Triple-Controller Voting Architecture for SIL-Rated Control Reliability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing industrial control systems face challenges in achieving high reliability without incurring significant costs, particularly in safety-critical environments, as they often rely on single controllers with multiple processors or cores, which can be costly and prone to failures.
Innovation Solution
A control system with triple modular redundancy (TMR) using separate controllers, where each controller generates redundant output data packets, and an I/O system evaluates these packets through a voting process to generate a control input, ensuring reliable operation even in the presence of failures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate controllers are used to implement triple modular redundancy, then reliability is improved, but device complexity increases
Solution Approach 1:
The control system is divided into three separate controller devices, each independently generating redundant output data packets. This segmentation allows each controller to operate autonomously while contributing to the overall redundancy, improving reliability without requiring a single complex controller with multiple processors.
Solution Approach 2:
Each controller generates copies of the same control output data packets, creating redundant versions that are transmitted through the network. The I/O system then evaluates these copied packets through a voting process, ensuring that the system can tolerate failures in individual controllers while maintaining safe operation.
2Reliability
If triple modular redundancy is implemented using separate controllers, then safety integrity level is improved, but cost increases
Solution Approach 1:
The system uses three existing SIL2-rated controllers that can each serve multiple functions: normal control operations and redundant safety-critical operations. By leveraging the multi-functionality of these controllers within the TMR framework, the system achieves SIL3 ratings without requiring specialized expensive hardware for each redundant unit.
Solution Approach 2:
The system changes the operational parameters of existing controllers by configuring them to participate in a voting mechanism within the I/O system. This parameter change allows standard controllers to function within a redundant architecture, achieving higher safety integrity levels without the need for costly specialized hardware upgrades.
3Reliability
If redundant output data packets are transmitted through a network, then reliability is improved, but communication overhead increases
Solution Approach 1:
Controllers transmit redundant output data packets at periodic intervals through the network rather than continuously. This periodic transmission reduces network bandwidth consumption while still providing timely failover capability, as the redundant packets are sent frequently enough to detect failures but not so frequently as to waste network resources.
Data Source
AI summary
A control system with triple modular redundancy (TMR) using separate controllers includes a first controller device, a second controller device, a third controller device, and an input/output (I/O system). The I/O system receives redundant output data packets from the first controller device, the second controller device, and the third controller device. The I/O system further evaluates the redundant data packets based on a voting process, generates a control input responsive to evaluating the redundant data packets based on the voting process, and provides the control input to the first controller device, the second controller device, and the third controller device.