WO2015169352A1

WO2015169352A1 - Flexible controller utilization in a process control system

Info

Publication number: WO2015169352A1
Application number: PCT/EP2014/059346
Authority: WO
Inventors: Johan Gunnar; Kjell-Joar Alme; Mats Gunnmarker; Tommy Lillehagen
Original assignee: Abb Technology Ltd
Priority date: 2014-05-07
Filing date: 2014-05-07
Publication date: 2015-11-12

Abstract

The disclosure relates to a process control system (220), a method and a computer program product. The process control system (220) comprises a plurality of physical controllers (11) for controlling a plurality of field devices (34-39), a field network (D3) interconnecting the plurality of physical controllers (11) and the plurality of field devices (34-39), and a control function manager (10) for setting-up and managing a set of virtual controllers, allocating control functions for controlling the field devices (34-39) to the set of virtual controllers (VC1, VC2, VC3) and allocating physical controllers (11) for executing the control functions allocated to the set of virtual controllers. The field network (D3) is configured to provide a communication connection between any one of the plurality of physical controllers (11) and any one of the plurality of field devices (34-39). The plurality of physical controllers (11) are configured as a shared pool of hardware resources of the set of virtual controllers.

Description

FLEXIBLE CONTROLLER UTILIZATION IN A PROCESS CONTROL

SYSTEM

TECHNICAL FIELD

The embodiments described herein relate generally to process control systems and in particular to devices and methods that allows for flexible controller utilization in a process control system.

BACKGROUND

Computer controlled process control systems are used for controlling and/or monitoring of industrial processes in many different types of industries and utilities such as automotive, chemical, pharmaceutical, food, metal, mines, steel mills, consumer products, power generation, power distribution, pure and waste water handling, oil refineries, gas pipe-lines and off-shore platforms. Field devices which are instruments or actuators such as motors, valves, valve positioners and sensors of different types perform functions within the process such as driving conveyor belts, opening or closing valves, and measuring process control parameters. Controllers perform control functions to monitor and control the field devices. Such control functions may involve receiving signals indicating process control measurements, processing the received information and generating control signals that are transmitted to the field device(s) to control and/or monitor the operation of the process. An operator is generally able to perform desired operations with respect to the process by means of an operator workstation that is communicatively connected to receive process information from field devices and controllers. The operator may e.g. be able to view the current state of the process via a user interface, perform evaluations of the process and modify the operation of the process by using the operator workstation.

In order to make the process control system more fault tolerant controllers are often arranged in redundant pairs such as described in the international patent application WO 00/62135 A1 where a primary digital controller is responsible for operating the control logic and a backup digital controller receives process inputs from the primary controller and executes the control algorithm in parallel to the primary controller according to a synchronous execution method. In traditional process control systems, logic runs on dedicated controllers and redundancy is managed locally, close to the controlled hardware. Input/output (I/O) signals from field instruments and actuators are typically terminated in local I/O units and controllers. The setup and allocation of logic and control functions to specific controllers in the overall system and supporting inter-process communication tend to be static once deployed. After engineering and commissioning, the system becomes less amenable to change due to the complexity and risks associated with low-level alterations in a large and live production system.

If a controller fails, alongside its redundant counterpart, or if interlinking communication is broken, then the functions of that particular piece of equipment or process section cease to exist in the overall system. As the logic is configured in a master-slave coupling between each controller and I/O unit, and relevant field devices, an internal fault has the potential to break down an entire control loop. Further, there is no easy way to balance the processing load of the system between existing controllers after the engineering phase has been completed. Thus, if the load becomes too high in one part of the system and causes degraded performance, there is no way to compensate for that by reassigning computation resources to other devices.

Typically, fault tolerance is implemented by means of adding redundant counterparts to each controller and/or I/O unit, but this also restrains the extent of where recovery can take place and how faults can be detected and reverted.

In subsea applications wherein field devices and often also controllers are installed subsea it is highly desirable that hardware is maintained or replaced as seldom as possible due to the cost and difficulty involved when performing such operations subsea. There is therefore a need for process control systems and methods that are fault tolerant and allow for flexible use of installed hardware. SUMMARY

An object of the present invention is to provide an improved process control system and method which at least partly overcome some of the above mentioned problems.

The above stated object is achieved by means of a process control system, a method and a computer program product according to the independent claims.

A first embodiment provides a process control system comprising a plurality of physical controllers for controlling a plurality of field devices and a field network interconnecting the plurality of physical controllers and the plurality of field devices. The process control system also comprises a control function manager for setting-up and managing a set of virtual controllers, allocating control functions for controlling the field devices to the set of virtual controllers and allocating physical controllers for executing the control functions allocated to the set of virtual controllers. The field network is configured to provide a communication connection between any one of the plurality of physical controllers and any one of the plurality of field devices. Furthermore the plurality of physical controllers are configured as a shared pool of hardware resources of the set of virtual controllers such that any one of the physical controllers is capable of executing one or several control functions allocated to any one or several virtual controller of the set of virtual controllers in accordance with an allocation instruction from the control function manager to control any of the plurality of field devices. A second embodiment provides a method to be carried out in a process control system comprising a plurality of physical controllers for controlling a plurality of field devices, a field network (D3) interconnecting the plurality of physical controllers and the plurality of field devices and a control function manager for setting-up and managing a set of virtual controllers. The field network is configured to provide a communication connection between any one of the plurality of physical controllers and any one of the plurality of field devices. The plurality of physical controllers are configured as a shared pool of hardware resources of said set of virtual controllers such that any one of the physical controllers is capable of executing one or several control functions allocated to any one or several virtual controller of the set of virtual controllers in accordance with an allocation instruction from the control function manager to control any of the plurality of field devices. According to the method the control function manager allocates control functions for controlling the plurality of field devices to the set of virtual controllers and allocates physical controllers for executing the control functions allocated to the set of virtual controllers.

A third embodiment provides a computer program product on a computer readable medium comprising computer program code instructions configured, when said program code is loaded into and executed by a processor provided in a process control system, to cause the method according to the second embodiment to be carried out.

An advantage of embodiments of this disclosure is that a flexible controller utilization and flexible controller redundancy may be provided in process control systems that allow for easy operation and maintenance, and reallocation of computational resources,

Another advantage of some embodiments is that hot-swapping of components during production is enabled.

A further advantage is that some embodiments allow for flexible load balancing to ensure satisfactory system performance. Yet another advantage of some embodiments is better degradation behavior which makes it possible and easy to run the process control system in reduced mode to a higher extent than some prior art solutions.

Furthermore some embodiments provide for a possibility for extended maintenance interval e.g., in subsea applications.

Further advantages and features of embodiments of this disclosure will become apparent when reading the following detailed description in conjunction with the drawings. BRIEF DESCRIPTION OF THE DRAWINGS

Fig. 1 is a schematic diagram of a process and a process control system according to prior art.

Fig. 2 is a schematic diagram of a process control system according to an embodiment of the invention.

Fig. 3 is a schematic diagram illustrating allocation of control functions to virtual controllers and physical controllers according to an embodiment of the invention. Figs. 4a and 4b are schematic diagrams illustrating reallocation of control functions to another physical controller according to an embodiment of the invention.

Figs. 5a and 5b are schematic diagrams illustrating reallocation of control functions to another physical controller according to another embodiment of the invention.

Figs. 6a and 6b are schematic diagrams illustrating reallocation of control functions to another physical controller according to yet another embodiment of the invention.

Figs. 7a and 7b are schematic diagrams illustrating reallocation of control functions to another physical controller according to a further embodiment of the invention.

Fig. 8 is a schematic diagram illustrating allocation of control functions to physical controllers according to an embodiment of the invention.

Fig. 9 is a flow diagram illustrating an embodiment of a method to be carried out in a process control system.

Fig. 10 is a flow diagram illustrating an alternative embodiment of a method to be carried out in a process control system.

Fig. 1 1 is a schematic block diagram illustrating an exemplary embodiment of a control function manager and a computer program product. DETAILED DESCRIPTION

The following detailed description of the example embodiments refers to the accompanying drawings. The same reference numbers in different drawings identify the same or similar elements. Also, the following detailed description is provided for the purpose of illustration and explanation of some example embodiments and not for the purpose of limitation.

Reference throughout the specification to "one embodiment" or "an embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment is included in at least one embodiment of this disclosure. Thus, the appearance of the phrases "in one embodiment" or "in an embodiment" in various places throughout the specification are not necessarily all referring to the same embodiment. Further, the particular features, structures or characteristics may be combined in any suitable manner in one or more embodiments.

To provide a good understanding for the following example embodiments, a process control system according to prior art will first be described with reference to Fig. 1 . Fig. 1 shows schematically a control system 20 for a process 30, i.e. a process control system. The process control system 20 is a computerized process control system for controlling an industrial process 30. The process 30 may comprise a number of different sub-processes and process sections. The process may be monitored through one or more process monitoring computers, which communicate with a server handling monitoring and control of the process. In Fig. 1 the process control system 20 includes a number of operator workstations or terminals 27, 28 connected to a first data bus D1 . A wireless gateway 25 is connected to a wireless network and is also connected to the first data bus D1 and configured such that portable workstations such as workstation 26 may access the control system 20 wirelessly. There is furthermore a second data bus D2, and between the first and second data busses D1 , D2 there is connected a server 21 providing control and monitoring of the process 30 and a database 23 where data, such as historical data relating to control and monitoring of the process 30 is stored. The process 30 may comprise process controllers 31 , 32 and monitored equipment collectively referred to as field devices such as a motor 36, valves 34, 38, and measuring equipment such as sensors 35, 37. The controller 31 , motor 36, valve 38, and sensor 37 are part of a first process section, and the controller 32, valve 34 and sensor 35 are part of a second process section. To the second data bus D2 there are furthermore connected process interface units also referred to as I/O units 64 and 66 for providing a communicative connection between the process 30 and the process control system 20. It should however be realized that there may be more or fewer of each of these interface units 64, 66. It should here also be realized that some of these may only be provided for control, some only for measurements and some for both control and measurements. It should be realized that one or more of sensor units 35, 37 may be connected to such process interface units. Such units are involved in controlling the process 30 and in doing this also involved in measuring physical properties related to the process. The measured properties may here comprise properties of the process itself such as measurements of temperature or pressure in a pulp and paper process, a steel mill, an oil & gas production site, a petrochemical process, a pharmaceutical process or measurements such as current and voltage in electrical power process measurements of generation, transmission and distribution processes.

The controllers 31 and 32 would typically be provided in redundant pairs such that another controller is provided to execute the respective control algorithms of controllers 31 and 32 in parallel according to a synchronous execution method. However, it can be seen from Fig. 1 that there is a limited flexibility in the arrangement of the controllers. If the controller 31 would become overloaded or fail, control function resources available in the controller 32 cannot assist in the control of the motor 36 or valve 38.

In contrast to the more fixed controller utilization described in Fig. 1 , embodiments which will be described in further detail below allow for a more flexible controller utilization. By making control software run virtually on top of a shared pool of hardware resources in the form of physical controllers, the available controller resources may be used more flexibly and efficiently. This assumes that field devices are either connected to fieldbuses and thereby available to more than one physical controller in a network, or hard-wired to I/O stations that are reachable from more than one controller node. Further, by loosening up the master-slave coupling and extending a field network to make it available to several controllers, one can allow logic to be moved seamlessly to another controller that still has access to the relevant field devices if the initially assigned controller fails or if there is congestion or contention in the system. Fig. 2 is a schematic diagram illustrating a process control system 220 which has been configured to implement flexible controller utilization according to an embodiment as described in this disclosure. Those elements disclosed in Fig. 2 which correspond exactly to already described elements in Fig. 1 have been given the same reference numerals as in Fig. 1 . The process control system 220 monitors and controls a process 230. The process 230 illustrated in Fig. 2 comprises field devices such as actuators and instruments that are connected to the process control system via a field network D3 either directly or via I/O units such as I/O units 67 and 68 shown in Fig. 2. The field devices of the process 230 comprises valves 34, 38, a motor 36 and sensors 35, 37 and 39 as schematically illustrated in Fig. 2, but it should be understood that the process 230 may comprise a much larger number of field devices of different types. The process control system 220 comprises a number of physical controllers 1 1 configured to interact with the field devices 230 and execute control functions in order to monitor and control the process 230. The physical controllers are hardware units that comprise interfaces for input and output of signals from/to the field devices via the field network D3 and from/to overhead system units such as a server 21 and workstations 26, 27, 28 via data buses D1 and D2. The physical controllers also comprise processing means, e.g. processors configured to process received input signals, generate output signals and process software code instructions in order to execute control functions.

The field network D3 is configured to provide a communication connection between any one of the physical controllers 1 1 and any one of the field devices 34-39. Depending on e.g. the location of the process 230 and delay requirements the field network may be implemented by means of many different types of communication networks using different types of communication protocols. According to an example embodiment the field network D3 is implemented as a PROFINET network. The process control system 230 also comprises a control function manager 10. The control function manager is a functional entity responsible for setting-up and managing a set of virtual controllers, allocating control functions for controlling the field devices to the set of virtual controllers and allocating physical controllers for executing the control functions allocated to the set of virtual controllers. The control function manager would typically be implemented in software arranged to execute in a dedicated processing unit such as schematically illustrated in Fig. 2 or arranged in a distributed fashion to e.g. execute in the processing means of the physical controllers 1 1 . A virtual controller may be set-up by software logic to emulate a hardware controller according from the view point of overhead control system units such as the server 21 hus the introduction of the control function manager does not require any modification of overhead control system units such as servers and/or workstations. The virtual controllers serve to functionally separate control logic from controller hardware resources to allow for flexible and efficient allocation of controller hardware resources for executing the desired control functions. The virtual controllers make it possible to keep complexity low since control functions that depend on each other may be grouped and allocated to the same virtual controller which make it possible to hide to overhead control system units that a large number of physical controllers are in fact involved in executing a group of control functions.

Fig. 3 is a diagram schematically illustrating allocation of control functions to virtual controllers VC1 , VC2, VC3 and physical controllers 1 1 a, 1 1 b, 1 1 c, 1 1 d, 1 1 e. Fig. 3 illustrates the overall layout of the process control system comprising overhead control system 29, the control function manager 10, the virtual controllers VC1 , VC2, VC3 managed by the control function manager 10, physical controllers 1 1 a-e and the field network D3 for providing connection to field devices 31 . The control function manager 10 and the virtual controllers VC1 - VC3 form a virtualization layer between the upper-most control nodes of the system, i.e. the overhead control system 29, and the physical controllers 1 1 a-e and I/O units (not shown in Fig. 3). By extending the connectivity between the field devices 31 and the physical controllers 1 1 a-e, the lower-most layers of the process control system may be regarded as a shared pool of resources that the overhead control system 29 can allocate control functions and control loops to dynamically. The dynamicity of the system will yield increased robustness and reliability as it takes away the need for low-level and complex hardware to deal with fault-tolerance and redundancy. Further, this architecture has the potential to improve the overall performance of the system significantly, as computation and processing can be distributed more evenly amongst the available controllers and thus reduce the risk of hotspots in the system. In terms of redundancy and modularity, the system also enables hot-swapping of faulty or defect components without this having any noticeable impact on the rest of the system. The control function manager 10, regardless of where it resides, such as inside every one of the physical controllers 1 1 a-e or in support hardware separated from the physical controllers, is responsible for spawning virtual controllers and allocating system-wide control functions to the physical controllers depending on availability, load, etc. Say for instance, as illustrated in Fig. 3, that the control function manager allocates control functions F(1 ) through F(n) to the virtual controller VC1 that, say run on a dual pair of physical controllers 1 1 a and 1 1 b. The control function manager 10 may decide to allocate m of the functions to one of the controllers and the rest (n-m) to the other one. Assume likewise that control functions G(1 ) through G(n) are allocated to the virtual controller VC2 and control functions H(1 ) though H(n) are allocated to the virtual controller VC3. The physical controllers 1 1 c and 1 1 d are allocated to execute the control functions allocated to the virtual controller VC2 and the physical controller 1 1 e is allocated to execute the control functions allocated to the virtual controller VC3. Additional redundant controllers may be allocated analogously to synchronously execute the same control functions as the physical controllers 1 1 a-e but this is not described in detail here for simplicity.

Figs. 4a and 4b are schematic diagrams illustrating reallocation of functionality in the event of a failure of a physical controller. Assume that the virtual controller VC1 controls field devices 34, 35 and 39 by means of the physical controllers 1 1 a and 1 1 b that execute control functions F(1 ) - F(n). The control function manager has allocated the physical controllers such that 1 1 a executes control functions F(1 )-F(m) while the physical controller 1 1 b executes control functions F(m+1 ) - F(n) as illustrated in Fig. 4a. There is also a physical controller 1 1 c in the process control system which has not been allocated to support the virtual controller VC1 . The physical controller 1 1 c might be either idle or executing control functions allocated to another virtual controller. Fig. 4b illustrates a scenario where the virtual controller 1 1 a fails. In response to detection of this failure the control function manager reallocates the physical controllers used by the virtual controller VC1 such that control functions F(1 )-F(k) now are executed by the physical controller 1 1 c and control functions F(k+1 )-F(n) are executed by the physical controller 1 1 b. In some cases the control function manager may decide that the physical controller 1 1 c replaces the physical controller 1 1 a and executes the same control functions that the physical controller 1 1 a executed before failing. But if e.g. the physical controller 1 1 c has more limited or higher capacity than the physical controller 1 1 a had, the control function manager may decide to let the physical controller 1 1 c execute less or more control functions than the physical controller 1 1 a did. This reallocation of physical controllers is transparent to the overhead control system.

Figs. 4a and 4b illustrates reallocation triggered by a failure of a physical controller 1 1 a, but the controller function manager may be configured to reallocate physical controllers assigned to execute a particular set of control functions for a variety of reasons such as load sharing between physical controllers and communication links or in response to an operator reallocation command. If e.g. the hardware is to be updated it is possible to reallocate the control functions to make a physical controller that is to be updated idle before it is replaced.

According to the above described examples it is possible that the control functions allocated to a virtual controller are executed by a single or a plurality of physical controllers. According to some embodiments it is also possible that a physical controller is allocated to execute control functions allocated to a plurality of different virtual controllers. According to other embodiments the physical controllers are configured to execute control functions allocated to any virtual controller but the physical controllers are only allocated to one virtual controller at a time. According to yet further embodiments the physical controllers are configured into subsets serving a respective virtual controller. If one physical controller of a particular subset fails the control function manager performs a reallocation of the physical controllers within the particular subset.

Some exemplary embodiments that illustrate how virtual controllers may be set- up and managed and how control functions may be allocated and re-allocated are described in further detail in Figs 5-8.

Figs. 5a and 5b illustrate how redundant pairs may be handled according to an exemplary embodiment. Fig. 5a shows that the control function manager has allocated the physical controllers such that the physical controllers 1 1 a and 1 1 b are redundant pairs which both execute control functions F(1 )-F(m). If one of the physical controllers 1 1 a or 1 1 b fails the control operation can continue uninterrupted since one of the controllers is still working. The control function manager can then reallocate the physical controllers such that e.g. the physical controllers 1 1 b and 1 1 c forms a new redundant pair (assuming that it was the physical controller 1 1 a that failed) as illustrated in Fig. 5b.

Figs. 6a and 6b illustrate an embodiment in which the physical controllers are divided into subsets and allocated to a respective virtual controller. As illustrated in Fig. 6a the physical controllers 1 1 a, 1 1 b and 1 1 c have been allocated to the virtual controller VC1 . If one of the physical controllers of the subset would fail such as the physical controller 1 1 a, the control function manager would perform a reallocation of control functions allocated to the physical controllers of the subset of controllers allocated to the virtual controller VC1 as illustrated in Fig. 6b.

Figs. 7a and 7b illustrates an exemplary scenario where the physical controllers 1 1 a and 1 1 b first are allocated to execute control functions allocated to the virtual controller VC1 , but after a reallocation (e.g. due to failure of the physical controller 1 1 a) the physical controllers 1 1 b and 1 1 c execute the control functions allocated to the virtual controller VC1 .

Fig. 8 illustrates a scenario with a more complex allocation scheme according to which some physical controllers execute control functions allocated to a single virtual controller while other physical controllers execute control functions allocated to more than one virtual controller. Fig. 8 shows that the physical controller 1 1 b executes control functions allocated to the virtual controller VC1 , the physical controllers 1 1 c and 1 1 d executes control functions allocated to the virtual controller VC2 and the physical controller 1 1 a executes control functions allocated to both the virtual controller VC1 and the virtual controller VC2. The physical controllers 1 1 e and 1 1 f are spare controllers which may be reallocated to execute control functions of either the virtual controller VC1 or VC2 as desired in accordance with allocation instructions from the control function manager. Fig. 9 is a flow diagram illustrating a method to be carried out in a process control system according to an embodiment as described above. The method comprises a step 51 according to which the control function manager allocates control functions for controlling the field devices to the set of virtual controllers and a step

52 according to which the control function manager allocates physical controllers for executing the control functions allocated to the set of virtual controllers.

Fig. 10 is a flow diagram of an alternative embodiment of a method to be carried out in a process control system. The method illustrated in Fig. 10 comprises steps 51 and 52 corresponding to the steps of the method of Fig. 9 and also a step 54 of the control function manager reallocating a physical controller by changing the physical controller that is assigned to execute a particular control function. According to some embodiments the step 54 is performed in response to a step

53 of detecting a particular event configured to trigger the reallocation of a physical controller. Such an event may according to different embodiments be:

- detection of a fault of a physical controller,

- detection of a need for load balancing, such as overload of a physical controller or an uneven load distribution, or

- detection of an operator reallocation command, e.g. initiated by the operators desire to do some maintenance work on a particular physical controller.

The flexible redundancy provided by means of using a control function manager and virtual controllers as described above allows for better degradation behavior than process control systems according to prior art. By allocating control functions to the set of virtual controllers in an appropriate way it is made easy to run in a reduced mode if required. Referring again to Fig. 3, assume that control functions F(1 )-F(n) which are assigned to the virtual controller VC1 are safety critical control functions which if not performed might impact the safety of personnel, process equipment and/or the environment. The control functions G(1 )-G(n) allocated to the virtual controller VC2 are assumed to be production related control functions which if not performed have a negative impact on the production of the process but without risking the safety of personnel or equipment. Finally, the control functions H(1 )-H(n) allocated to the virtual controller VC3 are assumed to be control functions that relate to functions that are nice to have but which do not have a direct impact on the current performance of the process, such as control functions related to condition-based maintenance, collection of statistics etc. In such a scenario, if it would be detected that physical controllers have failed to such an extent that all of the control functions cannot be performed the control function manager can easily control the process to run in a reduced mode by deactivating control functions with a lower priority first, in this example by deactivating the control functions allocated to the virtual controller VC3, in order to ensure that there are enough controller resources for executing control functions with a higher priority, namely those allocated to the virtual controllers VC1 and VC2 in the present example.

Fig. 1 1 is a schematic block diagram illustrating an exemplary embodiment of a control function manager 10. In Fig. 1 1 the control function manager 10 comprises software as well as dedicated hardware of a unit separate from the physical controllers but as mentioned above it is according to other embodiments possible that the control function manager comprises software that is distributed and executed in the physical controllers. The control function manager may also according to some embodiments comprise a central part separate from the physical controllers and local parts comprising software executed in processors of the physical controllers. The control functions manager 10 shown in Fig. 1 1 comprises one or several interfaces 73 for communicating with the physical control units and overhead control system, one or several processors 74 for executing software code instructions, a memory 76 and a computer program product 75 loaded into the memory 76 and comprising computer program code instructions configured, when the program code is loaded into and executed by the processor(s) 74, to cause the method shown in Fig. 9 or Fig. 10 to be carried out. The computer program product may also be stored on other types of computer readable media, both volatile and non-volatile, such as portable memory devices e.g. USB-sticks, CD-ROM discs and portable harddiscs which may be loaded into and executed by processors of the process control system.

Embodiments described herein may be particularly advantageous to use in subsea applications in which either the field devices or the field devices and the controllers are installed subsea. Since it is particularly difficult and costly to replace or maintain hardware that is placed subsea the possibility for an extended maintenance interval that is provided by the flexible redundancy of the disclosed embodiments is very beneficial for subsea applications. Furthermore the disclosed embodiments makes it easy to provide an overcapacity in terms of controller hardware resources and to allow for such redundant hardware to be used as efficiently as possible to improve system performance. Consider e.g. an example scenario where there is a real requirement of 40 physical controllers to execute the desired control functions but 50 physical controllers are provided to give spare capacity. These 50 physical controllers may be used flexibly since they according to the disclosed embodiments are configured to be used as a pool of controller resources. The control function manager may e.g. allocate the control functions such that 45 of the 50 physical controllers are used to execute control functions as long as all physical controllers are working in order to not overload any of the physical controllers to ensure best possible performance.

The control function manager may be implemented to allocate the control functions to the set of virtual controllers in different ways. It is beneficial to group control functions that are mutually dependent within the same virtual controller. Assume for instance that a first control function F(x) implies reading measurements of pressure before and after a pump and computing the differential pressure. A second control function F(y) uses the differential pressure and a detected rotation speed of a motor driving the pump, computes how the rotation speed needs to be changed in order to get the desired pressure conditions for the pump and controls the power supplied to the motor accordingly. Since the first and second control function F(y) depends on the control function F(x) it is appropriate that these control functions are allocated to the same virtual controller. One virtual controller may e.g. be allocated all control functions relating to pump control, while another virtual controller is allocated all control functions related to valve control. There may be a large number of physical controllers involved in this pump and valve control but from the view point of the overhead control system only the virtual controllers need to be visible and if it is desired to make changes of e.g. pump control the overhead control system communicates this by communicating with the virtual controller responsible for pump control. Thus from the view point of the overhead control system, complexity may be reduced.

Physical controllers according to prior art are usually configured to receive instructions regarding which field devices to control and if software required to communicate with and control these devices are not already present in the physical controller it is common to download such software via a communication network. Such programmable physical controllers are already provided with the properties necessary for interacting with the control function manager. Accordingly implementation of the above described embodiments will generally not require any adaptation of the hardware of the physical controllers. The only requirement is that the physical controllers are connected to the field network interconnecting the plurality of physical controllers and the plurality of field devices and that the physical controllers are configured as a shared pool of hardware resources of the set of virtual controllers. As is apparent from the above description there are numerous advantages associated with different ones of the above described embodiments. Example embodiments:

allow for easy operation and maintenance, and reallocation of computational resources,

- enable hot-swapping of components during production,

allow for flexible load balancing to ensure satisfactory system performance brings redundancy up to a more global level, removing the need for local and complex hardware. Consequently, cheaper and more reliable components can be deployed (e.g., on the seabed for subsea applications), allow for better degradation behavior - possibility to run at least in reduced mode,

provide possibility for extended maintenance interval (e.g., in subsea applications).

Virtualization can simplify the engineering process for achieving fault-tolerance and high availability.

The above-described example embodiments are intended to be illustrative in all respects, rather than restrictive. All such variations and modifications are considered to be within the scope of protection as defined by the following claims. No element, act, or instruction used in the description of the present application should be construed as critical or essential to the invention unless explicitly described as such. Also, as used herein, the article "a" is intended to include one or more items.

Claims

1 . A process control system (220) comprising

a plurality of physical controllers (1 1 ) for controlling a plurality of field devices (34-39);

a field network (D3) interconnecting the plurality of physical controllers (1 1 ) and the plurality of field devices (34-39); and

a control function manager (10) for setting-up and managing a set of virtual controllers (VC1 , VC2, VC3), allocating control functions for controlling said field devices (34-39) to the set of virtual controllers (VC1 , VC2, VC3) and allocating physical controllers (1 1 ) for executing the control functions allocated to the set of virtual controllers (VC1 , VC2, VC3);

wherein said field network (D3) is configured to provide a communication connection between any one of the plurality of physical controllers (1 1 ) and any one of the plurality of field devices (34-39) and

the plurality of physical controllers (1 1 ) are configured as a shared pool of hardware resources of said set of virtual controllers (VC1 , VC2, VC3) such that any one of the physical controllers (1 1 ) is capable of executing one or several control functions allocated to any one or several virtual controller of the set of virtual controllers (VC1 , VC2, VC3) in accordance with an allocation instruction from the control function manager (10) to control any of the plurality of field devices (34-39).

2. The process control system (220) according to claim 1 , wherein the control function manager (10) is further configured to reallocate a physical controller (1 1 ) by changing the physical controller (1 1 ) that is assigned to execute a particular control function.

3. The process control (220) system according to claim 2, wherein the control function manager (10) is configured to automatically reallocate physical controllers (1 1 ) in response to a detected fault of a physical controller (1 1 ).

4. The process control system (220) according to claim 2 or 3, wherein the control function manager (10) is configured to perform load balancing between the physical controllers (1 1 ) by reallocating physical controllers (1 1 ) to achieve a desired load distribution between the physical controllers (1 1 ).

5. The process control system (220) according to any of claims 2-4, wherein the control function manager (10) is configured to reallocate physical controllers (1 1 ) to remove all allocations of control functions to a selected physical controller in response to an input of an operator reallocation command.

6. The process control system (220) according to any previous claim wherein the control function manager (10) is configured to allocate control functions to the set of virtual controllers (VC1 , VC2, VC3) based on a priority associated with each control function, such that the control functions associated with a high priority is allocated to a first virtual controller and such that control functions associated with a low priority is allocated to a second virtual controller.

7. The process control system according to claim 6, wherein the control function manager (10) is configured to deactivate execution of any control function allocated to the second virtual controller in response to detection of a lack of resources in the physical controllers (1 1 ) for executing control functions.

8. The process control system (220) according to any previous claim, wherein the control function manager (10) is implemented in software (75) executed in a processor (74) connected to the physical controllers (1 1 ) by a communication network (D2).

9. The process control system (220) according to any of claims 1 -7, wherein the control function manager (10) is implemented in software (75) which completely or partly is executed in processors of the plurality of physical controllers (1 1 ) when performing the tasks of the control function manager (10).

10. The process control system (220) according to any previous claim where the process control system (220) is configured to control a subsea process and wherein

the plurality of field devices (34-39) or the plurality of field devices (34-39) and the plurality of physical controllers (1 1 ) are located subsea.

1 1 . A method to be carried out in a process control system (220) comprising a plurality of physical controllers (1 1 ) for controlling a plurality of field devices (34-

39), a field network (D3) interconnecting the plurality of physical controllers (1 1 ) and the plurality of field devices (34-39); and a control function manager (10) for setting-up and managing a set of virtual controllers (VC1 , VC2, VC3), wherein said field network (D3) is configured to provide a communication connection between any one of the plurality of physical controllers (1 1 ) and any one of the plurality of field devices (34-39), and wherein the plurality of physical controllers (1 1 ) are configured as a shared pool of hardware resources of said set of virtual controllers (VC1 , VC2, VC3) such that any one of the physical controllers (1 1 ) is capable of executing one or several control functions allocated to any one or several virtual controller of the set of virtual controllers (VC1 , VC2, VC3) in accordance with an allocation instruction from the control function manager (10) to control any of the plurality of field devices (34-39), the method comprising

the control function manager (10) allocating (51 ) control functions for controlling said plurality of field devices to the set of virtual controllers (VC1 , VC2, VC3) and allocating (52) physical controllers (1 1 ) for executing the control functions allocated to the set of virtual controllers (VC1 , VC2, VC3).

12. The method according claim 1 1 , wherein the control function manager (1 1 ) allocates physical controllers (1 1 ) such that the control functions allocated to a virtual controller (VC1 , VC2, VC3) are executed by a plurality of different physical controllers (1 1 ).

13. The method according to claim 1 1 or 12, wherein the control function manager (10) allocates physical controllers such that a first physical controller executes control functions allocated to a plurality of different virtual controllers (VC1 , VC2, VC3).

14. The method according to claim 1 1 or 12, wherein the control function manager

(10) allocates physical controllers such that each physical controller executes control functions allocated to a single virtual controller ((VC1 , VC2, VC3).

15. The method according to any of claims 1 1 -14, further comprising

the control function manager (10) reallocating (54) a physical controller (1 1 ) by changing the physical controller (1 1 ) that is assigned to execute a particular control function.

16. The method according to claim 15, wherein the control function manager (10) automatically reallocates physical controllers (1 1 ) in response to a detected fault of a physical controller (1 1 ).

17. The method according to claim 15 or 16, wherein the control function manager (10) performs load balancing between the physical controllers (1 1 ) by reallocating physical controllers (1 1 ) to achieve a desired load distribution between the physical controllers (1 1 ).

18. The method according to any of claims 15-17, wherein the control function manager (10) reallocates physical controllers (1 1 ) to remove all allocations of control functions (10) to a selected physical controller (1 1 ) in response to an input of an operator reallocation command.

19. The method according to any of claims 1 1 -18 wherein the control function manager (10) allocates control functions to the set of virtual controllers (VC1 , VC2,

VC3) based on a priority associated with each control function, such that the control functions associated with a high priority is allocated to a first virtual controller and such that control functions associated with a low priority is allocated to a second virtual controller.

20. The method according to claim 19, wherein the control function manager (10) deactivates execution of any control function allocated to the second virtual controller in response to detection of a lack of resources in the physical controllers

(1 1 ) for executing control functions.

21 . A computer program product (75) on a computer readable medium (76) comprising computer program code instructions configured, when said program code is loaded into and executed by a processor (74) provided in a process control system (220), to cause the method according to any of claims 1 1 -20 to be carried out.