The following discussion is part of an occasional series, "Ask the Automation Pros," authored by Greg McMillan, industry consultant, author of numerous process control books and 2010 ISA Life Achievement Award recipient. Program administrators will collect submitted questions and solicit responses from automation professionals. Past Q&A videos are available on the ISA YouTube channel; you can view the playlist here. You can read posts from this series here.

Looking for additional career guidance, or to offer support to those new to automation? Sign up for the ISA Mentor Program.

Russ Rhinehart’s Questions

Where are the best practices to 1) understand where override control is needed, and 2) how to implement it?

Peter Morgan’s Response

It’s good that Russ raises this question on this forum since the subject is rarely covered in courses on control despite being widely used in industrial applications. There are opportunities to apply override control when a manipulated variable influences more than one process variable. For example, pump speed might be adjusted by a controller to control pipeline flow, but in doing so, when the pump speed is increased, the pump discharge pressure increases and pump suction pressure falls. The inadvertent closure of a downstream valve or failure of a downstream booster pump might mean that the target flow cannot be achieved without exceeding the design pressure limit for the pump discharge piping. Similarly, a restriction upstream of the pump could result in low suction pressure which, if pump speed is not reduced, could lead to pump failure through cavitation. Limits like this are usually identified by the process engineer. It is important to recognize that an override strategy cannot be relied upon for equipment/plant protection, but might be implemented to preempt operation of the primary equipment protection to avoid shutdowns which more seriously affect production, and which have their own way of introducing hazards especially on start-up.

An override strategy involves using one or multiple low or high signal selectors and must incorporate provisions to prevent integral wind-up of the controller(s) that are not selected for adjustment of the MV. For position PID controllers, there are two methods that I can recommend: one using integral tracking and the other using external reset feedback (ERFB) at controllers implementing integral action through positive feedback. In my career, I have successfully implemented many override strategies employing integral tracking but have recently been introduced to the benefits of using ERFB for override strategies by Greg McMillan. I will briefly cover the implementation of both methods here.

Override Implementing Integral Tracking

Explaining a couple of terms will be helpful here:

Integral Tracking Mode: In this mode, the controller integral term follows the track value so that the output is the sum of the track value plus the gain times error. Not all DCS or PLC vendors provide this feature in the standard PID block, but it can be implemented using controller output tracking (defined below), using (in this case) the output of the signal selector plus controller gain times error as the tracking signal.

Output Tracking Mode: In this mode, the controller output follows the track value. Although output tracking is commonly provided by DCS and PLC vendors as a feature of the standard PID block, it can be alternatively implemented by writing the track value to the controller output register (or equivalent) when output tracking is requested by the configured logic.

Figure 1 illustrates an override strategy implementing integral tracking. In normal operation, the pump speed is controlled to match pipeline flow with the setpoint. In this situation, the pump discharge pressure will be lower than the override setpoint and the pump suction pressure will be above the override setpoint and both will be in the integral track mode so that their outputs will follow the filter output with offsets depending on the error. The importance of adding a filter in the tracking signal cannot be overstated, since without it, if more than one controller is calling for a reduction in speed, the speed demand will rapidly ratchet to zero due to the successive switching of the controllers to integral tracking. The filter time constant is usually set to match the integral action time of the fastest controller. In the steady state, the filter output will match the value of the selector output but will follow slightly behind it in a transient situation. If, due to a restriction downstream of the pump, the pump discharge pressure rises, the output of the discharge pressure controller will approach the value at the output of the filter, falling further until it is lower than the selected signal. When this occurs, the discharge pressure controller will exit the integral track mode to control discharge pressure and the pipeline flow controller will enter the integral tracking mode. When the condition causing high discharge pressure is rectified, and discharge pressure falls, the discharge pressure controller output will increase until pipeline flow is above setpoint, when flow controller will exit the integral track mode and the pump discharge pressure enter the integral track mode.

Cautionary Notes in Implementation

Typically, the PID controller in DCS and PLCs incorporate an auto/man station and it is important that the operator has a single point of access for manual intervention. This might mean that the override controllers be locked in Auto and the mode at the primary controller unrestricted. Alternatively, an auto/man station can be configured downstream of the selector and the primary and override controller(s) locked in auto.

Although override action is not necessarily alarmed, an indication of the mode of the controller should be indicated at the Human Machine Interface (HMI).

As a general comment and caution, it should be noted that a number of vendors make provision for the implementation of this strategy without the need for the user to custom configure the required tracking at the controller or add provisions to prevent ratchetting. In these cases, the behavior may not be immediately obvious (and may not be fully described), and users are advised to verify behavior of the implemented override strategy by offline testing before use.

Figure 1: Override strategy implementing integral tracking

Override Implementing External Reset Feedback

When controller integral action is implemented using filtered positive feedback, the output of the signal selector can be used as the feedback signal for every controller in the override strategy, avoiding integral windup of controllers not selected and latency in action when there is a demand for override action. When external reset feedback is utilized, there is no need for additional Boolean logic (or custom code) in implementing the override strategy. Interestingly, integration by filtered positive feedback was (and is) a feature of pneumatic controllers, but has not been widely adopted by control system vendors. F. Greg Shinskey and Greg McMillan have long been advocates of this implementation, and it is unfortunate that it hasn’t been made widely available by control system vendors.

Figure 2 illustrates the reference override strategy using controllers implementing ERFB, also shown is the simplified schematic for the controller.

In the steady state (practically a rare situation), and pump suction pressure and discharge pressure normal, the override controller outputs would match the output of the flow controller plus (at each override controller) the controller gain times the control error and the output of each would be higher than that from the flow controller. Note that the suction pressure controller would be direct acting and the discharge pressure reverse acting. As pump discharge pressure increases and approaches the override setpoint, the output of the discharge pressure controller would approach the value at the output of the flow controller and eventually (when the discharge pressure is above the override setpoint) would be lower than that from the flow controller and would be selected as the speed setpoint so that the pump discharge pressure controller modulates the pump speed and the suction pressure and flow controllers follow.

Figure 2: Override strategy implementing external reset feedback

Comparing the response of implementations, we can assume that the tuning constants for the controllers will be the same since the controlled process is the same. When, in the implementation using integral tracking, the filter time constant is set to match the IAT of the fastest loop (usually an override controller), when the demand from the flow controller is increasing, the filter output will be following the speed demand but slightly behind it. In this case, as the PV at an override controller approaches the setpoint, the override controller output may be selected a little before the PV crosses the override setpoint. This is advantageous in that it helps avoid an overshoot of the setpoint. For the implementation using ERFB, since the filter in the integral track implementation matches that of the fastest controller, the response of the ERFB implementation will be indistinguishable from that of the integral tracking implementation. The situation is slightly different for the recovery from override action. In this case, because the filter time constant (IAT) for the flow controller is typically larger in the case of the ERFB implementation than that in the integral tracking implementation, in the ERFB implementation, the transfer to flow control would occur before that occurring for the integral tracking implementation. Arguably this might be considered better, in that the recovery is more gradual with possibly a larger margin to override action when the transfer takes place. Although I have never had to implement override strategies using integral tracking with a different filter for each controller, it would seem that doing so would make the integral tracking implementation and ERFB implementation exactly equivalent, the ERFB implementation remaining the simplest.

Cautionary Notes in Implementation

If an implementation of PID using filtered positive feedback is not provided as a standard configurable control option in the programable system (DCS or PLC), the temptation to custom build it should not be acted on without some consideration. While the algorithm can be easily built with function blocks typically provided in a contemporary control system, mode shedding based on downstream status and initialization on download which are conditions accounted for in vendor provided functions might not be easily accounted for, or at least will add to the complexity of a custom algorithm. Not to be forgotten is the need to build a custom “faceplate” when a custom PID is configured — not that complicated, but extra effort.

Let’s continue to encourage vendors to provide ERFB as standard option.

For further reading, check out ISA Technical Report ISA-TR5.9-2023 Proportional-Integral-Derivative (PID) Algorithms and Performance.

Greg McMillan’s Thoughts

I greatly appreciate the simulation studies that Peter has made as seen in his response and also in the Control Global feature article: “The pitfalls and promise of override strategies.”

It has always been a challenge to ensure that the PID controllers can smoothly and proactively take over to promote process performance and to prevent the activation of safety instrumented systems. Override controllers must not unnecessarily interfere with the controllers normally in charge of manipulated variables. Override controllers need to act soon enough but not experience excessive overshoot when they take over that is challenging for large sudden disturbances and interactions and difficult process dynamics. Also, ratcheting occurs when two or more controllers are asking to go in the same direction causing the outputs to walk-off to their output limit. I was clued into an essential implementation tip when a 1980s study showed that integral tracking with a filter time equal to the reset time in each override controller prevented ratcheting and helped achieve the process performance and safety goals. ERFB uses a filter time equal to its reset time. This, plus other ERFB features greatly help achieve the best override control. Note that ERFB is the inherent result of the positive feedback implementation of integral action detailed in ISA-TR5.9-2023 with other benefits explained in terms of dead time compensation and dealing with analyzer cycle times.

I advocate implementing some historized diagnostics that keeps track of how much time each override controller has taken over and what was the peak error, integrated absolute error, and settling time each time an override controller has taken over in a representative period, which could be the current batch for a batch process or the last 12 hours for a continuous process. This can be used to improve tuning and to diagnose some process or equipment issues.

It is important to note that override control is sequential whereas constraint control in model predictive control (MPC) is simultaneous. Also, the dynamic models in MPC constraint control provide proactive corrections based on predictions of constraint variables future values.

Mark Darby’s Thoughts

In chemical engineering textbooks I’ve read and used, override control is usually covered, but the details vary. Some, I’m pleased to say, do cover external reset feedback. In others, it is treated in the same way as anti-reset wind-up is often handled, i.e., by turning off integral action of the unselected PID output. Consistent with what others have said, external reset should be considered a standard approach for implementing selectors with multiple PID outputs.

I recently encountered the ratcheting problem in a PLC implementation of an override controller with a column pressure controller. As is I think is common in many PLCs, the PID is implemented as an incremental algorithm, generating a delta move that is added to a downstream block current value (PID loop setpoint or analog output). The ratcheting problem became apparent after I changed the pressure controller tuning to tighten the control. Peter Morgan simulated this case and reproduced similar behavior I witnessed. For this particular implementation, we decided against coding a custom external reset feedback (or integral tracking) method and opted instead for a logic-based implementation that would only allow the override controller to come into the selector when the override was close to its limit.

More generally, I believe a logic-based approach for bringing in overrides can make sense regardless of the underlying algorithm. I know of practitioners who will sometimes modify the PID tuning of an override based on how far away the override is from its limit. An example is when the integral time of the override is much larger than the main controller, which may lead to the override coming in and out when far from the limit. To prevent this situation from occurring, the integral time can be set smaller when the override is far from its limit.

Regarding the approach of setting the unselected output offset equal to its error multiplied by its gain, I have also used systems with this built-in approach. It was illuminating to learn that it must have included a filter on the selected output before applying the gain x error correction. But as I recall, it was an undocumented feature.

A final note on MPC: An override is automatically handled in a model predictive controller (MPC) and can offer advantageous over a PID-selector approach. Depending on the control system, an MPC option might be available on level 2 (Purdue model). MPC would also offer improved handling for the case of using multiple manipulated variables to control a given controlled variable.

Matthew Howard’s Thoughts                                                                                              

The override select block in the DCS system I use sets the unselected output offset equal to the error of the unselected loop multiplied by the gain of the loop. This is a built-in feature to prevent ratcheting. This results in a smooth crossover of control for our cases that involve two controllers. For example, a level controller asking for pumps to speed up, but a flow controller that acts as a “flow limiter.” If the flow gets too high, it lifts the beds in water clarifiers.  Then the available flow rate goes down drastically when downstream filters get plugged. The only big problems I have had are when the output of the override controller fans out to multiple points. I had big problems working on a boiler master that we could not figure out and had to write custom programming to force what we wanted to happen to get “bumpless transfer” to function the way we envisioned.

Michael Taube’s Thoughts

Working with a DCS that has the proper transition-handling built-in: it eliminates a LOT of “rolling your own,” thus making maintenance and troubleshooting so much easier! There is an important caveat, however: Be sure that ALL function blocks, especially fanout blocks, in an application propagate override status to its primary. I was asked to (re)design a multi-heater firing and fuel management application for a client when they discovered that their design attempts (which were MANY) would not work simply for this reason alone! They had struggled for over two years trying to make it work before they discovered the “feature;” it took me about two hours to come up with an alternative design that I eventually implemented at site.

Ed Farmer’s Thoughts

There are at least three “overriding” criteria for a process control or automation system.

First is the proper operation of the process itself — performing the desired functions in the desired manner. This is often based on pertinent techniques but often with a bit of derivation to meet the needs specific to the particular project.

Second, there is the often-well-understood methodology of the core process design itself. Sometimes adaptation from the “normal” for a particular application involves control system design tweaks that bump into the simpler objectives of the basic design.

Third, there are safety issues which often confront reliability, operation safety, public safety and operational economics.

Process constraints and overrides are the essential periphery of what we must expect from the overall implementation of an automation system. The usual objectives are getting the most from the system and limiting the hazards and damage it can produce. “Getting the process right” involves methods and adjustments that make the essential things happen in the expected way. “Safety” often involves limiting conditions that head outside the acceptable criteria. A safety parameter is usually required to be in a “normal range” for operation to occur. We look for conditions that are certain to positively indicate proper operation.

Clearly, the constraint design objectives are focused on positive indication of “all safe” conditions.

Good references for this sort of thing are in the Nuclear Regulatory Commission publications which include such things as NUREG-0492 “Fault Tree Handbook.” I used their approach in an ISA “short course” I called “Risk Assessment and Management” that I did back in the ‘80s. The course involves about 35 pages which included:

• Fundamentals of risk assessment
• Fault tree analysis
• Fault tree mathematics
• Appropriate alarm circuit/system design
• Risk assessment

It was organized around three days, typically in some ISA event. It qualified for 3 Continuing Education Units (CEU).

About the Automation Pros

Russ Rhinehart is ChE professor emeritus at Oklahoma State University, has experience in both the process industry (13 years) and academe (31 years). He is a fellow of the International Society of Automation (ISA) and the American Institute of Chemical Engineers (AIChE), a former Editor-in-Chief of ISA Transactions and President of the Am. Automatic Control Council, and was inducted into the Control Global Process Automation Hall of Fame. Visit www.r3eda.com.

Peter Morgan is an ISA senior member with more than 40 years of experience designing and commissioning control systems for the power and process industries. He was a contributing member of the ISA 5.9 PID committee for which he won the ISA Standards Achievement Award and has had a number of feature articles published in Control magazine.

Gregory K. McMillan retired as a Senior Fellow from Solutia Inc in 2002 and retired as a Senior Principal Software Engineer in Emerson Process Systems and Solutions simulation R&D in 2023. Greg is an ISA Fellow and the author of more than 200 articles and papers, 100 Q&A posts, 80 blogs, 200 columns and 20 books. He was one of the first inductees into the Control Global Process Automation Hall of Fame in 2001, and received the ISA Lifetime Achievement Award in 2010, ISA Mentor Award in 2020 and ISA Standards Achievement Award in 2023.

https://www.linkedin.com/in/greg-mcmillan-5b256514/

Mark Darby is an independent consultant with CMiD Solutions. He provides process control-related services to the petrochemical, refining and mid/upstream industries in the design and implementation of advanced regulatory and multivariable predictive controls. Mark is an ISA senior member. He served on the TR5.9 committee that produced the PID technical report and has presented at ISA technical conferences. Mark frequently publishes and presents on topics related to process control and real-time optimization. He is a contributing author to the McGraw-Hill Process/Industrial Instruments and Controls Handbook Sixth Edition.

www.linkedin.com/in/mark-darby-5210921

Matthew Howard is the Pulp Mill Area Systems Manager for Sappi North America, Somerset Mill, Skowhegan Maine, a large fully integrated pulp and paper manufacturing facility.  He has is a past member of the ISA Mentor Program.  He is responsible for multiple DCS systems maintenance and integration.  He prefers to use his UMaine Chemical Engineering and technical background to implement process improvements with or without capital investment.  Informed by an early stint as frontline supervisor, he also strives to steadily improve the operator effectiveness of his plant in accord with ISA standards 101 and ISA 18.2.

Michael Taube is a Principal Consultant at S&D Consulting Inc. Serving the greater process industries as an independent consultant since 2002, he pursues his passion to make things better than they were yesterday by identifying the problems no one else sees or is willing to admit to and willingly “gets his hands dirty” to solve the problems no one else can. Due to the continued occurrence of individual injuries and fatalities as well as large-scale industrial incidents, he collaborates with operational excellence and safety culture experts to promote a real and lasting cultural shift in the process industries to help make ZERO incidents a reality. He graduated from Texas A&M University in 1988 with a Bachelor of Science degree in Chemical Engineering. 

https://www.linkedin.com/in/michaeltaube/

Ed Farmer completed a BSEE and a Physics Master degree at California State University – Chico. He retired in 2018 after 50 years of electrical and control systems engineering. Much of his work involved oil industry automation projects around the world and application of the LeakNet pipeline leak detection and location system he patented. His publications include three ISA books, short courses, numerous periodical articles and blogs. He is an ISA Fellow and Mentor.