Redundant Field Device Segmentation for SIL 3 Safety
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Field devices in automation technology face challenges in achieving high safety integrity levels, particularly with conventional microprocessors that are monolithic and prone to failures, which cannot meet the stringent safety requirements of SIL 3 standards, especially in applications like level monitoring in tanks with hazardous liquids.
Innovation Solution
A field device design featuring redundant and diversified components, including a majority voter with comparator, error detection, and switch-off stages integrated within each voting channel, along with reconfigurable logic modules and separate power supplies for measurement and current setting channels, ensures enhanced functional safety and reliability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a conventional monolithic microprocessor is used as the voter, then the device complexity is reduced, but the functional safety cannot meet SIL 3 requirements
Solution Approach 1:
The voter is segmented into three independent voting channels (VC1, VC2, VC3), each with its own comparator stage, error detection stage, and shutdown stage. This segmentation allows the system to tolerate failures in individual channels while maintaining overall safety integrity at SIL 3 level.
Solution Approach 2:
Error detection stages are implemented in each voting channel to detect faults before they propagate to the output. The shutdown stages are pre-configured to immediately isolate faulty channels, preventing systematic errors from compromising the entire system before safety requirements are violated.
2Reliability
If redundant measurement channels are implemented, then the reliability is improved, but the device complexity increases
Solution Approach 1:
The measurement system is divided into three independent measurement channels (MC1, MC2, MC3), each with its own sensor and signal processing path. This segmentation enables redundant measurement while maintaining modularity, where each channel can be independently analyzed and replaced without affecting the others.
Solution Approach 2:
Each voting channel is designed with universal functionality to process signals from any measurement channel. The comparator stages and error detection logic are identical across all voting channels, allowing them to universally evaluate any combination of measurement inputs, thereby reducing overall system complexity despite the redundant architecture.
3Reliability
If separate power supplies are used for measurement and current setting channels, then the functional safety is improved, but the device complexity increases
Solution Approach 1:
The power supply system is segmented into separate power sources for measurement channels and current setting channels. This physical segmentation prevents a single point of failure from affecting both measurement and control functions, thereby improving safety integrity while maintaining manageable complexity through modular power distribution.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The invention relates to a field device for determining or monitoring a process variable in automation engineering, the field device satisfying a safety standard that is required in predetermined safety-critical usage, with a sensor operating according to a defined measurement principle, and with a control/evaluation unit (6) that prepares and evaluates measurement data supplied by the sensor along at least three redundant and diversely designed measuring channels (MK), and wherein a redundant analogue current interface (8) is provided, by means of which a current representing the process variable can be adjusted via a two-wire line. The analogue current interface (8) is designed to be triply redundant and the following components are associated with the analogue current interface (8): three parallel-connected current-adjustment channels (IK); a doubly redundant voter (V) that detects a malfunction (Feh) in one of the measuring channels MK and/or the current-adjustment channels (IK); and a doubly redundant shut-down stage (9), via which a measuring channel (MK) or a current-adjustment channel (IK) is switched off when the voter (V) detects a malfunction in the measuring channel (MK) or in the current-adjustment channel (IK).