Methods and apparatus for control configuration with enhanced change-tracking

Abstract

The invention provides, in some aspects, a process, environmental, manufacturing, industrial or other such control system (hereinafter, “control system”) with enhanced, real-time change tracking. The system includes one or more configurable elements (e.g., field devices), a change tracking system that records of changes to those configurable elements (e.g., for compliance reporting, etc.) and a change detection system that responds to detected changes in configuration of those element(s) by inferring an identity of a person and/or device responsible for a change, the time of the change, and/or the reason for the change. This is unlike prior art systems, in which that such information must be specified, e.g., in a data entry form filled-in by the field engineer, operator or other who is making the change.

Description

BACKGROUND OF THE INVENTION

The invention relates to process control and, more particularly, to tracking changes in the configuration of process control devices.

The terms “control” and “control systems” refer to the control of a device or system by monitoring one or more of its characteristics. This is used to insure that output, processing, quality and/or efficiency remain within desired parameters over the course of time. In many control systems, digital data processing or other automated apparatus monitor a device, process or system and automatically adjust its operational parameters. In other control systems, such apparatus monitor the device, process or system and display alarms or other indicia of its characteristics, leaving responsibility for adjustment to the operator.

Control is used in a number of fields. Process control, for example, is typically employed in the manufacturing sector for process, repetitive and discrete manufactures, though, it also has wide application in utility and other service industries. Environmental control finds application in residential, commercial, institutional and industrial settings, where temperature and other environmental factors must be properly maintained. Control is also used in articles of manufacture, from toasters to aircraft, to monitor and control device operation.

Modern day control systems typically include a combination of field devices, control devices, and controllers, the functions of which may overlap or be combined. Field devices include temperature, flow and other sensors that measure characteristics of the device, process or system being controlled. Control devices include valves, actuators, and the like, that control the device, process or system itself.

Controllers generate settings for the control devices based on measurements from the field devices. Controller operation is typically based on a “control algorithm” that maintains a controlled system at a desired level, or drives it to that level, by minimizing differences between the values measured by the sensors and, for example, a setpoint defined by the operator.

In a food processing plant, for example, a controller can be used to maintain a soup stock at a simmer or low boil. This is done by comparing measurements of vapor pressure in the processing vessel with a desired setpoint. If the vessel pressure is too low, the control algorithm may call for incrementally opening the heating gas valves, thereby, driving the pressure and boiling activity upwards. As the pressure approaches the desired setpoint, the algorithm requires incrementally leveling the valves to maintain the roil of the boil.

Controllers may be networked or otherwise connected to other computing apparatus that facilitate monitoring or administration. The so-called S88 industry standard, described in Batch Control—Part 1: Models and Terminology (The International Society for Measurement and Control 1995), for example, defines a hierarchy of processing and control equipment (“equipment entities”) that can be used to model and control an automated manufacturing process. At the lowest level of the hierarchy are control modules that directly manipulate field devices (e.g., opening and closing valves) and, possibly, other control modules. At a higher level, equipment modules coordinate the functions control modules, as well as of other equipment modules, and may execute phases of the manufacturing process (such as setting controller constants and modes). “Units,” at still a higher level of the hierarchy, coordinate the functions of equipment and control modules. Process cells orchestrate all processing activities required to produce a manufacturing batch, e.g., scheduling, preparing and monitoring equipment or resources, and so forth.

The principal function of controllers is executing control algorithms for the real-time monitoring and control of devices, processes or systems. They typically have neither the computing power nor user interfaces required to facilitate the design of a control algorithm. Instead, the art has developed configurators. These are typically general purpose computers (e.g., workstations) running software that permit an engineer or operator to graphically model a device, process or system and the desired strategy for controlling it. This includes enumerating field devices, control devices, controllers and other apparatus that will be used for control, specifying their interrelationships and the information that will be transferred among them, as well as detailing the calculations and methodology they will apply for purposes of control. Once modeling is complete and tested, the control algorithm is downloaded to the controllers.

One well known process control system configurator is that provided with the I/A Series® (hereinafter, “IAS” or “I/A”) systems, marketed by the assignee hereof. These provide a graphical interface (FoxCAE) permitting an engineer to model a process hierarchically and to define a control algorithm from that hierarchy. Multiple editors are provided for defining and modifying modules within the hierarchy. A change management system, FoxCMS®, also marketed by the assignee hereof, provides for logging of configuration changes downloaded to controllers by the I/A Series system.

Though prior art process control configuration systems, particularly, the IAS systems and others sold by the assignee hereof, have met wide acceptance in the industry, there remains room for improvement. Such is the case, for example, with respect to the configuration of complex control systems, as well as with the tracking of changes to the configurations of those systems.

In this context, an object of the present invention is to provide improved methods and apparatus for control and, particularly, for tracking changes to configurations of control systems.

A further object of the invention is to provide such methods and apparatus as facilitate tracking changes made outside traditional process control model configurators.

Still yet a further object of the invention is to provide such methods and apparatus as can be used with a range control systems, whether pertaining to process, environmental, manufacturing, industrial or other such control or otherwise.

SUMMARY OF THE INVENTION

The foregoing are among the objects attained by the invention, which provides, in one aspect, a process, environmental, manufacturing, industrial or other such control system (hereinafter, “control system”) with enhanced change tracking. The system includes one or more configurable elements (e.g., controllers, field devices, etc.), a change tracking system that records of changes to those configurable elements (e.g., for compliance reporting, etc.) and a change detection system that responds to changes made to the configuration of those elements (e.g., outside the purview of a configuration editor), by inferring an identity of a person and/or device responsible for a change, the time of the change, and/or the reason(s) for the change. This is unlike prior art systems, in which that such information is typically specified by an editor or other configurator subsystem, e.g., in a data entry form (or widget) completed by the field engineer, operator or other who is making the change.

Inference Based on Live Lists of Users

Related aspects of the invention provide systems, e.g., as described above, in which the change detection system infers the identity of a person responsible for a change from a list of “live” users on a control network to which the element(s) are coupled. These live users are, for example, those that are logged-in and/or active on the network.

In such a control system, by way of non-limiting example, the change detection system can respond to indication that the configuration of a field device has been changed (e.g., outside the configurator) by querying the network for a list of users who were logged-in at the time of the change and, further, for example, by winnowing down that list to identify users with sufficient access and permissions to effect the change. The change detection system can, further, winnow down such a list to identify (a) users who are expected to make changes (e.g., field engineers), and/or (b) users who are not expected to make changes and whose log-ins might suggest surreptitious activity.

In related aspects of the invention, the change detection system winnow the live user list based on the result of queries to asset management, employment, IT or other databases and/or other stores of information about the control system, the devices and/or the people with potential access to it and/or responsible for changing it. Continuing the example above, the change detection system can access a maintenance database to discern which of the users on the live list were expected to make a detected configuration change. Alternatively or in addition, that subsystem can access personnel databases to identify users that scheduled to have been on vacation at the time the change was made.

Further related aspects of the invention provide systems, e.g., as described above, in which the change detection system infers the identity of a person responsible for a change from information resident on and/or supplied by the device that made the change. In such a control system, by way of non-limiting example, the change detection system can respond to indications that the configuration of a field device has been changed by querying a proxy or other software executing on the responsible device for the identify of the operator (or “user”) who made the change. Thus, for example, that resident software can query memory locations on the device for the user's identity and can return that to the change detection subsystem.

Alternatively, or in addition, the resident software can query the user of that device directly, e.g., by way of a pop-up dialog box or otherwise to ask his/her identity. As above, queries by the change detection system to the resident software and/or responses by it can be made at or around the time the change is detected or subsequent thereto.

Inference Based on Live Lists of Devices

Other aspects of the invention provide systems, e.g., as described above, in which the change detection system infers the identity of a person and/or a device responsible for a change from a list of devices that were “live” on the control network at the time of the change—and, more particularly, for example, from a list of those live devices that were in direct or indirect communications coupling with changed element.

These live devices are, for example, those that are actively coupled to the network and on which a user is logged-in (or in which a process capable of effecting the change is active)—or that, more generally, are sufficiently coupled to the changed as to enable a user (or process) to effect the change to the configurable elements.

In such a control system, by way of non-limiting example, the change detection system can respond to a change (e.g., made outside the configurator) by querying the network for a list of devices that are active and logged in to the control network to identify those capable of effecting a configuration changes. The change detection system can, further, winnow down the live list to identify workstations, personal computers, portable computers, personal digital assistants and other devices on which a logged-in user might effect the detected change. It can further include, of example, winnowing such a list to identify (a) devices from which a change is expected to be made (e.g., a plant floor-based workstation, and/or (b) unexpected devices from which a surreptitious change might be made (e.g., an unregistered portable computer or PDA).

In further related aspects of the invention, the change detection system can query one or more devices identified from the live list, e.g., to identify the user responsible for the detected change. Thus, for example, the change detection system can query memory locations on the device to identify logged-in users (or active processes) at or around the time of the change.

Inference Based on Enterprise, Control System or Other Databases

In related aspects of the invention, the change detection system can supplant or supplement querying of the live lists of users and/or devices with querying of asset management, employment, IT or other databases and/or other stores of information about the control system, the devices and/or the people with potential access to it and/or responsible for changing it. Continuing the example above, the change detection system can access a maintenance database to discern which of the devices and/or their respective users on the live lists were expected to make a detected configuration change. Alternatively or in addition, that subsystem can access an IT database to identify which devices on such a list are assigned to which users and/or to identify which devices on that list were previously reported as checked-out/lost/stolen (and, thus, may be the source of permitted vs. surreptitious activity). Alternatively or in addition, that subsystem can access a personnel database to discern which of those users whose job roles included making changes of the type detected were on duty at the time of the change.

Still further aspects of the invention provide methods for process, environmental, manufacturing, industrial or other such control system with enhanced change tracking that parallel operation of the systems described above.

These and other aspects of the invention are evident in the drawings and in the discussion that follows.

BRIEF DESCRIPTION OF THE DRAWINGS

A more complete understanding of the invention may be attained by reference to the drawings, in which:

FIG. 1 depicts a control system of the type in which the invention is practiced;

FIGS. 2A-2B depict a process control system of the type with which the invention is practiced;

FIG. 3 depicts control algorithm configurator components in a system according to the invention;

FIG. 4 depicts component interaction in a system according to the invention;

FIG. 5 depicts an exemplary editor (here, a field bus module editor) in a system according to the invention; and

FIG. 6 depicts a process for enhanced change tracking in accord with the invention.

DETAILED DESCRIPTION OF THE ILLUSTRATED EMBODIMENT

System Architecture

FIGS. 1-2 depict an illustrative control system 5 of the type with which apparatus and methods according to the invention may be practiced. The illustrated system is particularly adapted for use in connection with process control, as discussed further below. However, those skilled in the art will appreciate that apparatus and methods according to the invention can be used in connection with other control systems. In this regard, subsystems 12A, 12B can encompass any industrial, manufacturing, service, environmental or other process, device or system under monitoring or control (hereinafter, collectively, “control”).

The system of FIGS. 1-2 includes a workstation 11 that is coupled to one or more control devices, here, controllers 10A, 10B, actuators 18, sensors 24, 26, and so forth, as illustrated, on some of which reside process control algorithms for monitoring and/or controlling one or more processes within subsystems 12A, 12B. These may represent independent processes or different aspects of the same or related processes. Moreover, the processes encompassed in subsystems 12A, 12B may reside within a single plant, site or area, cell or unit or, conversely, they may dispersed among many plants, sites, areas, cell or units.

Workstation 11 represents an engineering workstation, personal computer, mainframe computer or other digital data processing device suitable for modeling and/or configuring a control system 5 (e.g., here, controllers 10A, 10B and other control devices, such as actuators 18, sensors 24, 26, and other field devices and/or the apparatus controlled thereby). Though illustrated as being carried out on workstation 11, those skilled in the art will appreciate that the modeling and configuration functions can be executed on suitably configured controllers 10A, 10B or other control devices (e.g., smart field devices or other control devices those having sufficient processing power and interfaces to provide the graphical and other configuration functions described herein). A discussion of the use of smart field devices and other control devices for modeling and control is provided, by way of example, in U.S. Pat. No. 6,788,980, entitled “Methods and Apparatus for Control Using Control Devices That Provide a Virtual Machine Environment and That Communicate Via an IP Network,” the teachings of which are incorporated herein by reference.

Network 14 provides a medium for communications, real-time or otherwise, among and/or between the elements of the control system 5, including workstation 11, change tracking system 16, controllers 10A, 10B and other control devices 18, 19, 24, 26 and controlled apparatus. The network 14 also provides a medium permitting the downloading of control algorithms and other configuration information, e.g., to controllers 10A, 10B and other control devices 18, 19, 24, 26 (or controlled apparatus), e.g., from workstation 11. It can also provide a medium for uploading information from controllers 10A, 10B and other control devices 18, 19, 24, 26 (or controlled apparatus) to those other digital data processors 11, 16. Though illustrated to represent a LAN, WAN, or global network (Internet), those skilled in the art will appreciate that element 14 may represent any medium or mechanism through which control algorithms and configuration and other information may be transported, electronically, physically or otherwise, to and from and/or among the illustrated elements 10A, 10B, 11, 16, 18, 19, 24, 26.

Change tracking system (CTS) 16 logs changes to the control system 5, e.g., to controllers 10A, 10B and the other control devices (e.g., actuators 18, sensors 24, 26, and other field devices) or controlled apparatus. This can be for regulatory purposes, safety purposes, maintenance purposes or otherwise, which the system 16 can additionally support, e.g., via retrieval and reporting services (discussed below). That logged information can include, by way of non-limiting example, control algorithms, operational parameters, I/O assignments, and so forth. In the illustrated embodiment, CTS 16 comprises a conventional change tracking (or management) system of the type known in the art and/or commercially available in the marketplace (e.g., the FoxCMS®, marketed by the assignee hereof) as adapted in accord with the teaching hereof.

Exemplary Control Subsystem

An exemplary subsystem 12A including a control process is illustrated in greater detail in FIG. 2A. It shows an actuator, such as valve 18 (or other field device), that governs the rate of fluid flow to aeration tank 20 which, in turn, transfers the liquid to storage tank 22. Field devices, i.e., sensors 24 and 26, monitor the state of process 12A and, thereby, facilitate its control by controller 10A which executes a control algorithm 28. Thus, sensor 24 is disposed in or adjacent to tank 20 for measuring the temperature of fluid therein, while sensor 26 measures the flow of fluid from aeration tank 20 to storage tank 22. The illustrated actuator (valve 18), sensors 24, 26 and other field devices (not shown) in the illustrated subsystem may of the “smart” variety or otherwise. In this regard, “smart” field devices are those of the type known in the art that may, for example, include embedded processors and/or other logic suitable for advanced configuration and/or operational modes including execution of control algorithms of their own.

FIG. 2A further illustrates a control algorithm 28 of the type that can be configured by methods and apparatus according to the invention. Here, the algorithm 28 is executed by controller 10A to communicate with and/or coordinate operations of the field devices 18, 19, 24, 26 and, thereby, to control the processes being carried out in subsystem 12A. The algorithm 28 includes blocks or other entities 29, 30, 32, that model those field devices—and, more generally, that model those and other control devices and other elements within subsystem 12A or, more generally, in system 10 and the apparatus controlled thereby—and that monitor and/or control the states and interactions between those entities.

Entities 29, 30, 32 comprise software components which may include, by non-limiting example, source, intermediate or executable code, databases, of the type conventionally used in the art for operating controllers, field devices, control devices and other control equipment. Referenced in this regard in the discussion below are software components, and process control systems in general, marketed as the I/A Series® systems (hereinafter, “IAS” or “I/A”) available from the assignee hereof Those skilled in the art will appreciate that methods and apparatus according to the invention can be used to model processes and configure control algorithms for use with other control systems, as well.

FIGS. 2A and 2B further illustrate that one or more of the control devices—e.g., controllers 10A, 10B, workstation 11, change tracking system 16, and the other control devices (e.g., actuators 18, field bus module 19, sensors 24, 26, and other field devices) or controlled apparatus—can be coupled for communication via portions of the network 14, here, network segment 14a. Those segments can comprise any network media known in the art and/or available in the marketplace suitable for such purposes. The segments can operate in accord with Profibus, Fieldbus, Hart, Modbus or other “process control” communications standards, and can include (as applicable) bus masters and/or slaves necessary and/or desirable to practice in accord with those standards. A further appreciation of the configuration and operation of such network segments may be attained by reference to incorporated-by-reference U.S. patent application Ser. No. 12/474,942.

Configurator

The illustrated system utilizes a Control Algorithm Configurator, to model and configure control processes, as well as to logging downloaded configuration information for change tracking. That system can be constructed and operated in the manner of process control configurators of the type known in the art—as adapted in accord with the teachings hereof. Thus, by way of example, it can be constructed and, operated in the manner of the process control configurator (i) referred to as the “IDA Control Algorithm Configurator,” and the like, in aforementioned incorporated-by-reference U.S. Pat. No. 6,754,885, and/or (ii) referred to as the “Control Algorithm Configurator,” the “Configurator,” in incorporated-by-reference U.S. patent application Ser. No. 12/474,942—either or both, again, as adapted in accord with the teachings hereof.

By way of overview, the Configurator employs objects (or other data and/or programming constructs) to represent the devices that make up the control system, the entities that define the control algorithms executed by those devices, the processes or systems being monitored and/or controlled by those devices and algorithms, as well as the entities within the configuration apparatus itself.

In the illustrated embodiment, the objects represent, by way of non-limiting example, field devices, field bus modules (FBMs), control devices, control processors, blocks, loops, compounds, bus masters, bus slaves, networks, field buses, historians, object type categories, object connections, parameter connections, display placeholders, graphical display entities, and reports—all by way of non-limiting example. They also represent entities of a control level hierarchy, e.g., sites, areas, process cells, units, and the like. Thus, by way of non-limiting example, the Configurator utilizes objects to represent the elements shown in FIGS. 1, 2A and 2B, including, but not limited to the bus master (FBM) 19 and bus slaves (e.g., actuator 18 and sensors 24, 26).

In the illustrated embodiment, the objects are stored in the database(s) and are referred to as the “model,” the “configuration model,” the “control system model,” and the like. Such a model is depicted in the object diagrams provided in the figures attached to aforementioned incorporated-by-reference U.S. Pat. No. 6,754,885 and U.S. patent application Ser. No. 12/474,942 and discussed therein, as well as by the graphical and textual representations thereof (typically, in the context of the editors), again, in the figures attached thereto and discussed therein.

Parameters define characteristics of each object and, therefore, of the element or entity the object represents. Depending on the type of object, these include inputs, outputs, alarm limits, control functions and display characteristics, among others. Each parameter can have attributes that define the parameter's value and other attributes. These include, for example, parameter name, parameter grouping, display label, data type, behavior, help information, edit type, data value range, formula definition, and display format.

Databases

The control system model can be stored in central databases and/or distributed among workstation 11, controllers 10A, 10B and other control devices, e.g., as disclosed in aforementioned, incorporated-by-reference U.S. Pat. Nos. 7,096,465 and 6,788,980, as well as in PCT Application WO03/89,995, entitled “Methods and Apparatus for Process, Factory-Floor, Environmental, Computer Aided Manufacturing-Based or Other Control System With Real-Time Data Distribution,” the teachings of which are also incorporated herein by reference.

In addition to modeling database(s), the illustrated control system can include and/or be coupled to one or more enterprise, control system or other databases of the type typically employed by or in connection with control systems. These include, for example, asset management, employment, information technology (IT) or other databases and/or other stores of information about the control system, the devices and/or the people with potential access to the control system—i.e., the control devices (e.g., controllers 10A, 10B, workstation 11, change tracking system 16, and the other control devices, such as actuators 18, module 19, sensors 24, 26, and other field devices) or the apparatus controlled thereby.

The foregoing modeling databases and other databases are represented for illustrative purposes only by elements 34A-34E in the drawings. Though shown distributed around the control system, these may be consolidated in fewer or distributed among more such devices or elsewhere or otherwise, all in the conventional manner known in the art.

Configurator Architecture

Referring to FIG. 3, a Configurator according to one embodiment of the invention includes a Framework, a database, a project manager and a set of editors. The Framework provides common resources, such as menus, toolbars, dialogs, and security services, used by the editors to manipulate, display and report configuration data stored in the model/configuration database. In one practice of the invention, the Configurator and Framework are packaged as a single application. This software package can be installed on workstation 11 or other digital data processor.

The editors are used by the implementation creator to create and maintain standard control scheme definition objects distributed with the implementation and by users to create their own plant control schemes. The Project Manager allows the user to browse through the project configuration hierarchies and data. Interactions among the editors and the project manager/navigator are shown, by way of non-limiting example, in FIG. 4.

The database, which may comprise one of aforementioned components 34A-34E, forms part of an object oriented database management system (OODBMS), which may be any type commercially available in the marketplace. The database can be deployed in a client/server configuration with a single centralized database per plant servicing multiple clients, or otherwise. In the illustrated embodiment, it resides on the workstation 11, e.g., or on a digital data processor coupled therewith.

A user can employ Configurator editors to create and maintain control scheme definition objects distributed with the implementation and to create their own plant control schemes. Thus, for example, a user can employ an editor to define one object as a descendant of another object at the time of configuration. An object so defined derives parameters from its ancestor which, in turn, derives parameters from its own ancestors, and so forth. Editors also facilitate definition, during configuration, of the association between parameters and their respective objects. Editors can also be used, by way of non-limiting example, to establish relationships between objects—for example, a user can employ an editor to select objects that represent field devices and indicate (e.g., via a drag-and-drop operation, a menu option or other command) that she wishes to establish a relationship with an object that represents a control processor.

To illustrate by way of a non-limiting example, an apparatus according to the invention for use in configuring process control systems can employ an object to model a “conventional” analog input (AIN) field device of the type used in a particular product. That object can include output, high-high alarm, high-low alarm and other parameters of the type used for modeling such devices. The Configurator can be used to define a further object, one that models an analog input device for use in high-temperature environments. That object can descend from the general AIN object and inherit its parameters, e.g., the high-high alarm and high-low alarm parameters. Configuration-time changes to the parameters of the general AIN object can automatically carry through to the high-temperature AIN object, thus, facilitating configuration of the process control system.

The editor can be used to define a further object, one that models an analog input device for use for high-temperature measurements (throughout). That object can descend from the general AIN object and inherit its parameters, e.g., the high-high alarm and high-low alarm parameters, along with their respective attributes—e.g., their alarm value and track attributes. The editor can be used, for example, to alter those attributes, e.g., changing the alarm values, say, for the high-low alarm of the new object.

An editor of the type employed by the Configurator is shown, by way of example, FIG. 5. This shows a Field Bus Module editor that permits a user to define and/or modify parameters of objects in the database that represent devices that serve as field bus masters, i.e., devices that configure and/or control communications on field buses 14A or other sections of the network 14 (see FIGS. 1 and 2A-2B). This can include, by way of non-limiting example, parameters defining timings, port assignments and/or other aspects of the configuration of the respective segments that those bus masters are responsible for configuring and/or controlling.

In addition to recording changes requested by users, preferred Configurator editors record the identity of the person making the change, the time of the change, and/or the reasons for the change. The editors can query users to supply some or all of this information with each change and/or can infer it from application or system logs. Thus, for example, configuration editors can determine user identity from system files identifying the currently logged-in user and can determine time of change from the system clock, all by way of example. The editors can query users for the change justifications (reasons) at the time of each change and/or at the time an edit session is begun.

Download System

Returning to FIG. 4, the Configurator includes a download system or download service, labelled “Download” in the drawing, that transfers configuration information from objects in the model to respective devices of the control system and/or control apparatus, e.g., controllers 10A, 10B and the other control devices (e.g., actuators 18, module 19, sensors 24, 26, and other field devices) or controlled apparatus. The Download Service can be invoked automatically, for example, whenever a user completes an editor session, though, more typically, it is executed by explicit request of the user (e.g., after she has completed a series of editor sessions and verified changes to the model via “manual” checking, via simulator, or otherwise). By way of example, after completing a session with the Field Bus module editor to set values for port assignments, bus timing parameter, etc., the user can invoke the Download Service to configure the corresponding control system elements.

Upon invocation, the Download Service of the illustrated embodiment transfers configuration information from objects in the model to the devices that they (the objects) represent. Continuing with the example, this includes transferring, to the respective bus masters, communications configuration information for their respective segments. (Of course, where objects representing other control system elements have been changed, instead or in addition, it means transferring information for them, instead or in addition, respectively). Downloads can go directly to the respective devices or can go indirectly, e.g., via other devices, such as controllers, field bus modules, as per convention.

At the same time, the Download Service logs those transfers to the change tracking system (CTS) 16. This includes logging the downloaded device parameters, as well (in some embodiments) as the identity of the person and/or device making the change, the time of the change and of the download, and/or the reasons for the change. These transfers to the CTS can be via RPC calls, via calls to functions the CTS exposes in an applications program interface (API), or otherwise. In the illustrated embodiment, the transfers to the CTS are effected by XML files.

By way of example, in connection with downloading configuration information to a device whose system i.d. is “FBM00222,” the Download Service can generate an XML file named, for example, “FBM00222.xml” that contains a listing of parameters downloaded to the device, as well as their respective values—or, referring to the Parameter Definition attribute set above, by including in the XML file the “name” attribute of each parameter for which a value is downloaded, as well as that “value” attribute, though, other attributes can be used instead or in addition.

In other embodiments, the Download Service can generate and the change tracking system 16 can accept change-tracking information in other formats (e.g., as appended parameters to HTTP calls on network 14, as fields of remote procedure calls, or otherwise) and/or grouped in other ways (e.g., one file per parameter changed, multiple devices per file, or otherwise).

Change Tracking System

As noted above, change tracking system (CTS) 16 logs changes to the control system 5, e.g., to controllers 10A, 10B and the other control devices (e.g., actuators 18, module 19, sensors 24, 26, and other field devices) and/or the apparatus controlled thereby. This can be for regulatory purposes, safety purposes, maintenance purposes or otherwise, which the system 16 can additionally support, e.g., via retrieval and reporting services (discussed below). That logged information can include, by way of non-limiting example, control algorithms, operational parameters, I/O assignments, and so forth.

CTS 16 accepts XML files generated, e.g., by the Download Service, the field bus module editor and/or the field device editor, that contain textual (e.g. ASCII) or other representations of configuration information downloaded to devices and named to match (or otherwise in accord with) those devices. The textual or other representations contained in those files includes names of the fields, parameters, etc., to which information is downloaded, as well as the values so downloaded. In other embodiments, the change tracking system 16 can accept the information to be logged in other formats (e.g., as appended parameters to HTTP calls on network 14, as fields of remote procedure calls, or otherwise) and/or grouped in other ways (e.g., one file per parameter changed, multiple devices per file, or otherwise) and/or transmitted in accord with other protocols and/or mechanisms.

Configurator Revisited

In addition to permitting configuration changes to be downloaded (and tracked) after completion of edit sessions, the illustrated Field. Bus Module editor includes a Direct Download feature, that permits users to make direct and immediate (or “real-time”) edits of configuration values stored in the bus master devices. Thus, for example, as the user defines and/or modifies parameter values using the editor's dialog boxes and other edit controls, the editor invokes the FDT or other interface (hereinafter, “interface”) of the corresponding device to cause those values to be loaded into it (the device) while, at the same time, updating the corresponding model objects so that they maintain an accurate representation of the device. The editor also logs the changes to the change tracking system 19, e.g., in the same manner as the Download Service logs transfers it makes to such devices (e.g., via the use of XML files), as discussed below.

The Configurator may incorporate other editors, with greater or lesser functionality than that discussed above in connection with FIG. 5, for types and/or classes of field bus modules and/or for other elements of the control system, e.g., controllers 10A, 10B, and the other control devices (e.g., actuators 18, module 19, sensors 24, 26, and other field devices) or controlled apparatus.

A further appreciation of the editors, download system, change tracking system (or “change tracking service”), and Configurator utilized in an embodiment of the invention may be attained by reference to incorporated-by-reference U.S. Pat. No. 6,754,885 and U.S. patent application Ser. No. 12/474,942.

As those skilled in the art will appreciated, other embodiments may utilize editors, download services and/or change tracking services that operate in other ways, known in the art or otherwise.

Enhanced Change Tracking

Illustrated control system 5, additionally, tracks configuration changes that are made outside the Configurator (and Download Service). Thus, for example, it can log to the CTS 16 changes made to configurable elements in the control system directly and/or indirectly (e.g., via other elements of the control system—other than the Configurator). In addition to logging those changes to CTS 16, the system infers the identity of the person (and/or device) responsible for the change, the time of the change and/or the reason(s) for the change. This is information that would normally be recorded by the Configurator and logged to the CTS along with the changes themselves. This is unlike prior art systems in changes made outside the configuration editor may be undetected or, if detected, lacks additional identity/time/reason information necessary for adequate record-keeping.

This is advantageous, for example, in tracking changes made to controllers, field bus managers, “smart” field devices and/or other control devices with embedded processors and/or other logic suitable for direct configuration via on-board keypads, etc. and/or via self-generated configuration interfaces (accessible by network 14 and/or segment 14a, wirelessly, or otherwise). Even for devices or apparatus that do not themselves provide for direct configuration, this is useful for tracking changes made to them via other devices, whether part of the control system or not. This can include, for example, tracking changes made by ad hoc, but permitted devices, as well as tracking changes made by rogue devices and/or in surreptitious manners.

As used herein, references to the “time” a change is made to a configurable element of the control system mean a date or time and, many embodiments, both. Moreover, the terms “users,” “operators” and like refer not only to persons that are utilizing workstations, personal computers, portable computers, PDAs, and/or other devices from which changes to configurable elements may be effected, but also to daemons and other processes that are executing autonomously (or otherwise) on such devices.

Referring back to FIG. 1, the illustrated system includes a change detection system (CDS) 30 that supports enhanced change tracking as discussed above and detailed below. In the illustrated embodiment, that subsystem comprises functional components 30A-30D whose operation is distributed among devices of the control system—here, among controllers 10A, 10B, workstation 11, and change tracking system 16. The components 30 can communicate with one another and co-share responsibility on a peer-to-peer basis; alternatively, one can serve as a “master” that coordinates the actions of the others and/or as a “server” that provides services to the others for purposes of facilitating enhanced change tracking in accord with the teachings hereof. The components 30A-30D communicate with the elements on which they reside directly or indirectly; they may communicate with other elements of the control system via network 14, all in the conventional manner known in the art as adapted in accord with the teachings hereof.

The configuration of CDS 30 shown here is by way of example. In other embodiments, the CDS 30 may be distributed among other devices of the control system and/or of the controlled apparatus. Alternatively, it may be consolidated in a single one of those device or in another element of the system (e.g., within change tracking system 16 or within a dedicated change detection system). Regardless, the components 30A-30D may be implemented in software executing on general purpose processors (embedded or otherwise) of their respective devices 10A, 10B, 11, 19; though, in other embodiments, they may be implemented on special-purpose hardware, instead or in addition, all in accord with the teachings hereof.

Operation of Illustrated CDS 30 is shown in FIG. 6. Consistent with the foregoing, this may be effected by software executing on a single one of the elements (e.g., component 30D executing on or in connection with CTS 16) or on multiples ones of those elements. In the illustrated embodiment, these element(s) execute steps discussed below and shown in the drawing. Other embodiments may eliminate some of these steps and/or execute other steps instead or in addition, all in accord with the teachings hereof.

In step 50, the CDS 30 detects that a change has been made in one of the configurable elements of the control system 5—and, specifically, that the configuration of that element varies from that reflected in the control model. Typically, this indicates that a change to the element has been made outside the Configurator (and Download Service). This may be, for example, a change to workstation 11, though, of potentially greater import, it may be a change to network segments 14a, controllers 10A, 10B and the other control devices (e.g., actuators 18, module 19, sensors 24, 26, and other field devices) and/or the apparatus controlled thereby—some or all of which may be remotely disposed (e.g., from the workstation 11) and, therefore, potentially subject to unsupervised or even surreptitious change.

Changes may be detected in any of several ways, depending on configuration of the network 14, the capabilities of the respective configurable elements, and so forth. This includes polling one or more of the elements (step 52), responding to change alert signalling initiated by the elements themselves (step 54) and/or comparing the element configurations (a) during downloads initiated by the Configurator or operator and/or when a device or other element is added to or sync's with the control system (step 56).

In step 52, the CDS 30 queries each of one or more of the configurable elements on an ad hoc, sporadic and/or period basis, e.g., hourly or daily to determine if the configuration of that element has changed since the time of the last download from the Configurator. The query can be made via network 14 or other communications mechanism (e.g., a separate wired or wireless channel) in accord with the protocol employed by that network and/or communications mechanism and by the element being queried. Other queries discussed in the text that follows may be made via similar mechanisms or otherwise.

In the illustrated embodiment, the query takes place in a few phases. In a first phase (step 52A), the CDS queries each element for preliminary data indicating that a change has or might have been made to the element's configuration. Such a preliminary query can be for the value of a change flag stored on the element, for an identifier (e.g., version number or timestamp) of the current configuration stored on that device, for a checksum of that configuration, and/or for some other information from which the CDS 30 can discern that a change may have been made outside the configurator (but not necessarily what the change is).

The CDS can then compare that data with information maintained in the modeling databases regarding the configuration last downloaded from the Configurator (e.g., by the Download Service). If the comparison suggests that the configurations match or, put another way, that no change has been made to the queried element since the time of the last download from the Configurator—the CDS treats that configurable element as unchanged and proceeds with polling (e.g., entering a wait state until the next scheduled polling of that element or querying the configurable element in the polling sequence).

On the other hand, if the information gained by the CDS 30 in the first query suggests that that a change has been made to the queried element since the time of the last download from the Configurator, the CDS can proceed with a second phase of the query. See step 52B. In this phase, the CDS 30 queries the configurable element for detailed data regarding the element's current configuration. In the illustrated embodiment, this includes all or a portion of the configuration stored on the element, along with any associated information maintained by the element about that configuration (e.g., download timestamp, download port, etc.)

While in some embodiments, the CDS compares that more detailed data with correspondingly more detailed information from maintained in the modeling databases regarding the configuration last downloaded from the Configurator to verify whether indeed a change has been made (and, if not, ignores or logs the results of the preliminary phase 52A and proceeds with polling as above), in other embodiments it readies that data for logging to the CTS along with the “inferred” information discussed below in connection with steps 62-76.

As those skilled in the art will appreciate, a multi-phase query of the type exemplified in steps 52A-52B has the advantage of reducing the “administrative” load placed on the CDS 30, the configurable elements and the network 14 during polling. Accordingly, in some embodiments, the CDS performs the query in more than two phases. Likewise, in some embodiments, the CDS delays the second phase until such times as the normal operational load on the configurable elements and/or the network 14 is reduced. Notwithstanding the advantages of a multi-phase query, in some embodiments, querying is accomplished in a single phase.

Alternatively or in addition to the polling discussed above, the CDS 30 can detect that a configurable element has been changed via alert signalling received directly from that element indicating that its configuration has (or is being) changed. See step 54A. In this regard, smart field devices and/or other configurable elements may be equipped with native (or other) functionality that causes them to generate alerts whenever changes are made to their configurations via on-board keypads, etc. and/or via self-generated configuration interfaces accessible by network 14 and/or segment 14a, wirelessly, or otherwise. Such alerts can be received by the CDS 30 from the configurable element via network 14 or other communications mechanism, as above. In some embodiments, these alerts can include timestamps reflecting the time that changes are made.

Upon receiving such an alert, the CDS 30 queries the element that generated it for detailed data regarding that element's current configuration. See step 54B. As with step 52B, in the illustrated embodiment, this includes all or a portion of the configuration stored on the element, along with any associated information maintained by the element about that configuration (e.g., download timestamp, download port, etc.)

As above, in some embodiments, the CDS compares that more detailed data with correspondingly more detailed information from the modeling databases regarding the configuration last downloaded from the Configurator to verify whether indeed a change has been made and, if so, readies that data for logging to the CTS along with the inferred information gained in steps 62-76, discussed below. (As above, if the comparison reveals that no change has been made, the CDS can ignore the alert or simply log it).

With continued reference to step 54, in some embodiments, the alert signalling referred to above need not come directly from the element that has been (or is being) changed. Rather, the CDS 30 can respond to an alert received from a first element of the control system (e.g., a field bus module or a controller) indicating that a second element of the system (e.g., a field device) has been or is being changed by querying that second element as discussed above in connection with step 54B and readying the more detailed data obtained from it for logging, as discussed above.

Alternatively or in addition to polling and/or responding to alerts signaled by a changed element, the CDS 30 can be alerted by the Configurator that a configurable element of the control system (a) has been changed other than through operation of the Configurator and/or the Download Service, and/or (b) has been newly added to and/or sync's with the control system. See step 56.

In this regard, the Configurator can utilize the Download Service, or related functionality, to upload all or a portion of the configuration stored on the configurable element, along with any associated information maintained by the element about that configuration (e.g., download timestamp, download port, etc.), and can compare that data with corresponding information in the modeling databases regarding the configuration last downloaded to that element. The Configurator can do this (a) when a Configurator editor for the element is invoked, (b) when the Download Service is invoked to download editor-made changes to that element, (c) when an element is newly coupled to the control system and/or attempts to sync with it, or at another time. If it detects differences, the Configurator can notify the CDS 30 and can supply to it data for logging to the CTS along with the inferred information gained in steps 62-76, discussed below.

Though step 56 is performed by the Configurator in some embodiments, in others one or more aspects of those steps are performed by the CDS 30—for example, on being alerted by the Configurator that it (the Configurator) is being invoked to edit one or more objects in the control model pertaining to a given element. Alternatively, or in addition, the Configurator can query such an element in phases, e.g., as discussed above in connection with steps 52A-52B, alerting the CDS 30 that the element has (or may have been changed) after either step of the query

In step 60, the CDS infers information about the change to a configurable element detected in steps 50-56. That change is often referred to below, simply, as the “change,” the “detected change,” or the like. As above, this may be done in any of several ways, depending configuration of the network 14, the capabilities of the respective configurable elements, and so forth. This includes determining the time of change (step 62), inferring the identify of the device responsible for the change (step 72), inferring the identity of the person responsible for the change (step 74), and/or inferring the reason(s) for the change (step 76), e.g., based on queries to the changed device, the control system, enterprise databases and the like (steps 64-70). The inferences—and the queries upon which they are based—in connection with the illustrated embodiment are discussed below; other embodiments may make other inferences, instead or in addition, and may base them on other queries, instead or in addition.

In step 62, the CDS 30 responds to detection of a change to a configurable element by determining and/or inferring the time of the change. Specifics of the determination or inference vary with in accord with the manner of detection, the type of the configurable elements, and so forth.

Thus, for example, in the case of changes that are expected to be detected in real-time, e.g., changes detected in step 54 via alert signalling received directly from the changed element, the CDS 30 takes the time of alert as an estimate of the time of change. See step 62A. In instances where the CDS queries the CDS for more detailed data, e.g., as in step 54B, a timestamp or other information returned by the query can further inform the estimate of the time of change.

By way of further example, in the case of changes that are determined by polling, e.g., changes detected in step 52, the CDS estimates as the time of change (or, perhaps, more accurately, the period of change) the time interval since the configurable element was last updated by the Configurator (or Download Service) or since the last polling, whichever is later. Again, in instances where the CDS queries the CDS for more detailed data, e.g., as in step 52B, a timestamp or other information returned by the query can further inform the estimate of the time of change.

By way of still further example, in the case of changes to a configurable element that are detected by the Configurator, e.g., in step 56, the CDS estimates as the period of change the time interval since the configurable element was last updated by the Configurator (or Download Service). Again, in instances where the CDS queries the CDS for more detailed data, e.g., as in step 56, a timestamp or other information returned by the query can further inform the estimate of the time of change.

By way of still further example, the time of change may be indicated in an alert generated by a changed element or by another element of the control system. In such cases, the time of change can be determined directly from the alert.

In step 64, the CDS 30 queries the element whose configuration has been changed to discern the identity of workstation, personal computer, portable computer, PDA or other device that made the change. The CDS can also query the changed element for the identity of the person responsible for the change, as well as the reason(s) for the change, though such information would not typically expected to be stored in the changed elements (particularly, for example, if it is a controller or field device). Regardless, the querying of step 64 can be in connection with a more detailed data query, e.g., as of the type discussed above in connection with step 54B, and/or it can be a separate query from the CDS to that element.

In step 66, the CDS 30 queries the network 14 (and, more generally, the control system) for a “live list” of active devices on the local control network from which the identity of the person/device responsible for the change may be inferred. If the change is estimated (e.g., in step 62) to have recently occurred, the query is for currently or recently active devices. If the change occurred earlier, the CDS queries the control system for devices active around the estimated time of the change, e.g., as determined in step 62.

The query of step 66 is directed to net log lists, IP address tables and other indicia of devices (such as workstations, personal computers, portable computers and PDAs, to name a few examples) communicatively coupled to network 14 and, more particularly, to a network segment (e.g., 14B) on which the changed element resides. Depending on the configuration of network 14 and/or control system 5, the CDS directs these queries to intrusion detection apparatus, routers, switches, gateways and or other elements (not shown) of the network 14 that are responsible authorizing elements on the network, granting them identities (e.g., IP addresses) and/or otherwise permitted them to communicate with (and, more particularly, for example, to configure) to effect the detected change.

In step 68, the CDS 30 likewise queries the network 14 (and, more generally, the control system) for a list of “live” (or active) users on the local control network, also for purposes of inferring the identity of the person/device responsible for the change. As above, if the change is estimated (e.g., in step 62) to have recently occurred, the query is for currently or recently active users. If the change occurred earlier, the CDS queries the control system queries for users active around the estimated time of the change.

The query of step 68 is directed to user lists, process lists, and other indicia of users logged into network 14 and, more particularly, to a network segment (e.g., 14B) on which the changed element resides. Depending on the configuration of network 14 and/or control system 5, the CDS directs these queries to workstations and/or other elements (not shown) of the network 14 into which users may log for access, e.g., to the changed element.

In step 70, the CDS 30 queries control and “enterprise” databases for information from which can be discerned the actual or possible identity of the person responsible for the change and/or the actual or possible reasons for the change. The queried databases includes asset management, employment, IT or other databases and/or other stores of information about the control system, the devices and/or the people with potential access to it and/or responsible for changing it, along with maintenance schedules, etc. These may be databases and stores of the type discussed above in connection with elements 34A-34E and/or they may be other databases and stores that are directly or indirectly coupled to the control system and, more particularly, to CDS 30, e.g., via network 14 or otherwise.

The query of step 70 can be directed to, by way of non-limiting example, employee lists (including recent hire lists and recent termination lists) that include user names, vacation/sick/time-off lists, punch-card data or other time-in and time-out information, areas of technical responsibility, areas of responsibility of physical plan, plant and network access privileges, and so forth, along with maintenance schedules, repair logs, repair requests, and so forth.

In step 72, the CDS discerns the identity of the device responsible for the change, if not evident, e.g., from the query performed in step 64. By way of example, the CDS 30 winnows down the live list to identify workstations, personal computers, portable computers, PDAs and other devices on which a logged-in user might effect the change. By way of example, the CDS 30 can further winnow down the list to identify (a) devices from which a change is expected to be made (e.g., a plant floor-based workstation, and/or (b) unexpected devices from which a surreptitious change might be made (e.g., an unregistered portable computer or PDA).

By way of still further example, the CDS can winnow down the list of live devices by reconciling them against information gained in step 70 regarding the capabilities of those devices. This may lead to an indication of a likely device or devices, e.g., where the CDS determines that only one of the active devices on the same network segment (e.g., 14A) as the changed element is likely capable of effecting the change—such as may be the inference where the list of live devices on that segment includes a singe user-controllable device, such as PDA 40 or a portable computer, along with one or more controllers or field devices (which, as a general matter, are less amenable to direct user control).

Following winnowing, the CDS can query the likely device(s) for additional information from which an inference of responsibility may be drawn. This includes, by way of non-limiting example, user lists, process lists, and other indicia of users who used the device at or around the time of the change, network connectivity lists and other indicia of networks, etc., to which the device was coupled at about that time, and so forth.

In some embodiments of the invention, apart from the Configurator, only authorized devices may be used to configure the configurable elements (or at least selected ones of the configurable elements, e.g., those deemed mission critical). One such device here, a PDA (by way of non-limiting example) that is coupled to controller 10A—is illustrated in FIG. 2, by way of non-limiting example. In addition to incorporating security codes that are required to make changes to those elements, such a device 40 can execute software that queries the user in connection with each change he/she makes with the device, e.g., with a pop-up dialog box, or otherwise, for his/her identity and the reason(s) for the change. Alternatively or in addition, such software can execute on the device 40, e.g., as a proxy for the CDS 40, and can query memory locations or otherwise to provide information required of the query of step 72.

In step 74, the CDS discerns the identity of the person responsible for the change. By way of example, the CDS 30 winnows down the live list to identify users with sufficient access and permissions to effect the signaled change, e.g., as determined from information gained in step 70. It can also use that information to winnow down the list to identify (a) users who are expected to make changes (e.g., field engineers), and/or (b) users who are not expected to make changes and whose log-ins might suggest surreptitious activity.

Combining the operations in steps 72 and 74, the CDS can infer a likely user (or users), e.g., as where the CDS determines that of plural devices active on the network at the time of the change, one was in use at that time by a logged-in user whose technical areas of responsibility included apparatus in the nature of the changed element and/or whose physical plant responsibilities include that element and/or who was scheduled to perform maintenance on that or nearby element.

The CDS can make other use of information from the enterprise or control databases in winnowing down the live list of users. By way of further example, it can access a maintenance database to discern which of the users on the live list were expected to make a detected configuration change. Alternatively or in addition, it can access personnel databases to identify users that were scheduled to have been on vacation at the time the change was made.

In step 76, the CDS discerns the reason (or possible reasons) for the change. To this end, the CDS 30 matches information gained in step 70 with information gained in steps 62 (and possibly steps 72 and 74) to identify maintenance requests, error logs or other indicia of reasons for a change. Thus, for example, if the configuration of an actuator 18 is changed (other than through action of the Configurator) following successive maintenance log entries suggesting faulty operation, the CDS 30 may infer that the reason for change was to replace (or repair) the faulty unit. The CDS 30 may corroborate the inferences with other information from the database and/or from the live user and live device logs, e.g., as where the field technician with responsibility for maintenance of the relevant portion of the plant was on duty and logged-in at the time of the apparent maintenance action.

As noted above, the inferences made in the illustrated embodiment and discussed above in connection with steps 62 and 72-76, are by way of example. Other embodiments may make other inferences instead or in addition to those discussed here, e.g., based on broken connections, incomplete processes, non-logged users, etc. Moreover, the aforementioned inferences may be based on queries other than, or in addition to, those discussed in steps 64-70. Thus, by way of example, the CDS can query one or more users whom it infers may have made the change, e.g., by way of a text message-based query, email-based query, pop-up dialog box or otherwise to ask his/her identity, their location at or around the time of the change, and/or for the reason for the change. Still, further, the “reason” inferred, e.g., in step 76, may comprise a multiple possible reasons—e.g., in instances where the change can be attributed to several possible causes (mutually exclusive or otherwise).

Regardless, in step 80, the CDS transmits the inference(s) to the CTS along with the other data discussed above in connection with steps 52, 54, and 56. As above, these transfers to the CTS can be via RPC calls, via calls to functions the CTS exposes in an applications program interface (API), or otherwise. In the illustrated embodiment, the transfers to the CTS are effected by XML files.

Described above are apparatus, systems and methods meeting the aforementioned objects, among others. It will be appreciated that the embodiments described herein are merely examples of the invention and that other embodiments, making changes to that shown herein, are within the scope of the invention. Thus, by way of non-limiting example, it will be appreciated that one or more of steps 62 and 76 may be executed by the CTS and/or other elements of the control system. Along these lines, for example, the CDS 30 may transfer the live lists of users and/or devices to the CTS which, itself, may execute one or more of the operations discussed above in connection with steps 72-76, by way of non-limiting example. In view of the foregoing, what we claim is:

Claims

1. A system for process, environmental, manufacturing or industrial control, comprising: one or more configurable elements that are coupled to a control network,a device that is coupled to the control network and that is capable of effecting a change to one or more of the configurable elements,a change tracking system that records changes to the one or more configurable elements, anda change detection system that is in communications coupling with the one or more configurable elements and with the change tracking system, the change detection system responding to detected changes in one or more of those elements by inferring at least one of an identity of a person, a device, and combination thereof that is responsible for a change, the time of the change, and/or the reason for the change.

2. The control system of claim 1, wherein the change detection system infers-the identity of the person responsible for a change from information resident on the device and/or supplied by the device that made the change.

3. The control system of claim 2, wherein the device that made the change executes software that identifies the user who was operating that device at the time of the change.

4. The control system of claim 3, wherein the software queries the user for identifying information prior to making the change.

5. A system for process, environmental, manufacturing or industrial control, comprising: one or more configurable elements,a change tracking system that records changes to the one or more configurable elements, anda change detection system that is in communications coupling with the one or more configurable elements and with the change tracking system, the change detection system responding to detected changes in one or more of those elements by inferring at least one of an identity of a person, a device, and a combination thereof that is responsible for a change, the time of the change, and/or the reason for the change, wherein the change detection system responds to a change alert signaling indicating that the configuration of a configurable element has been changed by querying a control network to which that element is coupled for a list of users that are logged-in or active on the network.

6. The control system of claim 5, wherein the change detection system infers the identity of a person responsible for a change from a list of live users on a control network to which one or more of the configurable elements are coupled.

7. The control system of claim 6, wherein live users are users that are any of logged-in or active on the control network at the time a change is made.

8. The control system of claim 5, wherein the change detection system winnows down the list of live users to identify users with sufficient access and permissions to effect the signaled change.

9. The control system of claim 8, wherein the change detection system further winnows-the list to identify one or more of (i) users who are expected to make a change to the one or more configurable elements, and (ii) users who are not expected to make such changes.

10. The control system of claim 5, wherein the change detection system queries any of an asset management, employment, information technology, or other database, or a store to identify any of users and/or devices with potential access to the control network.

11. The control system of claim 5, wherein the change detection system infers-the identity of a person responsible for the change from information resident on and/or supplied by the device that made the change.

12. The control system of claim 11, wherein the device that made the change executes software that identifies the user who was operating that device at the time of the change.

13. The control system of claim 12, wherein that software queries the user for identifying information prior to making the change.

14. A method for process, environmental, manufacturing or industrial control, the method comprising: effecting a configuration change in one or more elements of a control system,detecting the change,with a change detection system, inferring at least one of an identity of a person, a device, and a combination thereof that is responsible for a change, the time of the change, and/or the reason for the change, andwith the change detection system, responding to a change alert signaling indicating that the configuration of a configurable element has been changed by querying a control network to which that element is coupled for a list of users that are any of logged-in or active on that network.

15. The method of claim 14, wherein the change detection system executes the step of inferring the identity of a person responsible for a change from a list of live users on a control network to which one or more of the configurable elements are coupled.

16. The method of claim 15, wherein live users are users that are any of logged-in or active on the control network at the time a change is made.

17. The method of claim 14, wherein the change detection system executes the step of winnowing down the list to identify users with sufficient access and permissions to effect the signaled change.

18. The method of claim 17, wherein the change detection system executes the step of further winnowing-the list to identify one or more of (i) users who are expected to make a change to the one or more configurable elements, and (ii) users who are not expected to make such changes.

19. The method of claim 14, wherein the change detection system executes the step of querying any of an asset management, employment, information technology, or other database, or a store to identify any of users and/or devices with potential access to the control network.

20. The method of claim 14, wherein the change detection system executes the step of inferring the identity of a person responsible for the change from information resident on and/or supplied by the device that made the change.

21. The method of claim 20, comprising executing, on the device that made the change, software that identifies the user who was operating that device at the time of the change.