Logic Solver Digital Valve Controller (LSDVC) Function Block

The LSDVC block provides an interface to the Fisher Controls DVC6000ESD digital valve controller for safety shutdown applications. The block's output is assigned to a HART Two-state Output Channel on a Logic Solver. In a typical application the block's input is from an output of a Cause And Effect Matrix (LSCEM) block.

The LSDVC block does not support modes.

LSDVC Function Block 

Functional Overview - LSDVC Function Block

The LSDVC block contains all of the parameters found in the Discrete Output (LSDO) block. In addition, the LSDVC block performs automatic and manual partial stroke testing on the associated valve.

The following block diagram shows a simple application that uses the LSDVC block to operate a DVC6000ESD digital valve controller.

Simple LSDVC Application Diagram

In this example, the input to the Digital Valve Controller block is an effect output from a Cause and Effect Matrix block. During normal operation the effect output's value is 1 (one). When the inputs to the Cause and Effect Matrix block indicate a hazardous condition exists, the effect output is set to 0 (zero). This, in turn, trips the output of the Digital Valve Controller block, driving the associated Logic Solver HART Two-state Output Channel to the configured off-current value, which closes the valve.

The Discrete Input block is wired to a limit switch or other indicator to confirm that the valve closes. If the valve does not close, the PV input to the Digital Valve Controller block from the Discrete Input block eventually sets a fault state in the Digital Valve Controller block.

This simple example does not illustrate a number of configurable functions the block supports:

• Options for detecting a fault state
• Timers to delay sending a signal to close the valve or set the fault state
• Requiring permission before resetting the block to normal operation after being tripped.
• A number of features that support partial stroke testing

Refer to the Application Information section and the Alternative Implementation Example for more specific application information.

Schematic Diagram - LSDVC Function Block

The following diagram shows the internal components of the LSDVC function block.

LSDVC Function Block Schematic Diagram

Block Execution - LSDVC Function Block

Because the Logic Solver is a De-energized to Trip environment the normal operating value of the output is On (1) and the tripped value is Off (0).

To use the LSDVC block in a safety shutdown application, assign IO_OUT to a Logic Solver HART Two-state Output Channel connected to a Fisher Controls DVC6000ESD digital valve controller. Typically, the CAS_IN_D input of the LSDVC block would be wired from an EFFECT output of an upstream LSCEM block. Default LSDVC block behavior passes the value of CAS_IN_D to OUT_D. 

You can wire feedback from the DVC6000ESD to the RDBK_IN_D input parameter of the LSDVC block. This input would typically be wired from an LSDI function block representing a limit switch. The RDBK_IN_D value becomes the PV_D of the LSDVC block. If the configurable time CFM_TRIP_TIME expires before PV_D confirms the off state, the DO_ALERTS Failed to confirm after trip command becomes True. If RDBK_IN_D is not wired, PV_D has the same value as OUT_D, so confirmation is immediate.

Fault State Detection

The LSDVC block enters a fault state when any of three conditions is detected and a corresponding option has been selected for the detected condition. When the fault state is active, the block forces OUT_D to Off, sets the Fault State Active bit in BLOCK_ERR, and sets FAULT_STATE to Active. The FSTATE_OPTS options are selected by default and include:

• Enable detection based on CAS_IN_D status

If the status of CAS_IN_D becomes Bad, FSTATE_TIMER begins incrementing from 0.0. If the status remains Bad for FSTATE_TIME seconds, OUT_D is forced to 0 (zero). FSTATE_TIMER continues to increment while the status of CAS_IN_D is Bad. The fault state condition clears immediately when the status transitions away from Bad.

• Enable detection based on output channel status

OUT_D is forced to Off if the Logic Solver detects a short or open in the field wiring (status of OUT_D is Bad SensorFailure LowLimited) while OUT_D is being commanded On. The LSDVC block reacts to this status by forcing the output Off to track the state of the DVC6000ESD. Note that FSTATE_TIME has no effect when the fault state is a result of OUT_D status.

Note  If you use this option you must also require a reset, either in this block or in an upstream LSCEM block, because an active fault state condition clears when the block drives the output Off. Requiring a reset prevents the block from driving the output back to On during the next scan.

• Enable detection based on PV_D value

OUT_D is forced to 0 based on feedback from the final element wired into RDBK_IN_D. The final element is confirmed Off (PV_D is 0) while OUT_D is commanded On. Use this option to force the output off if a failure of the final element is not detected by a Logic Solver diagnostic. RDBK_IN_D should be wired when using this option, otherwise PV_D has the same value as OUT_D. Note that FSTATE_TIME has no effect when the fault state is a result of the value of PV_D.

Note  If you use this option you must also require a reset, either in this block or in an upstream LSCEM block, because an active fault state condition clears when the block drives the output Off. Requiring a reset prevents the block from driving the output back to On during the next scan.

FSTATE_TIMER is a writeable parameter. Be advised that writing to FSTATE_TIMER can cause the state of OUT_D to change depending on the value written.

Determining the value of OUT_D and writing the output channel value

The following figure is the state transition diagram for OUT_D_STATE. When OUT_D_STATE is Off or Off - Ready to Reset, the value of OUT_D is Off (0) and the Logic Solver channel defined by IO_OUT is written to Off. When OUT_D_STATE is On, OUT_D is On and IO_OUT is written to On.

OUT_D_STATE Transition Diagram

Note  To require a manual reset to transition OUT_D to On (1), it is recommended that you configure this in an upstream LSCEM block, not the LSDVC block. The LSCEM block has a number of features that enhance the reset logic. The ability to require resets in the LSDVC block (using the REQUIRE_RESET parameter) is provided if you do not have voter and LSCEM blocks to implement shutdown logic.

If you set the LSDVC block's REQUIRE_RESET parameter to True, any transition of OUT_D to Off (0) causes OUT_D to remain Off until all of the following conditions are met:

• CAS_IN_D equals 1
• FAULT_STATE is not active
• RESET is True

RESET should be changed to True using a button on a faceplate or process display in DeltaV Operate. The block changes RESET back to False. Do not expose RESET as an input on the block and wire to it. If you need to reset an LSDVC block from SIS module logic, use an LSCALC function block to do a conditional assignment to RESET.

When REQUIRE_RESET is False, OUT_D's value is based on the value of CAS_IN_D unless the fault state is active.

When OUT_D_STATE is Off or Off - Ready to Reset, the value of OUT_D is Off and the channel on this Logic Solver defined by IO_OUT is written to Off. This results in the configured OFF_CURRENT value (0 or 4 mA) being sent to the Logic Solver's HART Two-state Output Channel defined in IO_OUT.

When OUT_D_STATE is On, OUT_D is On and the channel is written to On. This results in 20 mA being sent to the Logic Solver's HART Two-state Output Channel.

Determining the value of PV_D

PV_D normally gets its value from RDBK_IN_D. If the status of RDBK_IN_D is BadNotConnected, PV_D has the same value as OUT_D. Use the invert input option in the upstream LSDI function block if you are using a closed limit switch. You can manipulate PV_D to test an operator display or test the confirmation alarm condition by using simulation in the upstream input function block (simulation available when the Logic Solver is assigned to the ProfessionalPLUS workstation as a simulated Logic Solver).

Determining the value of DO_ALERTS

The DO_ALERTS parameter reports two alarm conditions set by the block (inactive = 0, active = 1):

• Failed to confirm after trip command

The device fails to confirm after being commanded to trip. On any transition of OUT_D to Off, the block starts a confirmation timer. If the value of PV_D is not 0 within CFM_TRIP_TIME seconds, the alert Failed to confirm after trip command becomes True. The alert clears when OUT_D transitions to On (1).

• Confirm lost while commanded On

The device confirms Off while it is being commanded On. When OUT_D_STATE is On and PV_D has transitioned to 1, the condition is detected if PV_D becomes 0, for example if the device has a failure that causes it to confirm in the Off state. The alert clears on the next transition of OUT_D_STATE to On. 

Partial stroke testing

Perform partial stroke testing of a DVC6000ESD in one of the following ways:

• Initiate a test from a workstation using DeltaV Operate or Control Studio Online/Debug by a secure write to the PST_START parameter in the LSDVC block.
• Use a Calc block in an SIS module to initiate a test by conditionally writing the PST_START parameter in the LSDVC block.
• Configure the LSDVC block to periodically initiate the test based on the block's PST_PERIOD_TIME parameter.

Note  Do not attempt to initiate consecutive partial stroke tests from the logic unless you verify that each test completes before initiating the next. Otherwise, the first test succeeds and subsequent tests fail or are denied until the first test completes. 

The partial stroke testing facility in the LSDVC block is in one of three states as indicated in the PST_STATE parameter, whose state transition diagram is shown in the following figure.

PST_STATE Transition Diagram

The partial stroke testing state is Idle when the block has not been configured to initiate tests periodically, that is, PST_PERIOD_TIME is zero hours, and the block is waiting for a manual test to be initiated by PST_START.

The state is Armed when PST_PERIOD_TIME is greater than zero and PST_NEXT_TIMER is timing down. A test starts when PST_NEXT_TIMER reaches zero (times out), or if prior to timing out, a manual test is started.

The state transitions to PST in Progress when a test is started from Idle or Armed. The block sends a request to the IO subsystem to initiate a partial stroke test. The block generates an event based on whether the test was successful, failed, or denied. The state then transitions to Armed or Idle based on the value of PST_PERIOD_TIME.

A partial stroke test can fail for a number of reasons:

• The DVC6000ESD returns a test failed response
• The Logic Solver I/O processor is not in the Ready state when the block requests a test
• The Logic Solver I/O processor goes to the NoComm state after the test is initiated
• The Logic Solver control subsystem does not get a response from the Logic Solver I/O processor for 180 seconds while PST_STATE is PST In Progress.

When a partial stroke test fails, the block sets the PST_ALERTS Test failed. The alert remains set until the next time PST_STATE is PST in Progress.

The partial stroke test can be denied by the DVC6000ESD when it is in some modes of operation, for example, it is being calibrated or a test has been initiated from Valvelink, or the connected HART device does not support partial stroke testing. When a test is denied, the block sets the PST_ALERTS Test Denied, where it remains set until the next time PST_STATE is PST in Progress.

When PST_STATE is Armed or Idle, the block compares the elapsed time since the last successful test, PST_SINCE_TIMER, to the maximum allowed time between successful tests, PST_REQ_INTERVAL, and sets a the PST_ALERTS No successful test in the required interval if the time has been exceeded (unless the required interval is zero). PST_SINCE_TIMER is set to zero after a test succeeds. PST_SINCE_TIMER does not begin incrementing after an initial download of the Logic Solver until a successful test has occurred.

A transition can occur between Idle and Armed when PST_PERIOD_TIME is written in runtime, or on the first scan after a download if PST_PERIOD_TIME has changed. When the state is Idle, changing PST_PERIOD_TIME to a value greater than zero causes the state to change to Armed and PST_NEXT_TIMER to be initialized. When the state is Armed, writing PST_PERIOD_TIME to zero changes the state to Idle. When Armed, a greater than zero write to PST_PERIOD_TIME changes PST_NEXT_TIMER to the value written to PST_PERIOD_TIME if that value is less than the current value of PST_NEXT_TIMER. PST_NEXT_TIMER is decremented when the state is Armed.

When a download of the Logic Solver occurs where there is an existing configuration running, the current state and timer values are copied from running LSDVC blocks to retain the values.

Event Generation

The LSDVC block generates an event record when any of the following conditions become active and the REPORT_OPTS option Event records are not generated is not selected:

• The block has set DO_ALERTS Failed to confirm following a command to trip. The event record shows the path to the LSDVC block and the Failed to confirm after trip command text string along with the time of occurrence.
• The block has set DO_ALERTS Confirm lost while commanded On. The event record shows the path to the LSDVC block and the text Confirm lost while commanded On along with the time of occurrence.
• The command to trip was successful and RDBK_IN_D has been wired. The event record shows the path to the LSDVC block and the text Successful confirmation following a command to trip along with the time of occurrence.
• The block has set PST_ALERTS Test failed. The event record shows the path to the LSDVC block and the text string Partial stroke test failed along with the time of occurrence.
• The block has set PST_ALERTS Test denied. The event record shows the path to the LSDVC block and the text string Partial stroke test denied along with the time of occurrence.
• The block has set PST_ALERTS No successful test in the required interval. The event record shows the path to the LSDVC block and the text string Partial stroke test past due along with the time of occurrence.
• The partial stroke test is successful. The event record shows the path to the LSDVC block and the text Successful partial stroke test along with the time of occurrence.

Alarm Detection - LSDVC Function Block

You can configure alarm parameters to reference bits in DO_ALERTS, BLOCK_ERR, and PST_ALERTS. You can reference DO_ALERTS alarm conditions upstream of the LSDVC block when required.

The first alert in DO_ALERTS (Failed to confirm after trip command) propagates to the module parameter SIF_ERRORS when REPORT_OPTS option  Alarm conditions do not roll up to module level is not set.

The third alert in PST_ALERTS (Last test failed) propagates to the module parameter SIF_ERRORS when REPORT_OPTS option Alarm conditions do not roll up to module level is not set.

Status Handling - LSDVC Function Block

Status is considered in the detection of the fault state.

The status of OUT_D is normally GoodNonCascade NonSpecific NotLimited. If the fault state is active, the status is set to GoodCascade FaultStateActive NotLimited. If the status on the output channel is Bad, the status of OUT_D is set to Bad. Bad SensorFailure LowLimited indicates an open or short circuit has been detected. Bad DeviceFailure NotLimited indicates a channel error.

The status of PV_D is that of RDBK_IN_D unless its status is Bad NotConnected, in which case the status of PV_D is the same as OUT_D.

Parameters - LSDVC Function Block

The following table lists the system parameters for the function block:

LSDVC Function Block System Parameters

DO_ALERTS

The following table shows the alerts that can appear for an LSDO block, the bit position of each alert, and how to access the alert bit from DeltaV Operate.

PST_ALERTS

The following table shows the alerts that can appear for an LSDO block, the bit position of each alert, and how to access the alert bit from DeltaV Operate.

Application Information - LSDVC Function Block

Using output function blocks with the DVC6000ESD

The LSDVC function block provides an interface to the DVC6000ESD for safety shutdown and for partial stroke testing. The HART Two-state Output Channel provides the control signal and the HART communications path to the digital valve controller. You can configure the output channel to have an OFF_CURRENT of 0 mA or 4 mA. The control signal can command the valve controller to the tripped state regardless of the configured OFF_CURRENT value. Using an OFF_CURRENT value of 4 mA allows HART communication between the Logic Solver and the valve controller whether the valve controller is in the normal or the trip state. When the OFF_CURRENT is 0 mA, the power is removed entirely when the LSDVC function block drives the channel Off.

Caution  It is recommended to keep the travel cutoffs in the DVC6000ESD (Travel Cutoff High and Travel Cutoff Low) at their default value of 50%. Do not set Travel Cutoff Low below 15% or set Travel Cutoff High above 85%.

Implementation Example

• Outfit the valve with a solenoid as shown in the figure below.
• Use two output channels on the Logic Solver, one configured as a Discrete Output Channel and one as HART Two-state Output Channel.
• Set the OFF_CURRENT parameter to 4 mA.
• Use two output function blocks in the SIS module, one LSDO and one LSDVC.
• Wire the EFFECTn output from the LSCEM function block to the CAS_IN_D input on both function blocks.

Example Implementation

An advantage of this implementation is HART communication is active whether the valve is in the normal or trip state.

Alternate implementation

• The DVC6000ESD is not outfitted with a solenoid valve.
• Use a single output channel configured as HART Two-state Output Channel.
• Set the OFF_CURRENT parameter to 0 mA.
• Use one output function block, an LSDVC block, in the SIS module
• Wire the EFFECTn output from the LSCEM function block to the CAS_IN_D input of the LSDVC function block.

Alternate Implementation

An advantage of this implementation is that only one output channel is required. The disadvantage is not having HART communication when the DVC6000ESD is in the shutdown state.