Redundant Fail-Safe Control with Buffered Synchronization Handover
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In redundant automation systems, when the leading fail-safe subsystem detects an error and deactivates, it may transmit incorrect synchronization data to the trailing subsystem, causing the trailing subsystem to also deactivate, leading to loss of system control, despite the trailing subsystem being capable of continuing the process without issues if not supplied with erroneous data.
Innovation Solution
The method involves temporarily storing synchronization data in the trailing subsystem, performing error checks on the leading subsystem after each program section, and only acknowledging error-free data for processing, allowing the trailing subsystem to discard incorrect data and switch to solo operation if the leading subsystem fails, with asynchronous communication to decouple processing power from communication bandwidth.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the leading fail-safe subsystem transmits synchronization data to the trailing subsystem, then the trailing subsystem can maintain program execution sequence, but error data may be transmitted causing the trailing subsystem to deactivate
Solution Approach 1:
The trailing subsystem buffers synchronization data before processing, allowing it to temporarily store received data without immediately executing it. This preliminary buffering action enables the system to wait for error-free confirmation from the leading subsystem before applying the synchronization data, preventing error propagation while maintaining the ability to restore correct execution sequence.
Solution Approach 2:
The leading subsystem sends error-free confirmation signals to the trailing subsystem after successfully completing program sections. This feedback mechanism allows the trailing subsystem to verify the correctness of synchronization data before processing, ensuring that only valid data is applied and preventing error propagation while maintaining system reliability.
2Loss of time
If the trailing subsystem processes synchronization data immediately, then response time is reduced, but error-prone data causes subsystem deactivation
Solution Approach 1:
The trailing subsystem performs preliminary buffering of synchronization data without immediate processing. This allows the data to be ready for quick execution once validated, minimizing the time loss while ensuring reliability through the validation step before actual processing occurs.
3Reliability
If the leading subsystem deactivates upon error detection, then system safety is maintained, but synchronization data already transmitted may cause trailing subsystem to also deactivate
Solution Approach 1:
The trailing subsystem buffers synchronization data before processing, creating a safety mechanism that prevents erroneous data from immediately causing deactivation. This buffering allows the trailing subsystem to maintain control capability even when the leading subsystem deactivates, as it can discard faulty buffered data and continue operation.
Solution Approach 2:
The error-free confirmation feedback mechanism ensures that the trailing subsystem only processes valid synchronization data. When the leading subsystem deactivates due to an error, it can send error-free confirmations for previously processed sections, allowing the trailing subsystem to maintain correct program execution sequence and avoid unnecessary deactivation.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In order to operate a redundant automation system (100) for controlling a technical process, in which a first fail-safe subsystem (1) and a second fail-safe subsystem (2) are operated redundantly, and the faulty second fail-safe subsystem (2) is used, the synchronization data (SD) is initially stored in the second subsystem (2), and in the event that a fault-free state is detected, the first fail-safe subsystem (1) sends a fault-free message (FFOK) to the second fail-safe subsystem (2), whereupon the latter acknowledges the fault-free message (FFOK) with a fault-free confirmation (FFQ) and processes the synchronization data (SD) initially stored.