Process Engineering Division – Instrumentation and Automation Section – Daily Question – Question from 2020-10-27

1. The dual-redundancy ESD system features a dual configuration for everything from the I/O modules to the CPU and communication modules. One set is in operation, while the other is in hot standby mode. 2. Each component of the triple-redundancy voting system is independent, yet all three components have identical functions. The output signal from the triple-redundancy circuit passes through a 2-of-3 voting chip before becoming the system output. When a fault occurs in one of the three circuits and an error signal is generated, this error signal is suppressed after a 2-of-3 voting process, and the system still outputs the correct signal (voltage, current, or switch state). The system will not affect the process due to internal failures. 3. The two systems of the quadruple diagnostic system, which evolved from the dual diagnostic system, are not a simple redundant setup where one operates while the other serves as a backup; rather, they operate simultaneously. Not only are their inputs completely independent, but their outputs are also connected in parallel, representing true dualization.

The dualization diagnostic system in the SIS system is similar to a 1oo1D two-channel system; this architecture uses a single controller channel with diagnostic capabilities, along with a second diagnostic channel that forms an output circuit through a serial connection. The 1oo1D structure consists of a single logical calculator and an external monitoring clock, with the output of the timer connected in series with the output of the logical calculator. In more advanced systems, built-in diagnostics control an independent series output; when a failure is detected, it forces the system to go into a disconnected state. The diagnostic function converts a detected dangerous failure into a safe failure. The 1oo2D structure contains two independent circuit channels. The output circuit can use different types of dual switches. For example, the solid-state switch provides a conventional controller output, while another relay is controlled by internal diagnostics and provides a second normally open contact switch. If a potential dangerous failure is detected in the output circuit, the relay contacts will open, cutting off power to the output circuit and ensuring that the actuator remains in a safe state. A dual-circuit channel can utilize different types of contacts to achieve a 1oo1D configuration, such as two normally open contacts, or one normally open contact combined with one normally closed contact. The suffix “D” indicates that the system possesses more extensive and detailed self-diagnosis capabilities in each channel. The second shutdown path involves this self-diagnosis system using an advanced \"reference-based\" method for system diagnosis. A triple voting system is similar to a 2oo3 three-channel system. In applications where failure modes must be completely avoided in control systems, a two-out-of-three system represents the most reliable option. When it is necessary to prevent the occurrence of two failure modes, the structure of the system becomes very complex. A structural design that can tolerate both \"safe\" failures and \"dangerous\" failures is a two-out-of-three structure (two of the three units select the same result to be used for the safety function). This structure with three controller units provides a system that offers both security and high availability. This type of system is called a TMR (Triple Modular Redundancy) system. The output channel of each controller unit has two output points. Connect the two output points of each of the three controllers to form a \"voting\" circuit, using the result of this voting to determine the actual output signal. The output result depends on the opinion of the “majority”. When two output points in a circuit are connected, the output load will be activated. When two output points in a circuit are disconnected, the output load will be powered off. The quadriplex diagnostic system that evolved from the dualistic diagnostic system is something like the 2oo4D quadriplex system. To enable the system to downgrade to a 1oo2D configuration and continue operating in case of problems, some manufacturers offer a system solution known as quadrupling, sometimes referred to as QMR (Quadruple Module Redundancy). In a quadrupled system, the actual system architecture is derived from a structure based on dual input and output; the term \"quadrupled\" means that the system consists of four processors (two on each \"leg\”). This structure ensures that even if one leg of the system stops working due to an error or replacement, the entire system remains intact. Compared to 1oo2D or 2oo3 systems, it seems that 2oo4D systems may be safer and more reliable; in fact, when they are in operation, the level of availability and safety integrity provided by these systems is the same. Unlike hardware, software can never be downgraded. Therefore, when using software to test hardware, errors can always be detected before they occur. The QMR safety system uses software for self-testing and self-diagnosis, from the field to the processor. This makes the QMR safety system more reliable than any other system that does not use self-testing and self-diagnosis, including 2oo3 or 2oo4 systems. In addition to having internal self-testing and self-diagnosis capabilities, the QMR system also has the ability to test and diagnose field circuits. For both input and output, the system has loop monitoring functionality. An alarm is generated once a short circuit or an open circuit is detected in the circuit. This automatic detection and diagnosis method reduces the costs of maintaining and testing the entire system. The QMR with diagnostic system has the capability to handle multiple failures, as it can detect and isolate failures anywhere in the system. As long as the failures do not originate from the same part of the system, it can maintain the ability to retain all safety functions even when multiple failures occur. By integrating 2oo4D diagnostic techniques, the system gains the ability to detect and isolate failures, even those that have not yet resulted in any malfunctions. The QMR security system is the first, and currently the only one, to use a true dual-fault tolerance architecture. It is the only safety system that can maintain the system’s ability to perform safety functions at the SIL3 level even when both processors fail. The QMR system can operate seamlessly as a single-channel safety system at an integrity level of SIL3. It is very easy to replace the failed modules in the QMR security system; this can be done online, without the need for hot standby or intermediate modules, and it does not affect the operation of the security devices. Since the two channels operate independently, it is possible to use one channel without reducing the safety features of the entire system. Additionally, the complete program can be downloaded online without affecting the process or reducing the security integrity of the system. Before switching to a new application, the system performs a check and copies the values to ensure seamless and proper operation.

1. The dual-redundancy ESD system features a dual configuration for everything from the I/O modules to the CPU and communication modules. One set is in operation, while the other is in hot standby mode. 2. Each component of the triple-redundancy voting system is independent, yet all three components have identical functions. The output signal from the triple-redundancy circuit passes through a 2-of-3 voting chip before becoming the system output. When a fault occurs in one of the three circuits and an error signal is generated, this error signal is suppressed after a 2-of-3 voting process, and the system still outputs the correct signal (voltage, current, or switch state). The system will not affect the process due to internal failures. 3. The two systems of the quadruple diagnostic system, which evolved from the dual diagnostic system, are not a simple redundant setup where one operates while the other serves as a backup; rather, they operate simultaneously. Not only are their inputs completely independent, but their outputs are also connected in parallel, representing true dualization.

1. The dual-redundancy ESD system features a dual configuration for everything from the I/O modules to the CPU and communication modules. One set is in operation, while the other is in hot standby mode. 2. Each component of the triple-redundancy voting system is independent, yet all three components have identical functions. The output signal from the triple-redundancy circuit passes through a 2-of-3 voting chip before becoming the system output. When a fault occurs in one of the three circuits and an error signal is generated, this error signal is suppressed after a 2-of-3 voting process, and the system still outputs the correct signal (voltage, current, or switch state). The system will not affect the process due to internal failures. 3. The two systems of the quadruple diagnostic system, which evolved from the dual diagnostic system, are not a simple redundant setup where one operates while the other serves as a backup; rather, they operate simultaneously. Not only are their inputs completely independent, but their outputs are also connected in parallel, representing true dualization.

The two systems of the quadruple diagnostic system, which evolved from the dual diagnostic system, are not a simple redundant setup where one serves as a backup to the other; rather, they operate simultaneously. Not only are their inputs completely independent, but their outputs are also connected in parallel, representing a true dual configuration.

Redundant settings and diagnostics are meaningful only when they take into account both security and availability.

This post was last edited by h20090630 on 2020-10-27 at 19:59. The dualization diagnostic system in the SIS system is a two-channel system; this architecture utilizes a single controller channel with diagnostic capabilities, along with a second diagnostic channel that forms an output circuit through a serial connection. 1. The dual-redundancy ESD system features a dual configuration for everything from the I/O modules to the CPU and communication modules. One set is in operation, while the other is in hot standby mode. 2. Each component of the triple-redundancy voting system is independent, yet all three components have identical functions. The output signal from the triple-redundancy circuit passes through a 2-of-3 voting chip before becoming the system output. When a fault occurs in one of the three circuits and an error signal is generated, this error signal is suppressed after a 2-of-3 voting process, and the system still outputs the correct signal (voltage, current, or switch state). The system will not affect the process due to internal failures. 3. The two systems of the quadruple diagnostic system, which evolved from the dual diagnostic system, are not a simple redundant setup where one operates while the other serves as a backup; rather, they operate simultaneously. Not only are their inputs completely independent, but their outputs are also connected in parallel, representing true dualization.

1. The dual-redundancy ESD system features a dual configuration for everything from the I/O modules to the CPU and communication modules. One set is in operation, while the other is in hot standby mode. 2. Each component of the triple-redundancy voting system is independent, yet all three components have identical functions. The output signal from the triple-redundancy circuit passes through a 2-of-3 voting chip before becoming the system output. When a fault occurs in one of the three circuits and an error signal is generated, this error signal is suppressed after a 2-of-3 voting process, and the system still outputs the correct signal (voltage, current, or switch state). The system will not affect the process due to internal failures. 3. The two systems of the quadruple diagnostic system, which evolved from the dual diagnostic system, are not a simple redundant setup where one operates while the other serves as a backup; rather, they operate simultaneously. Not only are their inputs completely independent, but their outputs are also connected in parallel, representing true dualization.

Redundant settings and diagnostics are meaningful only when they take into account both security and availability.