Bently Nevada 3500/34 Triple redundant relay module

Bently Nevada 3500/34 Triple redundant relay module

The 3500/34 Triple Modular Redundancy relay module (TMR) adopts a triple modular redundancy design. Through 

multiple redundancy mechanisms of hardware and logic, it realizes highly reliable alarm drive and relay control. Its 

core working principle can be disassembled from the following aspects:

I. Overall Architecture and Signal Transmission Logic

Module composition and collaborative relationship

It is composed of two TMR relay modules and one TMR relay I/O module, and the three work together within the 3500

 framework.

The two TMR relay modules can be programmed and configured to "perform the same function simultaneously", 

forming a redundant backup to ensure that the system can still operate normally when a single module fails.

Triple input mechanism of alarm signals

In the TMR framework, the signals used to trigger alarms (such as monitoring data of equipment vibration, 

displacement, etc.) are synchronously transmitted to the TMR relay module through three independent data channels 

by three independent monitors.

Each data channel is isolated from each other to prevent signal loss or misjudgment caused by a failure of a single 

channel.

Ii. Alarm logic Processing and Contact Signal Generation

Programming and execution of alarm driver logic

Users can customize the alarm driver logic (such as threshold setting, alarm level priority, etc.) through 3500framework configuration software (such as Procomp), and the TMR relay module processes the input monitoring 

signal according to this logic.

For example: When any monitor detects that the signal exceeds the alarm threshold, the module triggers the 

corresponding alarm logic.

Generation and isolation of triple contact signals

For each of the four relay channels, the TMR relay module generates three independent alarm contact signals based 

on the signals of the three independent data channels respectively (each signal corresponds to the judgment result of 

one data channel).

These three contact signals are independent of each other, preventing the contact from malfunctioning due to a single

 circuit failure.

Iii. Voting Mechanism of TMR Relay I/O Module

Redundant voting logic of "3 choose 2"

The TMR relay I/O module consists of 12 relays, divided into 4 channel groups (with 3 relays in each group), and each 

channel group corresponds to 3 contact signals of one relay channel.

For each channel group, the I/O module performs a "3 choose 2 vote" : when at least two of the three contact signals 

are in the "alarm state", the relay of this channel group operates (such as closing or opening), and outputs the final 

control signal.

This mechanism can filter out the false triggering of a single contact signal (such as the false operation of a single 

contact due to interference or module failure), ensuring the reliability of the output.

Relay output form

The three relays in each channel group are connected in a "single-pole single-throw (SPST)" form. The on-off status of

 the relays is controlled by the voting result, and the final output is sent to external devices (such as shutdown 

solenoid valves, alarm indicator lights, etc.).

Iv. Core Advantages of Redundant Design

Fault tolerance capability

If a certain data channel or a certain contact in the TMR relay module malfunctions, due to the existence of triple

redundancy and the 3-in-2 voting mechanism, the system can still maintain correct output through the remaining 

normal signal, avoiding false alarms or missed alarms.

For instance, when one data channel mistakenly sends an alarm signal due to interference, if the signals of the other 

two channels are normal, a three-to-two vote will not trigger the relay to act, thus avoiding accidental shutdown.

High reliability and safety

The design complies with the requirements of ISA S84.01-1996 for safety instrumented systems (SIS), and is applicable

 to scenarios such as petrochemicals and power industries with extremely high requirements for equipment protection. 

It can effectively reduce the risk of production accidents or equipment damage caused by relay module failures.

V. Work Process Summary

Three monitors send monitoring signals to the TMR relay module through independent channels;

The TMR relay module processes signals according to the programming logic and generates three independent 

contact signals for each relay channel.

The contact signal is transmitted to the TMR relay I/O module, and the relay action is determined through a 

three-to-two vote.

The relay outputs control signals to achieve alarm or equipment protection functions. Meanwhile, the two TMR relay 

modules serve as redundant backups for each other.

The design of this triple redundancy + voting mechanism enables the 3500/34 module to have extremely high 

anti-interference ability and fault tolerance in complex industrial environments, and it is a core component for the 

safety monitoring of key equipment.