Redundant Fail-Safe Subsystem Sync Buffering Against Error Propagation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In redundant automation systems, faulty synchronization data can be transmitted from a failing first fail-safe subsystem to a second subsystem, leading to both subsystems deactivating and resulting in loss of system control, as the second subsystem processes incorrect data.
Innovation Solution
The second subsystem buffers synchronization data and only processes it after an error-free acknowledgement from the first subsystem, ensuring that only accurate data is used for control, and in case of failure, it switches to standalone operation using a stored program state, reducing response times and preventing error propagation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the first fail-safe subsystem transmits synchronization data to the second subsystem, then the second subsystem can maintain synchronized operation, but faulty data may be transmitted causing both subsystems to deactivate
Solution Approach 1:
The second subsystem buffers synchronization data before processing it. This preliminary buffering action allows the system to hold data in a pending state, preventing faulty data from immediately affecting system operation. The buffered data is only processed after verification of error-free status, thus eliminating harmful error propagation while maintaining reliability.
Solution Approach 2:
An error-free acknowledgement message serves as an intermediary between the first and second subsystems. This intermediary mechanism verifies data integrity before the second subsystem processes synchronization data. The acknowledgement acts as a mediator that prevents faulty data from being processed, thereby blocking error propagation while ensuring reliable synchronized operation.
2Speed
If the second subsystem processes synchronization data immediately upon receipt, then response time is reduced, but faulty data may cause system deactivation
Solution Approach 1:
The second subsystem performs preliminary buffering of synchronization data without immediate processing. This preliminary action separates data reception from data processing, allowing the system to prepare for quick processing while maintaining a safety checkpoint. The buffered data can be processed immediately once error-free status is confirmed, thus maintaining fast response times while preventing faulty data from causing deactivation.
Solution Approach 2:
The error-free acknowledgement mechanism provides feedback from the first subsystem to the second subsystem before data processing occurs. This feedback loop ensures that only verified correct data is processed, preventing faulty data from causing system deactivation. The feedback mechanism maintains reliability while allowing immediate processing of confirmed error-free data.
3Object-affected harmful factors
If the first subsystem performs error checking before data transmission, then error propagation is prevented, but system complexity increases
Solution Approach 1:
Instead of complex pre-transmission error checking in the first subsystem, a simple error-free acknowledgement feedback mechanism is implemented. The second subsystem buffers data and sends an acknowledgement indicating whether the data is error-free. This feedback approach prevents error propagation with minimal added complexity, as it only requires adding the acknowledgement message exchange rather than implementing complex error detection algorithms in the first subsystem.
Solution Approach 2:
The error-free acknowledgement message serves as a simple intermediary mechanism that verifies data integrity without requiring complex error checking in the first subsystem. This intermediary approach prevents error propagation by providing verification at the receiving end, thereby preventing faulty data from being processed while adding minimal system complexity compared to pre-transmission error checking mechanisms.
Data Source
AI summary
Method for operating a redundant automation system to control a technical process, wherein a second fail-safe subsystem is operated redundantly in relation to a first fail-safe subsystem, and wherein the faulty second fail-safe subsystem is used, where synchronization data is initially buffered in the second subsystem, and in the event that no errors are identified, the first fail-safe subsystem sends an error-free message to the second fail-safe subsystem to acknowledge the error-free message with an error free acknowledgment and process the initially buffered synchronization data.