Field watchdog

The field watchdog provides an electric fallback position using intrinsic safety. The fallback position is controlled with a probabilistic level of safely (a concept of 2002 on the organ conunands) however, the failnre of a channel (conunanding the fallback position), could result in multiple failure scenarios that would armihilate (offset) the order to the fallback positioa Considering the temporal aspect of these scenarios, it is necessary to lock the fallback state. This lock can be effective (and its efBciency easy to prove) only if executed with the concepts of intrinsic safety. 

Each charmel has a watchdog card where the contacts of a relay are put in series in order to power the field watchdog, and to set it up with a secure gravity relay. As soon as one of the units fails , the field watchdog cuts off the power supply of the signaling relays, thus securing the state. 

In the French confignration, the gravity relays nsed are of the NSl type (see Fignre 5.13). 

The management of redundancy is certainly one of the most complex functions of the system. The mechanisms producing the attributes of availability and safety are closely linked. 

Basically, it must be remembered that each MCCS securely undertakes the acquisitions, and the functional processing and finally generates the output The MCCS processing units A and B communicate with each other to determine which one is the most available . 

---

This fallback position is triggered by the unit failure (if the failure does not affect its ability to fallback) or by the dual unit. It is fallback positioning by collective suicide. For this, the watchdogs of each processing unit are put in series. Then-activation allows the control of a field watchdog (irreversible lock in the form of NSl relays). 

The field watchdog is an irreversible device for ensuring the maintenance of the system in a fallback position in case of a permanent failnre. These actions are to ensure that the system is not in a more permissive state than in the absence of failure. For this, the equipment power (all components) is cut off. This lack of power ensures the positioning of output in a restrictive state. This watchdog is periodically self-tested. This device detects, in the course of a program, a defect due to a temporary failure or random characteristic of the hardware or software equipment, and initiates the necessary actions. 

The double cut (Figure 5.11) is used as part of the powering of the remote relay said to be in campaign . The main benefit is that it reduces the risk of wrongly recharging the remote relay that provides power directly to the field equipment. The main disadvantage is that it uses a lot of (x2) contacts on the field watchdog relay. 

As soon as it is in the fallback position (field watchdog), the external power supply of the MCCS is cut for at least 5 seconds, the MCCS then restarts (by setting the outputs in restrictive mode, the watchdog is disabled). The power cut will remove potential residual erraticon on silicon junctions. 

The safety architecture is also ensured by an external watchdog controlled by the two watchdogs of the dual processing units. The fall of the watchdog causes the fall of the field watchdog. This watchdog protects against the diversion of the software and stops the MCCS upon detection of a defect ... 

C4 P1 fall of the watchdog the fall of the field watchdog causes the power cut of the processing units and of the MIRET racks, but cuts the 24 V field output post . The fall of the field watchdog puts the MCCS in a restrictive state ... 

C4 P3 detection of a defect on detection of a defect, the software can force the opening of the local watchdog relay to bring down the field watchdog relay. 

---