Dual Redundant Process Controller Synchronization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current process control systems face challenges in achieving high reliability and seamless redundancy, particularly in maintaining synchronization between dual modules, which can lead to errors and increased complexity, especially in critical industrial environments.
Innovation Solution
A dual redundant process controller is implemented, where two processor modules execute the same control application, with synchronization mechanisms using message-based synchronization and cyclic redundancy checks (CRCs) to ensure timely and accurate data transmission, and dynamic clock adjustment to reduce clock skew, allowing for seamless role swapping in case of failures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If triple modular redundancy (TMR) with voting is used, then reliability is improved, but device complexity increases due to tripling hardware components and customized voting at endpoints
Solution Approach 1:
The patent uses dual copying of control modules where each module maintains a complete copy of the control application and state information. This allows redundancy without requiring triple modular redundancy, reducing hardware complexity while maintaining reliability through pairwise comparison and synchronization between the two control modules.
Solution Approach 2:
The patent extracts the voting function from the hardware level and implements it at the software level through state comparison and synchronization protocols. This removes the need for dedicated voting hardware and customized endpoint voting logic, simplifying the overall system architecture while preserving the reliability benefits of redundancy.
2Ease of operation
If hot swap methods are used, then ease of operation is improved, but reliability deteriorates due to erroneous values being applied to the process during fault detection and module switching
Solution Approach 1:
The patent implements preliminary synchronization where the standby control module continuously receives and processes synchronized state information from the active module before any fault occurs. This ensures that when a switch is needed, the standby module is already prepared with valid state information, eliminating the erroneous values problem that plagues traditional hot swap methods.
Solution Approach 2:
The patent uses continuous feedback through state synchronization protocols where each control module monitors and compares its state with the other module. This feedback mechanism ensures that both modules remain synchronized and valid, allowing seamless switching without introducing erroneous values to the process control.
3Reliability
If dual-active approach with dedicated hardware synchronization is used, then reliability is improved, but device complexity increases due to dedicated hardware for synchronization, clock synchronization, and message content comparison
Solution Approach 1:
The patent replaces dedicated hardware synchronization mechanisms with software-based synchronization protocols running on generic processors. The state synchronization is achieved through message passing and comparison logic implemented in software, eliminating the need for specialized hardware components while maintaining synchronization accuracy.
Solution Approach 2:
The patent makes generic processor components perform multiple functions including control execution, state synchronization, clock management, and error detection. This multi-functionality approach eliminates the need for dedicated hardware components for each function, reducing overall device complexity while preserving reliability through software-based verification.
Data Source
AI summary
A dual redundant process controller is provided. The controller comprises a process control application that executes on a first and a second module. When executed by the first module, a first application instance writes a first synchronization information to the second module, reads a second synchronization information from the first module, and, when the second disagrees with the first synchronization information after passage of a time-out interval, performs a resynchronization function; and wherein, when executed by the second module, the second application instance writes the second synchronization information to the first module, reads the first synchronization information from the second module, and, when the first disagrees with the second synchronization information after passage of the time-out interval, performs the resynchronization function. The first application instance calls the synchronization function provided by the multitasking real-time operating system before invoking a set events function provided by a multitasking real-time operating system.