. The method could further include executing a separate fourth process (222, 226) to provide a service, which includes a function invoked on behalf of at least one of the first and second processes.

Description

APPARATUS AND METHOD FOR FAULT-TOLERANT PRESENTATION OF MULTIPLE GRAPHICAL DISPLAYS IN A PROCESS CONTROL SYSTEM

TECHNICAL FIELD

[0001] This disclosure relates generally to process control systems and more specifically to an apparatus and method for fault-tolerant presentation of multiple graphical displays in a process control system.

BACKGROUND

[0002] Processing facilities are often managed using process control systems. Example processing facilities include manufacturing plants, chemical plants, crude oil refineries, and ore processing plants. Among other operations, process control systems typically manage the use of motors, valves, and other industrial equipment in the processing facilities.

[0003] Conventional control systems often include graphical displays that provide operators with information about monitored processes. For example, graphical displays could allow operators to ensure proper operation of the monitored processes and to resolve problems with the monitored processes. Other types of graphical displays (such as human-machine interface or "HMI" view components) can augment these process control displays, such as when they are used to present information related to advanced process control or process optimization. A view component could be embedded within another graphical display, located in the same window as another graphical display, or located in its own window.

[0004] A problem in conventional control systems is that a fault in one graphical display can often interfere with the operation of other graphical displays. For example, a software fault in one view component could cause a failure in another view component or other graphical display. While managed code and application domains can be used in the MICROSOFT .NET FRAMEWORK to isolate non-user interface components, this typically cannot be used with user interfaces or with older or non-managed code. SUMMARY

[0005] This disclosure provides an apparatus and method for fault-tolerant presentation of multiple graphical displays in a process control system.

[0006] In a first embodiment, a method includes executing a plurality of first processes to generate a plurality of graphical displays. At least one of the graphical displays includes a user interface associated with a process system. The method also includes executing a second process to generate a window for presentation to an operator, where the second process is separate from the first processes. The method further includes inserting the graphical displays into the window and presenting the window with the graphical displays to the operator.

[0007] In particular embodiments, executing the second process also generates one or more user interface mechanisms in the window, where the user interface mechanisms include a title bar, a toolbar, and/or a menu. Also, the window and the user interface mechanisms may remain visible to the operator when a fault occurs in one or more of the graphical displays.

[0008] In other particular embodiments, the method also includes executing a third process to control the first and second processes, where the third process is separate from the first processes and the second process. Executing the third process may include monitoring a status of each of the first and second processes, and terminating and restarting one of the processes in response to detecting a fault with the process. Executing the third process may also include monitoring an availability of system resources and prioritizing at least some of the first and second processes in response to detecting an inadequate availability of the system resources. The first processes could include view components generating the graphical displays, and prioritizing the first and second processes could include prioritizing the view components based on a relative importance of the view components.

[0009] In yet other particular embodiments, the method further includes executing a fourth process to provide a service, where the service includes a function invoked on behalf of at least one of the first and second processes. The fourth process is separate from the first, second, and third processes.

[0010] In still other particular embodiments, the second, third, and fourth processes form a framework. Also, the first processes are developed without any prior knowledge of the framework.

[0011] In additional particular embodiments, the method further includes passing first data from the second process to one or more of the first processes and passing second data from one or more of the first processes to the second process. The first and second data include operator inputs, and the operator inputs are passed between the processes transparently to the operator.

[0012] In a second embodiment, an apparatus includes a processor configured to execute a plurality of first processes to generate a plurality of graphical displays. At least one of the graphical displays includes a user interface associated with a process system. The processor is also configured to execute a second process to generate a window that includes the graphical displays, where the second process is separate from the first processes. The apparatus also includes a display interface configured to provide the window with the graphical displays to a display device for presentation to an operator. [0013] In a third embodiment, a computer program is embodied on a computer readable medium. The computer program includes computer readable program code forming a plurality of first processes configured to generate a plurality of graphical displays. At least one of the graphical displays includes a user interface associated with a process system. The computer program also includes computer readable program code forming a second process configured to generate a window that includes the graphical displays, where the second process is separate from the first processes. In addition, the computer program includes computer readable program code configured to output the window with the graphical displays.

[0014] Other technical features may be readily apparent to one skilled in the art from the following figures, descriptions, and claims.

BRIEF DESCRIPTION OF THE DRAWINGS

[0015] For a more complete understanding of this disclosure, reference is now made to the following description, taken in conjunction with the accompanying drawings, in which:

[0016] FIGURE 1 illustrates an example process control system according to this disclosure;

[0017] FIGURE 2 illustrates an example framework for fault-tolerant presentation of multiple graphical displays in a process control system according to this disclosure;

[0018] FIGURES 3A and 3B illustrate an example presentation of multiple graphical displays in a process control system according to this disclosure; and

[0019] FIGURE 4 illustrates an example method for fault- tolerant presentation of multiple graphical displays in a process control system according to this disclosure.

DETAILED DESCRIPTION

[0020] FIGURES 1 through 4, discussed below, and the various embodiments used to describe the principles of the present invention in this patent document are by way of illustration only and should not be construed in any way to limit the scope of the invention. Those skilled in the art will understand that the principles of the invention may be implemented in any type of suitably arranged device or system.

[0021] FIGURE 1 illustrates an example process control system 100 according to this disclosure. The embodiment of the process control system 100 shown in FIGURE 1 is for illustration only. Other embodiments of the process control system 100 may be used without departing from the scope of this disclosure.

[0022] In this example embodiment, the process control system 100 includes various components that facilitate production or processing of at least one product or other material, such as one or more sensors 102a and one or more actuators 102b. The sensors 102a and actuators 102b represent components that may perform any of a wide variety of functions. For example, the sensors 102a could measure a wide variety of characteristics in a process system, such as temperature, pressure, or flow rate. Also, the actuators 102b could alter a wide variety of characteristics in the process system, such as heaters, motors, or valves. The sensors 102a and actuators 102b could represent any other or additional components. Each of the sensors 102a includes any suitable structure for measuring one or more characteristics in a process system. Each of the actuators 102b includes any suitable structure for operating on or affecting conditions in a process system. Also, a process system may generally represent any system or portion thereof configured to process one or more products or other materials in some manner.

[0023] At least one network 104 is coupled to the sensors 102a and actuators 102b. The network 104 facilitates interaction with the sensors 102a and actuators 102b. For example, the network 104 could transport measurement data from the sensors 102a and provide control signals to the actuators 102b. The network 104 could represent any suitable network or combination of networks. As particular examples, the network 104 could represent an Ethernet network, an electrical signal network (such as a HART or FOUNDATION FIELDBUS network) , a pneumatic control signal network, or any other or additional type(s) of network (s) .

[0024] Two controllers 106a-106b are coupled to the network 104. The controllers 106a-106b may, among other things, use the measurements from the sensors 102a to control the operation of the actuators 102b. For example, the controllers 106a-106b could receive measurement data from the sensors 102a and use the measurement data to generate control signals for the actuators 102b. Each of the controllers 106a-106b includes any hardware, software, firmware, or combination thereof for interacting with the sensors 102a and controlling the actuators 102b. The controllers 106a-106b could, for example, represent multivariable controllers or other types of controllers. As a particular example, each of the controllers 106a-106b could represent a computing device running a MICROSOFT WINDOWS operating system.

[0025] Two networks 108 are coupled to the controllers 106a-106b. The networks 108 facilitate interaction with the controllers 106a-106b, such as by transporting data to and from the controllers 106a-106b. The networks 108 could represent any suitable networks or combination of networks. As particular examples, the networks 108 could represent a pair of Ethernet networks or a redundant pair of Ethernet networks, such as a FAULT TOLERANT ETHERNET (FTE) network from HONEYWELL INTERNATIONAL INC.

[0026] At least one switch/firewall 110 couples the networks 108 to two networks 112. The switch/firewall 110 may transport traffic from one network to another. The switch/firewall 110 may also block traffic on one network from reaching another network. The switch/firewall 110 includes any suitable structure for providing communication between networks, such as a HONEYWELL CONTROL FIREWALL (CF9) device. The networks 112 could represent any suitable networks, such as a pair of Ethernet networks or an FTE network.

[0027] Two servers 114a-114b are coupled to the networks 112. The servers 114a-114b perform various functions to support the operation and control of the controllers 106a- 106b, sensors 102a, and actuators 102b. For example, the servers 114a-114b could log information collected or generated by the controllers 106a-106b, such as measurement data from the sensors 102a or control signals for the actuators 102b. The servers 114a-114b could also execute applications that control the operation of the controllers 106a-106b, thereby controlling the operation of the actuators 102b. In addition, the servers 114a-114b could provide secure access to the controllers 106a-106b. Each of the servers 114a-114b includes any hardware, software, firmware, or combination thereof for providing access to, control of, or operations related to the controllers 106a- 106b. Each of the servers 114a-114b could, for example, represent a computing device running a MICROSOFT WINDOWS operating system.

[0028] One or more operator stations 116 are coupled to the networks 112. The operator stations 116 represent computing or communication devices providing user access to the servers 114a-114b, which could then provide user access to the controllers 106a-106b (and possibly the sensors 102a and actuators 102b) . As particular examples, the operator stations 116 could allow users to review the operational history of the sensors 102a and actuators 102b using information collected by the controllers 106a-106b and/or the servers 114a-114b. The operator stations 116 could also allow the users to adjust the operation of the sensors 102a, actuators 102b, controllers 106a-106b, or servers 114a-114b. In addition, the operator stations 116 could receive and display warnings, alerts, or other messages or displays generated by the controllers 106a-106b or the servers 114a-114b. Each of the operator stations 116 includes any hardware, software, firmware, or combination thereof for supporting user access and control of the system 100. Each of the operator stations 116 could, for example, represent a computing device running a MICROSOFT WINDOWS operating system.

[0029] In this example, the system 100 also includes a wireless network 118, which can be used to facilitate communication with one or more wireless devices 120. The wireless network 118 may use any suitable technology to communicate, such as radio frequency (RF) signals. Also, the wireless devices 120 could represent devices that perform any suitable functions. The wireless devices 120 could, for example, represent wireless sensors, wireless actuators, and remote or portable operator stations or other user devices.

[0030] At least one router/firewall 122 couples the networks 112 to two networks 124. The router/firewall 122 includes any suitable structure for providing communication between networks, such as a secure router or combination router/firewall. The networks 124 could represent any suitable networks, such as a pair of Ethernet networks or an FTE network.

[0031] In this example, the system 100 includes at least one additional server 126 coupled to the networks 124. The server 126 executes various applications to control the overall operation of the system 100. For example, the system 100 could be used in a processing plant or other facility, and the server 126 could execute applications used to control the plant or other facility. As particular examples, the server 126 could execute applications such as enterprise resource planning (ERP) , manufacturing execution system (MES) , or any other or additional plant or process control applications. The server 126 includes any hardware, software, firmware, or combination thereof for controlling the overall operation of the system 100.

[0032] One or more operator stations 128 are coupled to the networks 124. The operator stations 128 represent computing or communication devices providing, for example, user access to the servers 114a-114b, 126. Each of the operator stations 128 includes any hardware, software, firmware, or combination thereof for supporting user access and control of the system 100. Each of the operator stations 128 could, for example, represent a computing device running a MICROSOFT WINDOWS operating system.

[0033] In particular embodiments, the various servers and operator stations may represent computing devices. For example, each of the servers 114a-114b, 126 could include one or more processors 130 and one or more memories 132 for storing instructions and data used, generated, or collected by the processor (s) 130. Each of the servers 114a-114b, 126 could also include at least one network interface 134, such as one or more Ethernet interfaces. Also, each of the operator stations 116, 128 could include one or more processors 136 and one or more memories 138 for storing instructions and data used, generated, or collected by the processor(s) 136. Each of the operator stations 116, 128 could also include at least one network interface 140, such as one or more Ethernet interfaces . Each of the operator stations 116, 128 could further include at least one display interface 141 for interacting with a display device (such as a graphics interface to a CRT or LCD computer monitor) .

[0034] In one aspect of operation, to facilitate monitoring and control over one or more processes, one or more of the operator stations 116, 128 may include a framework 142 for presenting various human-machine interface (HMI) view components or other graphical displays to operators. In general, any suitable graphical displays can be used with the framework 142, such as graphical displays that visually represent one or more processes (or portions thereof) being monitored and/or controlled by the operators. As a particular example, a graphical display could contain a process schematic that graphically illustrates the equipment used to perform a particular process. Any other suitable graphical displays with any other content could also be presented to an operator. Further, any suitable number of graphical displays could be presented at the same time, allowing operators to view various displays related to the monitored processes.

[0035] In accordance with this disclosure, various graphical displays provided by the framework 142 are implemented using their own processes, which helps to isolate the graphical displays so that a fault in one display has a reduced impact (if any) on other displays. Also, the framework 142 can seamlessly integrate the graphical displays within one or more windows, meaning multiple graphical displays executed in separate processes can be presented in a single window to an operator. Interprocess communications can be used to pass operator inputs between processes, so an operator may not be required to select a particular graphical display in order to provide input to that graphical display. From the perspective of the operator, the graphical displays integrated into a single window appear to come from a single process. Moreover, the framework 142 enables the graphical displays to be developed without any prior knowledge of the framework. The framework 142 may integrate the graphical displays (both user interface and non-user interface displays) without imposing any restrictions on the development technology used to construct the graphical displays. For instance, there may not be a requirement to develop displays using .NET managed code. In addition, the framework 142 can provide for the prioritization of certain graphical displays over other graphical displays, which may be useful in situations such as resource-bound environments (like those with low CPU availability) .

[0036] In this way, a robust, fault-tolerant application environment is provided for graphical displays. Additional details regarding the framework 142 are provided below. The framework 142 includes any hardware, software, firmware, or combination thereof for isolating graphical displays and integrating the displays for operators. As a particular example, the framework 142 could use HMIWEB technology from HONEYWELL INTERNATIONAL INC. to generate and present graphical displays to operators. The HMIWEB technology uses hypertext markup language (HTML) and allows users to build process control displays (web pages) that are loaded onto operator stations 116, 128. The HTML displays may use INTERNET EXPLORER or other browser technology to extend the functionality of the web pages to allow process information to be displayed and to allow operators to control processes via the web pages. In particular embodiments, the framework 142 can operate within a larger system, such as within EXPERION systems from HONEYWELL INTERNATIONAL INC.

[0037] Although FIGURE 1 illustrates one example of a process control system 100, various changes may be made to FIGURE 1. For example, a control system could include any number of sensors, actuators, controllers, servers, operator stations, networks, and framework or other applications. Also, the makeup and arrangement of the process control system 100 in FIGURE 1 is for illustration only. Components could be added, omitted, combined, or placed in any other suitable configuration according to particular needs. In addition, FIGURE 1 illustrates one operational environment in which graphical displays can be isolated in separate processes and integrated for operators. This functionality could be used in any other suitable device or system.

[0038] FIGURE 2 illustrates an example framework 142 for fault-tolerant presentation of multiple graphical displays in a process control system according to this disclosure. The embodiment of the framework 142 shown in FIGURE 2 is for illustration only. Other embodiments of the framework 142 could be used without departing from the scope of this disclosure. Also, for ease of explanation, the framework 142 in FIGURE 2 is described as operating in the system 100 of FIGURE 1. The framework 142 could be used in any other suitable device or system.

[0039] As shown in FIGURE 2, the framework 142 includes various processes that can be executed separately and communicate with one another. In this example, the process communications are based on the WINDOWS COMMUNICATION FOUNDATION (WCF) technology, although any other suitable inter-process communications could be used in the framework 142.

[0040] In this example, the framework 142 includes a core process 202, which represents the process controlling the overall operation of the framework 142. Within the core process 202 are a window manager 204 and a service manager 206. The window manager 204 controls the presentation of windows to an operator. A window generally represents a defined (often bounded) area in which one or more graphical displays can be presented to an operator. The window manager 204 could, for example, control the generation, presentation, and removal of windows on an operator station's display (s) . Once a window is created, other elements in the framework 142 can populate the window with graphical displays. The window manager 204 includes any hardware, software, firmware, or combination thereof for controlling one or more windows presented on at least one display.

[0041] The service manager 206 controls one or more services provided in the framework 142. As described in more detail below, services represent functions (often common ones) that can be invoked by other elements of the framework 142 to provide desired functionality in the framework 142. In other words, the services represent functions made available to other elements of the framework 142, rather than being programmed directly into the other elements of the framework 142. The service manager 206 controls the use of these services in the framework 142. The service manager 206 includes any hardware, software, firmware, or combination thereof for controlling one or more services.

[0042] As shown in FIGURE 2, the window manager 204 can create one or more window processes 208. Each window process 208 is associated with a different window presented on an operator station's display (s) . For example, each window process 208 could generally be responsible for generating and presenting a window on a display and inserting graphical or other content into the window. In this example, each window process 208 includes one or more window user interfaces (UI) 210 and a view proxy 212. The window user interfaces 210 generate input/output (I/O) mechanisms in the window associated with the window process 208. For instance, the window user interfaces 210 could be used to generate a title bar, a menu, and a toolbar in the window associated with the window process 208. The window user interfaces 210 include any hardware, software, firmware, or combination thereof for generating and presenting one or more user I/O mechanisms.

[0043] The view proxy 212 allows one or more HMI view components or other graphical displays to be presented in the window associated with the window process 208. For example, the view proxy 212 could display one or more view components within a space that is not occupied by the title bar, menu, and toolbar of the window. The actual view components or other graphical displays are implemented as separate processes to help provide fault isolation between graphical displays. The view proxy 212 therefore allows a graphical display generated by a separate process to be presented in the window associated with the window process 208. The view proxy 212 includes any hardware, software, firmware, or combination thereof for presenting one or more graphical displays in a window.

[0044] In FIGURE 2, two window processes 208 are present in the framework 142. This is for illustration only. Any suitable number of window processes 208 could be present at any given time in the framework 142. For example, one window process 208 could be present when an operator is viewing information in a single window, or more than two window processes 208 could be present when an operator is viewing information in more than two windows.

[0045] The framework 142 further includes one or more extension UI processes 214. The extension UI processes 214 are generally used to add graphical displays to the windows generated by the window processes 208. In this example, each extension UI process 214 includes an extension view 216 and a view host 218. The extension view 216 represents the element of the framework 142 actually generating a graphical display to be inserted into a window via the view proxy 212. The extension view 216 includes any hardware, software, firmware, or combination thereof for generating a graphical display. In particular embodiments, the extension view 216 can be implemented using WINFORM CONTROLS, WINDOWS PRESENTATION FOUNDATION (WPF) CONTROLS, or WIN32 CONTROLS from MICROSOFT CORPORATION. The view host 218 acts as an interface between the extension view 216 and the window process 208. The view host 218 allows the graphical display generated by the extension view 216 to be loaded by the window process 208. The view host 218 includes any hardware, software, firmware, or combination thereof for providing access to a graphical display.

[0046] The extension UI processes 214 could also include one or more service proxies 220. A service proxy 220 allows one or more services to be invoked and used by an extension UI process 214. For example, the service proxy 220 could request performance of a certain function on behalf of the extension UI process 214, and the results of the function could be returned to the service proxy 220 and used by the extension UI process 214 (such as to insert data into a graphical display) . The service proxy 220 includes any hardware, software, firmware, or combination thereof for providing access to one or more external services or other functions.

[0047] In this example, two different types of services are provided in the framework 142. A platform service process 222 provides at least one service 224, and an extension service process 226 provides at least one service 228. The processes 222 and 226 are divided based on the types of services 224 and 228 implemented by the processes. The service 224 in the platform service process 222 may relate to operations of the core process 202 or window process 208 (such as a service related to the window user interface 210) . The service 228 in the extension service process 226 may relate to operations of one or more extension UI processes 214. Each of the services 224 and 228 includes any hardware, software, firmware, or combination thereof for providing one or more functions to external components invoking the service.

[0048] As shown here, two extension UI processes 214 are present in the framework 142. This is for illustration only. Any suitable number of extension UI processes 214 could be present at any given time in the framework 142, such as when one extension UI process 214 is present for each view component being presented to an operator. Also, while two service processes 222 and 226 each having one service 224 and 228 are shown in FIGURE 2, any suitable number of service processes could be used, and each service process could include any suitable number of services.

[0049] In addition, the core process 202 in this example includes a watchdog 230. The watchdog 230 generally monitors other elements of the framework 142 to identify problems with those elements, at which point the watchdog 230 could take suitable corrective action. For example, the watchdog 230 could periodically check the status of the window processes 208 and the extension UI processes 214. If a fault with one of the processes is found, the watchdog 230 can terminate and restart that process. Faults here could include (but are not limited to) software crashes, software exceptions, deadlocks, software resource depletion, or any other problem that could interfere with a process. The watchdog 230 could also periodically check system resource availability (such as CPU resource availability) . If inadequate system resources are available, the watchdog 230 can prioritize certain graphical displays over other graphical displays. For instance, the watchdog 230 could prioritize the view components based on a relative importance of the view components. In this way, the watchdog 230 can help to ensure that more important graphical displays receive system resources, even if it is at the expense of less important graphical displays. The watchdog 230 includes any hardware, software, firmware, or combination thereof for monitoring and adjusting the operation of one or more processes .

[0050] In this example, the processes 202, 208, 214, 222, and 226 are implemented as separate executable processes. As a result, a fault with one process (such as a process 208 or 214) may not affect other processes (such as another process 208 or 214) . As a particular example, a fault with a view component might not affect the operation of other view components (in the same window or in different windows) . Similarly, a fault with one window might not affect the operation of other windows. Because of this, the framework 142 provides a generally fault- tolerant environment, where problems with views and windows may not affect all views and windows being used by an operator. This may be particularly useful when view components are provided by third-party vendors, where the third-party vendors' view components may suffer from faults or other problems. The framework 142 can help to ensure that faults caused by the third-party vendors' view components are limited to those view components and do not affect other graphical displays used by operators.

[0051] In addition, as noted above, various inter^¬ process communications (such as WCF) can be used to transfer data between processes 202, 208, 214, 222, and 226 in the framework 142. Not only that, inter-process communications can be used to transfer data between elements of a single process 202, 208, 214, 222, or 226

(such as when the elements within the core process 202, the window process 208, or the extension UI process 214 are themselves separate processes) . Among other things, the inter-process communications may allow keystrokes and commands received by the window processes 208 to be passed from the window processes 208 to the extension views 216 via cross-process calls. Similarly, events, commands, and keystrokes that are received by the extension views 216

(but that cannot be handled by the extension views) can be passed to the window processes 208 as needed. In this way, an operator need not select a particular window process or extension UI process before providing a command or keystroke for that process. The user inputs and other information can be passed between processes in a manner that is transparent to the operator.

[0052] Although FIGURE 2 illustrates one example of a framework 142 for fault-tolerant presentation of multiple graphical displays in a process control system, various changes may be made to FIGURE 2. For example, any suitable number of each process could be used in the framework 142, and each process in the framework 142 could include any suitable number of elements within that process.

[0053] FIGURES 3A and 3B illustrate an example presentation of multiple graphical displays in a process control system according to this disclosure. In particular, FIGURES 3A and 3B illustrate example graphical displays that could be presented side-by-side on a single monitor or on separate monitors of an operator station. The example presentation shown in FIGURES 3A and 3B is for illustration only. Any other suitable graphical displays could be used and presented to an operator without departing from the scope of this disclosure. Also, for ease of explanation, the presentation shown in FIGURE 3 is described as being generated by the framework 142 of FIGURE 2. The framework 142 could present graphical displays in any other suitable manner.

[0054] In FIGURE 3A, a window 300 generally defines an area where graphical displays are presented, and different contents of the window are provided by different processes in the framework 142. For example, one portion 302 of the window 300 may represent a graphical display created and provided by a window process 208. Another portion 302 of the window 300 may represent a graphical display created and provided by an extension UI process 214, meaning this content is defined by an extension view 216. A third portion 306 of the window 300 could contain data provided by a service, such as the service 228 in an extension service process 226. In FIGURE 3B, a window 350 generally defines another area where graphical displays are presented, and different contents of the window 350 are provided by different processes in the framework 142. For example, one portion 352 of the window 350 may represent a graphical display created and provided by a second window process 208, and another portion 354 of the window 350 may represent a graphical display created and provided by a second extension UI process 214.

[0055] As can be seen in FIGURES 3A and 3B, each window 300 and 350 represents a single window with graphical displays and other contents from multiple processes. Because of this, when one view component suffers a fault or other problem, one area of a window 300 or 350 could be affected, but the remaining areas of the window may remain unaffected. Similarly, when one window 300 or 350 suffers a fault or other problem, the entire window 300 or 350 could be affected, but the other window may remain unaffected. This provides a level of fault tolerance in the presentation of information to operators, which can help to preserve at least partial views of a process when faults or other problems occur with graphical displays.

[0056] Although FIGURES 3A and 3B illustrate one example of a presentation of multiple graphical displays in a process control system, various changes may be made to FIGURES 3A and 3B. For example, any number of windows could be presented to an operator, and each window could have graphical displays from any suitable number of separate processes.

[0057] FIGURE 4 illustrates an example method 400 for fault-tolerant presentation of multiple graphical displays in a process control system according to this disclosure. The embodiment of the method 400 shown in FIGURE 4 is for illustration only. Other embodiments of the method 400 could be used without departing from the scope of this disclosure. Also, for ease of explanation, the method 400 is described as being performed by the framework 142 of FIGURE 2. The method 400 could be used in any other suitable device or system.

[0058] Execution of a first process is initiated at step 402. This could include, for example, the processor in an operator station initiating execution of the core process 202. As a particular example, this could include the operator station initiating execution of the window manager 204, service manager 206, and watchdog 230.

[0059] Execution of a second process associated with a window is initiated at step 404. This could include, for example, the processor in the operator station initiating execution of a window process 208. As a particular example, this could include the window manager 204 initiating execution of a window process 208, such as in response to an operator opening a new window. One or more user interface elements are presented to the operator in the window at step 406. This could include, for example, generating a title bar, menu, and toolbar in the window using the window user interfaces 210.

[0060] Execution of a third process is initiated at step 408. This could include, for example, the processor in the operator station initiating execution of an extension UI process 214. As a particular example, this could include the operator station initiating execution of an extension view 216, a view proxy 218, and optionally one or more service proxies 220. A graphical display from the third process is presented in the window at step 410. This could include, for example, generating a graphical display by the extension view 216 and providing the generated graphical display to the view proxy 212 via the view host 218. This could also include the view proxy 212 inserting the generated graphical display into the window associated with the window process 208.

[0061] A service provided by a fourth process is called to provide specified data at step 412. This could include, for example, the service proxy 220 invoking a service 224 or 228 in a service process 222 or 226. The data from the service is presented in the window at step 414. This could include, for example, the extension UI process 214 providing the data to the extension view 216 for inclusion in a new graphical display or for updating of a current graphical display. The new or updated graphical display is then provided to the window process 208 for presentation.

[0062] A determination is made whether a problem exists with the processes at step 416. This could include, for example, the watchdog 230 determining if any process is suffering from a fault or other problem. If so, one or more of the processes can be terminated and restarted at step 418. In this way, the watchdog 230 can help to correct faults experienced by the processes. Also, a determination is made whether resources are low at step 420. This could include, for example, the watchdog 230 determining whether available CPU resources in an operator station have fallen below a threshold. If so, at least some of the processes are prioritized at step 422. This could include, for example, the watchdog 230 prioritizing the processes based on user-specified values or based on any other information. As a particular example, this could include the watchdog 230 prioritizing one window process 208 over another or one extension UI process 214 over another. The watchdog 230 could take other actions as well, such as terminating lower-priority processes or ensuring that available system resources are assigned first to higher-priority processes.

[0063] At this point, the method 400 ends, and various steps in FIGURE 4 could be repeated. For example, steps 416-422 could be repeated as long as the graphical displays are presented to the operator. Also, various ones of steps 404-414 could be repeated when the operator invokes a new window, a new view, or a new service.

[0064] Although FIGURE 4 illustrates one example of a method 400 for fault-tolerant presentation of multiple graphical displays in a process control system, various changes may be made to FIGURE 4. For example, while shown as a series of steps, various steps in FIGURE 4 could overlap, occur in parallel, occur in a different order, or occur multiple times.

[0065] In some embodiments, various functions described above are implemented or supported by a computer program that is formed from computer readable program code and that is embodied in a computer readable medium. The phrase "computer readable program code" includes any type of computer code, including source code, object code, and executable code. The phrase "computer readable medium" includes any type of medium capable of being accessed by a computer, such as read only memory (ROM) , random access memory (RAM) , a hard disk drive, a compact disc (CD) , a digital video disc (DVD) , or any other type of memory.

[0066] It may be advantageous to set forth definitions of certain words and phrases used throughout this patent document. The term "couple" and its derivatives refer to any direct or indirect communication between two or more elements, whether or not those elements are in physical contact with one another. The terms "application" and "program" refer to one or more computer programs, software components, sets of instructions, procedures, functions, objects, classes, instances, related data, or a portion thereof adapted for implementation in a suitable computer code (including source code, object code, or executable code) . The terms "transmit," "receive," and "communicate," as well as derivatives thereof, encompass both direct and indirect communication. The terms "include" and "comprise, " as well as derivatives thereof, mean inclusion without limitation. The term "or" is inclusive, meaning and/or. The phrases "associated with" and "associated therewith," as well as derivatives thereof, may mean to include, be included within, interconnect with, contain, be contained within, connect to or with, couple to or with, be communicable with, cooperate with, interleave, juxtapose, be proximate to, be bound to or with, have, have a property of, or the like. The term "controller" means any device, system, or part thereof that controls at least one operation. A controller may be implemented in hardware, firmware, software, or some combination of at least two of the same. The functionality associated with any particular controller may be centralized or distributed, whether locally or remotely.

[0067] While this disclosure has described certain embodiments and generally associated methods, alterations and permutations of these embodiments and methods will be apparent to those skilled in the art. Accordingly, the above description of example embodiments does not define or constrain this disclosure. Other changes, substitutions, and alterations are also possible without departing from the spirit and scope of this disclosure, as defined by the following claims.

Claims

WHAT IS CLAIMED IS:

1. A method comprising: executing a plurality of first processes (216) to generate a plurality of graphical displays, at least one of the graphical displays comprising a user interface associated with a process system; executing a second process (208) to generate a window for presentation to an operator, the second process separate from the first processes; inserting the graphical displays into the window; and presenting the window with the graphical displays to the operator.

2. The method of Claim 1, wherein: executing the second process also generates one or more user interface mechanisms in the window, the user interface mechanisms comprising at least one of: a title bar, a toolbar, and a menu; and the window and the user interface mechanisms remain visible to the operator when a fault occurs in one or more of the graphical displays.

3. The method of Claim 1, further comprising: executing a third process (202) to control the first and second processes, the third process separate from the first processes and the second process.

4. The method of Claim 3, wherein executing the third process comprises: monitoring a status of each of the first and second processes; and terminating and restarting one of the processes in response to detecting a fault with the process.

5. The method of Claim 3, wherein executing the third process comprises: monitoring an availability of system resources; and prioritizing at least some of the first and second processes in response to detecting an inadequate availability of the system resources.

6. The method of Claim 3, further comprising: executing a fourth process (222, 226) to provide a service, the service comprising a function invoked on behalf of at least one of the first and second processes, the fourth process separate from the first, second, and third processes.

7. The method of Claim 8, wherein: the second, third, and fourth processes form a framework; and the first processes are developed without any prior knowledge of the framework.

8. An apparatus comprising: a processor (136) configured to: execute a plurality of first processes (216) to generate a plurality of graphical displays, at least one of the graphical displays comprising a user interface associated with a process system; and execute a second process (208) to generate a window that includes the graphical displays, the second process separate from the first processes; and a display interface (141) configured to provide the window with the graphical displays to a display device for presentation to an operator.

9. The apparatus of Claim 8, wherein the processor is further configured to: execute a third process (202) to control the first and second processes, the third process separate from the first processes and the second process; and execute a fourth process (222, 226) to provide a service, the service comprising a function invoked on behalf of at least one of the first and second processes, the fourth process separate from the first, second, and third processes.

10. A computer program embodied on a computer readable medium, the computer program comprising: computer readable program code forming a plurality of first processes (216) configured to generate a plurality of graphical displays, at least one of the graphical displays comprising a user interface associated with a process system; computer readable program code forming a second process (208) configured to generate a window that includes the graphical displays, the second process separate from the first processes; and computer readable program code configured to output the window with the graphical displays.