Fault tolerance voting

Ability of a functional unit to continue to perform a required function in the presence of random faults or errors. For example, a one out of two (loo2) voting system can tolerate one random component failure and still perform its function. Fault tolerance is one of the specific requirements for safety integrity level (SIL) and is described in more detail in International Electrotechnical Commission (lEC) 61508 Part 2, Tables 2 and 3, and in lEC 61511 (ISA 84.01 2004) in Clause 11.4. 

One very effective barrier against random device failures is to implement redundancy. Fault tolerance is provided using multiple devices in voting configurations that are appropriate for the SIL. If one device breaks down, another device is available to provide the safety action. Since failures occur randomly, it is less likely that multiple devices fail at the same time. 

Device safety manual requirements Fault tolerance (redundancy and voting)... 

The issue is not too much different when one goes for 2oo3 because in one failure it is voted out but when two fail situation is similar. However, it is definitely clear from the discussions that triplicate is better options. TMR could be a better solution for critical applications as they offer better fault tolerance. See Fig. 1/6.1.2-1. 

Fault tolerance This is mainly guided by redundancy and voting circuit. 

Very high diagnostic coverage without hardware fault tolerance factors or voting... 

Redundancy and voting Fig. XI/1.1.3-1 shows how a redundancy and voting system increases the fault tolerance. In the first case in Fig. XI/1.1.3-1 A, output... 

WITH REDUNDANCY VOTING FAULT TOLERANCE INCREASES... 

TMR). If in place of three there are N numbers of such selection, then voting is N-modular redundancy (NMR). In this case of TMR, in the case of a double failure (item or voting circuit) output will fail silent fault , whereas in the case of a single fault (in each item or voting circuit) it is a single fault tolerant Byzantine fault. 

FAULT TOLERANCE THROUGH SUPERVISOR DONE BY VOTING OF TRIPLE REDUNDANT PROCESSORS.)... 

Fault tolerance in field instmmentation is mainly concerned with redundancies that in case of a basic plant control system (BPCS) ensure continuance of operation. In the case of a safety instmmentation system (SIS), they additionally minimize nuisance or spurious interventions and alarms. Redundancy in BPCS also improves safety. With properly selected and installed transmitters, improved performance can be achieved by measuring the same variable with more than a single field device. When field devices are more than 2, voting circuits are necessary. In this way m measurements out of a total of n number of signals are made so that m > n/2, for example, m = 2, n = 3, 2oo3 is the selection by voting. There are standardization of redundancy and voting techniques. Some of these are presented next. These are applied for both BPCS and SIS. 

Safety is of paramount importance in the petrochemical industry. Working with flammable and hazardous substances under severe process conditions is always challenging. Naturally, all up-to-date information of the plant must be available at suitable places. There shall be ESDs/PSDs to cope up with emergency situations. In most interlock and safety-related instmmentation, fault tolerant circuits with 2oo3/ loo2 or TMR voting are deployed. SIS SIL is maintained in most cases at SIL3 in these plants. 

Determine if a fault-tolerant control system is necessary. This is one in which a single fault can not cause the system to fail. T)rpically such a system uses triplicate redundancy with two-out-of-three voting logic and redimdant functions. 

After the occurrence of a failure, a totally separate computer is employed to carry out fault localization, which allows effective repair and restoration of full redundancy. The performance-monitoring software executes on the system s fault-tolerant computer and makes use of sensor voting and system mathematical models to detect failures. Real-time diagnostic tests are activated to identify suitable data paths and collect data required to carry out fault localization. 

Clause 6.2.1 requires that The Safety Instrumented Systems (SIS) architecture for each safety function shall be selected to meet its required Safety Integrity Level (SIL). (e.g. the selected architecture may be one out of one lool, loo2 voting, 2oo3 voting, etc.) This is an important feature and is one that has become a significant feature of the lEC standards 61508 and 61511 where the architecture of each part or subsystem of the SIS must comply with certain minimum requirements for fault tolerance. We shall examine these in more detail in Chapter 7... 

Two out of three architecture has three redundant channels with voting arranged to trip if any two channels command a trip. Hence the notation is 2oo3. The fault tolerance level is 1. 

An architecture for SIS logic solvers to achieve fault-tolerance by a 2 out of 3 voting configuration using identical redundant modules. 

Software-implemented fault tolerance is the most common TMR technique in use. This method involves three processors that nm asynchronously. This guards against transient errors. Each processor waits for the other two to cast their vote at certain points in the program cycle (at least once per input/output scan). The processors vote about ... 

Majority vote architectures are infrequently used, apart from some launchers (but the example of Ariane 5 confirms that selective redundancy architecture also meets the need, including in terms of continuity of service) and orbital transport vehicles. Their main disadvantage, at least for satelhtes or exploration probes, is the increase of mass and energy consumption compared to a selective architecture. Moreover, these architectures do not detect and tolerate common mode faults (that is why in the ATV the conventional detection mechanisms on each unit are kept in addition to the comparison mechanism). 

---