Thread Content
Implementation and analysis of redundancy technology in DCS systems. High reliability is the primary requirement for process control systems. Redundancy technology is a technique commonly used in the reliable design of computer systems, and it is one of the most effective methods for improving the reliability of such systems. To achieve a balance between high reliability and low failure rates, we typically employ redundancy techniques in the design and application of control systems. A proper redundancy design will **improve the reliability of the system, but it also increases the complexity of the system and the difficulty of its design. Systems that utilize redundancy configurations also result in higher costs for users. Therefore, how to carry out redundant design for control systems in a rational and effective manner is a topic worthy of research. 1: Redundancy technology. Overview of redundancy technology: Redundancy technology involves adding additional devices to ensure that the system operates in a more reliable and secure manner. There are various methods for classifying redundancy. Based on their location within the system, redundancy can be divided into component-level, subassembly-level, and system-level ； Based on the degree of redundancy, it can be classified into various types such as 1:1 redundancy, 1:2 redundancy, and 1:n redundancy. With the continuous improvement in the reliability of components today, 1:1 component-level thermal redundancy represents an effective, relatively simple, and flexibly configurable method of implementing redundancy, as seen in techniques such as I/O card redundancy, power supply redundancy, and main controller redundancy. Therefore, this approach is currently adopted in most mainstream process control systems both domestically and internationally. Of course, there are also successful examples in certain specific designs that employ component-level or multiple redundancy approaches in combination. Purpose of redundant design in control systems: To ensure that system operation is not affected by localized failures, to prevent maintenance of faulty components from impacting the overall functionality of the system, and to enable online maintenance so that faulty components can be repaired promptly. Redundant design increases the complexity of system design, and redundant configurations raise the investment required for user systems. However, this investment yields reliability for the system, as it increases the average time between failures (MTBF) of the entire user system and reduces the average time to repair failures (MTTR). Therefore, redundancy is essential in control systems used in critical applications. A parallel system composed of two components (which provide redundancy for each other) has an average time between failures that is 1.5 times that of a single-component system. The availability metrics of a system can be simply described by two parameters: the Mean Time Between Failures (MTBF) and the Mean Time to Repair (MTTR). The availability of a system can be expressed by the following formula: System availability = MTBF/(MTBF+MTBR). When the availability reaches 99.999%, the system is down for only 6 minutes per year. 2: Key technologies for control system redundancy. Redundancy is an advanced reliability design technique; 1:1 thermal redundancy, also known as dualization, is one effective form of redundancy. However, it does not involve the simple parallel operation of two components – rather, it requires the coordinated operation of hardware, software, and communication systems to function properly. To form an integrated whole out of two components that serve as redundancies for each other, several technical aspects are typically involved: 1) Information synchronization technology. This is a prerequisite for achieving a seamless transition between the active and backup components. Only through high-speed and efficient information synchronization, in line with the requirements regarding control latency, can it be ensured that the active and backup components operate in sync, thereby enabling a seamless switch between the redundant components. In the hot standby mode, one of the cards is in operational status (the active card), which handles functions such as data acquisition, computation, control output, and network communication for the system ； The other one is in standby mode (backup card), and it continuously monitors the internal control status of the active card (i.e., status synchronization). The positive/negative logic between the active/standby card units is mutually exclusive; that is, if one is the active card, the other must be the standby card ； Moreover, there are redundant control circuits (also known as active/standby control circuits) and communication circuits between them to coordinate the simultaneous and orderly operation of the two cards, ensuring consistency in their input/output characteristics; in other words, from the user’s perspective, it can be considered as if there is only one component. In general, in design, the operational status of the active and backup components is monitored, and their control states are synchronized (such as configuration information, output valve positions, control parameters, etc.) through high-speed redundant communication channels (serial or parallel). 2) Fault detection technology: To ensure that the redundant components come online promptly in the event of a fault, high-precision online fault detection technology is necessary to enable fault detection, fault location, fault isolation, and fault alerting. Fault detection includes the power supply, microprocessor, data communication links, data buses, and I/O status, etc. Fault diagnosis includes self-diagnosis of faults and mutual inspection of faults (inspection between the active and backup components). 3) Fault arbitration and switching technologies: After a fault is detected accurately and promptly, it is necessary to identify its location and assess its severity. Relying on the redundant control circuits mentioned earlier, the active and backup states are analyzed, compared, and arbitrated to determine whether a switch between these states is required. The switch of control rights to the redundant backup component must also be fast, safe, and disturbance-free. When a working component fails (power loss, reset, software error, hardware failure, etc.) or when the failure of the working component is more severe than that of the spare component, the spare component must quickly and without disruption take over all control tasks of the working component, so as not to cause any impact on on-site control. At the same time, it is required that the switching time be in the order of milliseconds, or even microseconds, so as to prevent loss of control over external control objects or invalidation of detection information due to failures in such components. Additionally, it is necessary to issue alerts as soon as possible through network communication or on-site LED displays, informing users of the faulty component and the nature of the fault so that timely maintenance can be carried out. 4) Hot-swapping technology: To ensure high reliability in fault-tolerant systems, it is necessary to minimize the system’s average time to repair, MTBR. To achieve this, the design should strive to enhance the independence, repairability, and fault maintainability of the units. Enabling online maintenance and replacement of faulty components is also an important part of redundancy technology; it is key to developing techniques for the rapid repair of faulty components in control systems. The hot-swapping capability of components allows for the addition or replacement of parts without disrupting the system’s normal operational functions, ensuring smooth system operation. 5) Fault isolation technology: When designing for redundancy, it is necessary to ensure that faults in the working and backup components affect each other as little as possible, or that the probability of such interference is very low (0.01%), in which case the faults can be considered isolated. This ensures that if a component in standby mode fails, it will not affect the normal operation of the redundant working components or other related components, thus maintaining the effectiveness of redundancy. 3: Analysis of the implementation of redundancy techniques in control systems. Through a detailed analysis of the principles and methods related to system redundancy, it can be seen that the availability of a system depends to a large extent on those components with low MTBF values that can have a significant impact on the proper operation of the system, such as main control cards, networks, power supplies, and communication forwarding cards. Implementing redundant design for critical components in system design can **improve the system’s availability. The following uses the SUPCON JX-300X as an example to analyze the implementation of redundancy. The redundancy of various components in the SUPCON JX-300X distributed control system is achieved, covering redundancy from the power supply, main controller, process control network, to the I/O cards. The JX-300X DCS features a fully intelligent and digital design, which enables the implementation of various technologies mentioned earlier, such as hot-swapping of cards, fault diagnosis, and information synchronization. The system adopts a three-layer model of typical control systems; each layer can be configured with redundancy, while there is full redundancy in the connections between layers. In other words, within the entire system, the redundant process control network (SCnet) and the redundant field I/O bus (SBUS) serve as highly reliable connection channels; the operation of various components within the system, as well as the point-to-point connections between them, can all be made redundant. Depending on the different functional roles of the various components within the control system, specific approaches are adopted. The specific strategies are as follows: 1) Redundancy of the main control card. The main control card serves as the core control unit of the entire system, responsible for carrying out the control tasks of the system. And all the key design aspects of redundancy technology are fully applied here. The software and hardware of the two redundant main control cards are identical; they run the same system software and applications. Under the control of the active/standby redundancy logic circuit, one of them operates in the active state (active card), while the other operates in the standby state (standby card), as shown in Figure 2. The working card and the backup card share a common redundant logic control circuit as well as dedicated high-speed peer-to-peer redundant communication channels; in addition, information exchange or fault diagnosis can also be carried out through the I/O bus and the process control network. The redundant main control cards can all access the I/O and process control networks. In standby mode, the main control card executes diagnostic programs to monitor the status of the working cards; it periodically queries the data memory in these working cards to receive real-time control operation information sent by them. The backup processor can save the latest control data at any time to ensure a seamless switch between operational and backup modes, but the main control card in operational mode plays a decisive role in controlling operations, generating outputs, and disseminating real-time process information (it has final say). The key to redundancy technology lies in achieving information synchronization, and the ultimate goal of this synchronization is to enable seamless switching between redundant components. We divide the methods of information synchronization into “natural synchronization” and “forced synchronization”. The two main control cards, which serve as a redundancy pair, exchange information with the outside world as a single unit (through network communication and I/O communication), and share the input information that reaches this unit; this is what is known as the identity of redundant components (it can also be referred to as unity). When transmitting information externally, the work card holds the initiative and speaks on behalf of the entire entity, which represents redundant coordination. Put simply, two components that are redundant with each other can be regarded as a single unit for user operation and external control. To ensure that the two redundant cards have equal access to external information (I/O communication, network communication), the redundant components are equipped with identical communication interfaces, thereby guaranteeing consistency in the input information within the cards. The two redundant card modules have their own communication paths; as long as the same input information is transmitted simultaneously through both communication paths, the two modules can obtain identical information. This synchronization of input information through external devices is called “natural synchronization”. “\"Natural synchronization\" occurs between redundant systems and external devices. The working card takes the initiative, speaks on behalf of the whole, and transmits various status information to the backup card through redundant communication in order to achieve synchronization of control tasks; this is known as \"forced synchronization\". “\"Forced synchronization\" ensures that the internal control state of a backup card remains consistent with that of the active card through redundant communication, and it occurs between cards that serve as redundancies for each other. Depending on the characteristics of the variables, different synchronization methods are employed; 2) Power supply system redundancy. The power supply is the source of energy that enables the entire control system to function properly; once a fault occurs in the power supply unit, it often leads to the disruption of the operation of the entire control system, with serious consequences. To ensure that the control system can operate safely, reliably, over the long term, and stably, a stable power supply must first be guaranteed. The JX-300X DCS features hot-swappable redundant power supplies; during normal operation, the two supplies each deliver half of the total power, allowing each supply to operate under light load conditions, which facilitates stable operation of the power supplies. When one of them fails, the other takes over its functions temporarily and triggers an alarm. It is designed with redundant power supplies that are hot-swappable, allowing faulty power supplies to be replaced during system maintenance without disrupting its normal operation. 3) Network system redundancy. Use redundant network cards and redundant network interfaces. During normal operation, the two redundant high-speed data paths operate in parallel, automatically distributing network traffic. The redundant design for load balancing enhances the system’s network communication bandwidth. When one path fails (such as a damaged network card or a wiring issue), the other path automatically takes on all the communication load, ensuring uninterrupted communication. 4) Cooling system redundancy. By utilizing redundant fans that can switch automatically within the control cabinet, real-time monitoring of both the fan speed and the temperature inside the cabinet is possible. An alarm is triggered automatically in case a working fan fails or the temperature inside the cabinet becomes too high, and the backup fan is activated automatically. 5) Information redundancy. In addition to hardware redundancy, the JX-300X DCS also employs information redundancy technology, which is another important means of improving system reliability. Information redundancy technology refers to the use of additional redundant bits during communication or when storing configuration information (important data) to provide the capability for error detection and even error correction. In this system, both the SBUS bus communication and the SCnet control network use the Cyclic Redundancy Code verification method. Important configuration information (such as system settings) is stored on the main control card with 1:1 redundancy, enabling these critical data to recover automatically in the event of a failure, thereby ensuring their security during system operation. Through the redundant design of these key components, the system can maintain a high level of availability.