Triconex controllers are designed specifically ...
... for both safety and critical control applications ...
... in high-hazard industries where safe operations are critical,
... and reliable operation is paramount.
As a safety and security certified system,
... the high-integrity, highly available,
... fault tolerant controller ...
... helps provide operation integrity,
... protection against inherent risks and hazards,
... as well as external threats like cyber attacks.
The Triple Modular Redundant design ...
... employs three isolated parallel control systems,
... and extensive diagnostics all integrated into one system.
The system uses two out of three voting ...
... to provide high-integrity, error free,
... uninterrupted process operation ...
... with no single point of failure.
So how does it work?
Every IO module houses the circuitry ...
... for three independent legs.
Each leg on the input module reads the process data,
... and passes that information ...
... to its respective main processor.
Then, the three main processors communicate ...
... with each other using ...
... a proprietary high-speed bus called TriBus.
Once per scan, the main processors synchronise ...
... and communicate with their neighbours over the TriBus.
The TriBus votes digital input data, compares output data,
... and sends copies of analogue input data ...
... to each main processor.
The main processors then execute the control programme,
... and send outputs generated from the control programme ...
... to the TMR output modules.
The Tricon controller votes the output data ...
... on the output module as close to the field as possible ...
... to detect and compensate for errors ...
... that may occur between the main processor ...
... and the final output driven to the field.
Extensive diagnostics on each channel, module,
... and functional circuit quickly detect ...
... and report operational faults ...
... by means of indicators or alarms.
Diagnostics are automatic,
... no special programming is required.
Each IO slot can contain two identical IO modules,
... which means if a fault is detected on one module,
... control is automatically switched to the healthy module.
A fault detected module can also be replaced online ...
... when only one module is installed in the slot.
In this case, a healthy module is inserted ...
... in the hot spare slot,
... and the control is switched to this module,
... which allows the fault detected module ...
... to be pulled and sent for repair.
Now, let's see the entire process in action.