Redundant Field Device Evaluation Unit for SIL 3 Safety
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional field devices in automation technology fail to meet the high safety requirements of SIL 3 standards due to the vulnerability of monolithic microprocessors in their evaluation units, which cannot reliably prevent dangerous errors and ensure the reliability of safety-critical applications like level monitoring in tanks.
Innovation Solution
The control/evaluation unit is designed with triple redundancy and a voter system comprising a comparator stage, error detection stage, and output selection stage, with each voter channel having double redundancy, ensuring that errors in measurement channels or power supplies do not compromise safety, and utilizing reconfigurable logic modules to dynamically adjust functionality based on application needs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a conventional monolithic microprocessor is used in the evaluation unit, then the device complexity is reduced and ease of manufacture is improved, but the functional safety and reliability cannot meet SIL 3 standards
Solution Approach 1:
The evaluation unit is segmented into multiple independent measurement channels (at least three), each with separate signal processing paths. This segmentation allows the system to isolate and detect faults in individual channels while maintaining operation through redundant channels, thereby achieving SIL 3 safety levels without requiring a single complex microprocessor to handle all safety logic.
Solution Approach 2:
A voter unit is introduced as an intermediary component between the measurement channels and the output. The voter receives signals from multiple measurement channels, compares them, and determines the final output value. This intermediary structure enables fault detection and safety validation without requiring the main control microprocessor to directly handle safety-critical comparisons.
2Reliability
If redundant and diverse measurement channels are implemented, then the safety level is improved, but the device complexity and cost increase
Solution Approach 1:
The measurement channels are designed with universal functionality, where each channel can independently perform the complete measurement and evaluation function. This multi-functionality allows any channel to serve as the primary measurement path, while others provide redundancy. The voter unit universally compares all channel outputs, enabling flexible fault tolerance without requiring specialized hardware for each channel.
Solution Approach 2:
The system utilizes parameter changes in the measurement signals (magnitude, polarity, timing) to detect faults and validate measurements. By monitoring multiple parameters across redundant channels, the system achieves high safety levels through software-based fault detection rather than requiring additional complex hardware sensors or actuators.
3Measurement precision
If the voter unit compares output signals from multiple measurement channels, then error detection capability is improved, but the processing time and complexity increase
Solution Approach 1:
The voter unit continuously compares output signals from all measurement channels in real-time, performing error detection preliminarily before final output is generated. This preliminary comparison action allows the system to identify divergent signals and potential faults immediately, enabling rapid fault detection without adding significant processing delay to the measurement cycle.
Solution Approach 2:
The evaluation unit is designed to rapidly process and compare signals through the voter logic, rushing through the comparison operation efficiently. The voter uses simple comparison logic that can quickly determine whether measurement channels agree or diverge, minimizing the time penalty associated with redundant signal processing while maintaining high error detection capability.
Data Source
Figure 1
Figure 2
Figure 3a~3c
AI summary
The invention relates to a field device for determining or monitoring a process variable in automation technology, wherein the field device satisfies a safety standard that is required in a predetermined safety-critical application, with a sensor (11) operating according to a defined measuring principle and with a control/evaluation unit (12) that processes and evaluates measurement data supplied by the sensor (11) along at least three measuring channels (MK) designed to be redundant and/or diverse, and wherein a voter (13) which consists of a plurality of components that are at least in part designed so as to be doubly redundant, is associated with the control/evaluation unit (12).