TRICONEX 3504E triple redundant analog input card

TRICONEX 3504E triple redundant analog input card

TRICONEX 3504E is an analog input card with a triple Modular redundancy (TMR) structure. It belongs to the core component of the Safety Instrumented System (SIS) and is mainly used for the monitoring and control of critical industrial processes. Its working principle is based on the "200OO3" (three to two) voting mechanism, and achieves high availability and fault tolerance through redundant design of hardware and software. The following is a detailed explanation of its working principle:

Triple Modular Redundancy (TMR) architecture

The TRICONEX 3504E adopts A unique TMR architecture. Each card contains three independent channels (A, B, C), and each channel has its own processor, memory, and I/O circuits. These three channels process the same input signals in parallel and continuously exchange data through the internal bus for real-time comparison:

Input signal distribution: Each channel independently receives the same analog input signal (such as 4-20mA or 0-10V).

Data processing: Three channels simultaneously sample, digitize and process the input signal.

Voting mechanism: During the output stage, the system conducts a "2oo3" vote on the results of the three channels - if the results of two or more channels are consistent, it is regarded as a valid output. If there is any inconsistency, a fail-safe response will be triggered.

2. Signal processing flow

2.1 Input Signal Conditioning

The analog input signal is first filtered, isolated and amplified through the signal conditioning circuit to eliminate interference and match the input range of the ADC (analog-to-digital converter).

The signal conditioning circuits of each channel operate independently to ensure that a single fault does not affect other channels.

2.2 Analog-to-Digital Conversion (ADC)

The conditioned analog signal is converted into digital values (usually 16-bit or higher resolution) by a high-precision ADC.

During the conversion process, the ADC of each channel is sampled independently, and the sampling time is synchronized or aligned through algorithms to ensure data consistency.

2.3 Digital Signal Processing

The digitized signal enters the processors of each channel (usually dedicated ASics or microcontrollers) for processing such as linearization, engineering unit conversion, and range verification.

The processor simultaneously executes a self-diagnostic program to detect hardware faults within the channel (such as ADC failure, memory errors, etc.).

2.4 Data Comparison and Voting

The processing results of the three channels are transmitted to the voting logic unit through the internal communication bus.

The voting logic continuously compares the data of the three channels:

If the three are consistent or the error is within the allowable range, output this value.

If the deviation of a certain channel from the other two channels exceeds the threshold, the fault of that channel is determined and it is automatically isolated (referred to as "channel disconnection").

Even if a single channel fails, the remaining two channels can still continue to work normally to maintain the system operation.

3. Fault Detection and fault-tolerant mechanism

3.1 Hardware-level self-diagnosis

Each channel is equipped with multiple self-diagnostic circuits to monitor the status of key components in real time, such as power supply, clock, ADC, memory, etc.

If a hardware fault is detected, an alarm will be triggered immediately and the system will be notified to cut off the channel.

3.2 Data Comparison and Voting

Continuous three-channel data comparison is the core fault-tolerant mechanism of the TMR architecture. By comparing the inconsistent results, the system can quickly locate and isolate the fault channels.

3.3 Fault Safety Response

If a fault causes the system to be unable to maintain the "200oo3" vote (such as when both channels fail simultaneously), the 3504E will trigger fail-safe actions (such as outputting preset values, cutting off the control loop or activating the backup system) to ensure the safe shutdown of the industrial process.

4. Communication and System Integration

Redundant communication interface: The 3504E communicates with other TMR cards (such as processor cards and output cards) via redundant buses (such as Triconnet of TRICONEX or standard industrial buses) to ensure the reliability of data transmission.

System-level synchronization: All TMR cards are synchronized through the master clock to ensure the timing consistency of the entire security system.

Configuration and diagnostic interface: Supports configuration, calibration and online diagnosis through dedicated software (such as TriStation), and enables remote monitoring of the card status and historical fault records.

5. Application Scenarios

TRICONEX 3504E is mainly used in critical control systems with extremely high requirements for safety and reliability, such as:

Emergency Shutdown systems (ESD) in the petrochemical industry

Gas Turbine Control and Protection

Non-nuclear-grade critical circuits of the nuclear power instrumentation control system

Safety monitoring of large generator sets

Leakage detection and control in pipeline transportation