Distributed programmable control system

Claim 1

A sub-routine control system for use with a fuel consuming apparatus, the apparatus including a plurality of similar groups of ancillary equipment which contribute to overall system operation, the apparatus further including sensors which provide signals commensurate with conditions which influence safety of operation, each ancillary equipment group being provided with a plurality of sensors for monitoring operating parameters and generating signals commensurate therewith, said control system comprising: a first programmable controller, said first programmable controller being connected to receive signals commensurate with the operational status of said ancillary equipment groups, said first programmable controller generating command signals for said equipment groups in response to said operational status signals and in accordance with stored instructions whereby said equipment groups will be operated in accordance with a schedule, said first programmable controller also being connected to receive the signals commensurate with the sensed conditions which influence the safety of operation of the apparatus and generating a shut-down signal for the apparatus when said safety signals indicate that an unsafe operating regime is being approached; a second programmable controller, said second programmable controller being connected to receive the signals commensurate with sensed conditions which influence the safety of operation of the apparatus and generating a shut-down signal for the apparatus when said safety signals indicate that an unsafe operating regime is being approached; means delivering the signals commensurate with sensed operating conditions which influence the safety of operation of the apparatus to said first and second programmable controllers; a plurality of third programmable controllers corresponding in number to the number of similar ancillary equipment groups; means delivering signals commensurate with the monitored operating parameters of each ancillary equipment group to respective of said programmable controllers of said third plurality; means delivering said command signals from said first programmable controller to said programmable controllers of said third plurality, said controllers of said third plurality of each generating operational status and control signals for its associated equipment group in response to the operating parameter signals and to an input command signal in accordance with stored instructions; means for delivering the signals commensurate with those monitored operating parameters which relate to the safety of operation of each equipment group to its associated controller of said third plurality, said controllers of said third plurality each generating operation termination signals commensurate with actual and potential violation of safe operating conditions of the ancillary equipment group in response to said safety related operating parameter signals and in accordance with stored instructions; means for delivering the signals commensurate with those monitored operating parameters which relate to the safety of operation of another ancillary equipment group of each of said programmable controllers of said third plurality, said controllers of said third plurality each also generating operation termination signals commensurate with actual and potential violation of safe operating conditions of a second ancillary equipment group in response to said safety related operating parameter signals and in accordance with stored instructions, said delivering means insuring that the safety of operation of each ancillary equipment group is redundantly checked by a pair of programmable controllers of said third plurality; means for comparing the operation termination signals pertaining to each ancillary equipment group as generated by a pair of programmable controllers of said third plurality, said comparing means providing an indication of any discrepancy between the signals commensurate with actual and potential violation of safe operating conditions for an individual equipment group; and means delivering the operational status signals generated by said programmable controllers of said third plurality to said first programmable controller.