Tricon Triple-Modular Redundant Controller: TMR Architecture for Critical Process Safety

Triconex Tricon Fault Tolerant Control System: Deep Analysis of Core Technology Architecture and Industrial Applications

In the field of modern industrial automation, especially in high-risk industries such as oil and gas, chemical refining, and power generation, process safety and continuous availability of systems are the cornerstone of enterprise operations. Faced with complex production environments, traditional programmable logic controllers (PLCs) often struggle to meet the stringent requirements of Safety Integrity Level (SIL) 3 and Mean Time to Repair (MTTR). As a leading fault-tolerant controller in the industry, the Triconex Tricon system provides solid support for critical process control with its unique technical architecture and excellent diagnostic capabilities. This article will be based on the "Tricon Systems Technical Product Guide" and provide a detailed analysis of the operating principle, hardware architecture, configuration options, and application value of the Tricon system in industrial settings.

Theoretical basis of fault-tolerant control system

What is fault tolerance? In control theory, it refers to the ability of a system to continue executing predetermined tasks without interrupting process control while identifying internal component faults and compensating for them. Tricon is the culmination of this concept, designed specifically for critical process applications that require high levels of security and availability.

The core competitiveness of the Tricon system lies in its Triple Modular Redundancy (TMR) architecture. This architecture is not simply redundant backup, but integrates three isolated and parallel control systems into one. The system adopts a "two out of three" voting mechanism, which means that even if a single hardware failure or transient error occurs in the system, the system can automatically block the error signal and maintain uninterrupted operation of the process using the correct signal. This design completely eliminates the possibility of a single point of failure and ensures high integrity of the control logic.

For engineers, the complexity of Tricon is encapsulated within a minimalist operating interface. Users only need to connect sensors and actuators to a single terminal block and write a control program. The three channels inside the system will automatically execute the program in parallel, handling complex data synchronization and voting tasks. This transparent triple processing mechanism not only reduces maintenance costs, but also greatly enhances the security of the system.

System operation principle and core architecture

1. Triple processing mechanism

The physical architecture of Tricon embodies the design concept of full triple, extending from the input module through the main processor (MP) to the output module. Each I/O module contains three independent channel circuits inside.

In the input stage, three channels asynchronously measure the on-site signals and store the data in input tables A, B, and C, respectively. Each main processor reads the data of its corresponding channel through a proprietary I/O bus and synchronizes the data within a scanning cycle per second through the high-speed TriBus bus. For numerical input, the system conducts a two out of three vote; For analog inputs, the median selection algorithm is used to eliminate abnormal readings caused by hardware interference.

2. TriBus bus and main processor

The brain of the system consists of three main processors (MP) with model number 3008, which form a triangular logic group. Each MP has 16MB of DRAM for storing control programs, sequential event (SOE) data, and communication buffers. MP communicates with each other through TriBus, which is a system composed of three independent serial links with a running speed of up to 25Mbps. TriBus is not only responsible for transmitting I/O and diagnostic data, but also verifies the output data and memory status of the previous cycle through hardware comparison and labeling of inconsistent data, thereby achieving processor level self diagnosis.

3. Output voting mechanism

In the output phase, the output values generated by the control program are transmitted to the output module through the I/O bus. Unlike voting only at the input end, Tricon performs output voting again within the output module, as close as possible to the on-site execution mechanism. This proximal voting mechanism enables the system to detect and compensate for any errors that may occur after voting and before the final output driver. Digital output modules typically use quadruple output circuits, utilizing parallel serial path logic to ensure power output only when the 2/3 driver command is closed.

In depth analysis of I/O module technology details

Tricon offers a full range of I/O modules designed to meet the precision, speed, and safety requirements of different application scenarios. Each module has online hot standby capability, which supports automatic switching of hot standby modules, greatly improving the maintainability of the system.

1. Digital Input Module (DI)

Tricon supports two types of DI modules: TMR (Triple Redundancy) and single channel.

TMR DI module: with 100% triple critical signal path. Each signal is independently regulated and provides optocoupler isolation. Of particular note is its' self-test 'feature. Given that most safety systems use a 'power outage trip' logic, it is crucial to detect the 'stuck on' state. The TMR module of the DC model reads zero input (OFF) by closing a switch in the circuit to verify the integrity of the circuit.

Single channel DI module: designed for cost sensitive but highly secure applications. Although only the critical signal path has been tripled, a special self-test circuit can detect all stuck ON or stuck OFF faults within 0.5 seconds.

2. Digital Output Module (DO)

The digital output module is the key to executing safety interlocks in the system, and is divided into various specifications such as dual channel, monitoring type, DC voltage type, and AC voltage type.

Monitoring type digital output (SDO): designed specifically for outputs that are in a single state for a long time, such as emergency stop valves. In addition to conventional output voting, SDO also has voltage and current read back circuits that can diagnose faults such as open circuits, short circuits, or load loss in on-site circuits. Through the "monitoring" function, the system can detect whether the load is erroneously energized or if there is a short circuit in the demagnetization state.

Dual channel digital output (DDO): strikes a balance between security and cost. It applies 2/3 voting logic to each switch, although not as redundant as TMR modules, it is sufficient to ensure safe operation.

3. Analog quantity and thermocouple module

The analog input module also uses three independent channels and processes data using the median selection algorithm to ensure that drift or faults in a single channel do not affect control accuracy. The thermocouple module integrates cold junction compensation and linearization functions, and supports multiple thermocouple types such as J, K, T, E, etc. The high-precision analog output module (AO) is used to drive 4-20mA field devices and has circuit detection function to ensure the accuracy of output current.

System configuration and expansion architecture

The flexibility of the Tricon system is reflected in its diverse rack configuration options, which consist of one main rack and up to 14 expansion or remote expansion (RXM) racks, supporting up to 118 I/O modules.

1. Rack layout and power supply

Each rack is equipped with two redundant power modules on the left side, using a dual power rail design. Each power module can independently provide full load power to all modules in the rack. The rated output power of the power module is 175 watts at an ambient temperature of 140 ° F (60 ° C). The main processor is located on the right side of the mainframe, and the rest is divided into logical slots.

In the mainframe, there are 6 logical slots for I/O and communication modules, as well as 1 COM slot. The expansion rack provides 8 logical slots.

2. I/O bus and remote expansion

The racks are connected through triple I/O bus cables. The standard local extension distance is usually 100 feet (30 meters), but can be extended to 1000 feet (300 meters) in specific applications.

For applications located more than 30 meters away from the main control room, such as different areas of offshore drilling platforms or large refineries, Tricon offers a Remote Expansion (RXM) solution. The RXM rack uses fiber optic cables to place I/O modules 7.5 miles (12 kilometers) away from the main rack, while also having excellent anti-static and electromagnetic interference capabilities. Each RXM module group serves as a repeater and extender, providing ground isolation to ensure that remote signals are not distorted.

3. Online module maintenance

Tricon's logic slot design supports two online repair methods: hot standby and online replacement.

Hot standby method: Install two identical I/O modules in the slot. One is in an active state, while the other is charged but not working. The system automatically rotates control every hour to ensure that both modules receive complete diagnosis. Once a fault is detected, the system instantly switches to the hot standby module.

Online replacement: Even if there is only one module in the slot, if a fault occurs, the engineer can directly insert the replacement module. Tricon will smoothly transition control from the old module to the new module after self diagnosis, without interference during the process.

Communication capability and integration with third-party systems

Effective integration of Safety Instrumented Systems (SIS) and Distributed Control Systems (DCS) is crucial in modern factories. Tricon offers a wide range of communication module options, breaking down information silos.

1. Overview of Communication Module

Tricon Communication Module (TCM): Supports 10/100BaseT Ethernet and RS-232/485 serial ports. It allows Tricon to communicate peer-to-peer with Modbus TCP/RTU devices, OPC clients, and other Tricon controllers, and supports GPS time synchronization.

Enhanced Intelligent Communication Module (EICM): Focusing on serial communication, supporting Modbus and TriStation protocols, with optical isolation ports, suitable for serial networks with high anti-interference requirements.

Network Communication Module (NCM): Supports IEEE 802.3 Ethernet with a running speed of 10Mbps, used to connect external hosts and Triconex dedicated applications.

Security Manager Module (SMM) and Hiway Interface Module (HIM): specifically designed for integration with Honeywell TDC 3000 DCS. SMM is directly mounted on the Universal Control Network (UCN), while HIM is connected through a data highway, making Tricon a secure node for Honeywell systems.

Advanced Communication Module (ACM): Used as an interface for Foxboro I/A Series DCS, mounted on Nodebus, achieving deep integration with Foxboro system.

2. Network Protocol and Security

Tricon supports multiple protocols, including Modbus master/slave, TCP/IP, UDP/IP, as well as Triconex's proprietary Peer to Peer and time synchronization protocols.

In terms of security, the communication system supports module level, medium level, and workstation level redundancy. By installing dual TCM or NCM and connecting dual network cables, the system can withstand cable breakage, port failures, and even module failures without losing communication connections. In addition, the write protection function can prevent external DCS or hosts from illegally modifying the Tricon security logic, ensuring the independence of the security system.

Software Engineering and Sequential Event Recording

Powerful hardware cannot do without excellent software support. The TriStation 1131 development workstation is the engineering core of the Tricon system and fully complies with the IEC 61131 international standard.

1. Programming environment and language

TriStation 1131 provides three programming languages: Function Block Diagram (FBD), Ladder Diagram (LD), and Structured Text (ST), which meet the programming habits of different engineers. In addition, Triconex offers the optional CEMPLE (Causal Matrix Programming Language Editor) for the widely used causal matrix in the process control industry. CEMPLE allows engineers to directly associate "causes" and "consequences" in a two-dimensional matrix and automatically convert them into functional block logic that complies with IEC standards, greatly reducing the risk of programming errors and improving development efficiency.

2. Sequential Event (SOE) capability

In accident analysis, it is crucial to determine the order in which accidents occurred. The Tricon controller has a powerful sequential event recording function built-in. During each scan, the main processor checks for specified discrete variable state changes (i.e. events), stamps them, and stores them in a buffer.

SOE software can collect event data from multiple networked Tricon controllers. Through Peer to Peer networks, the time synchronization error of all controllers can be controlled within ± 25 milliseconds. This high-precision time recording capability enables operators to accurately restore the on-site state at the time of the accident, analyze which sensor's false alarm caused the trip, or the delay problem in the control logic itself.

On site terminals and wiring options

To adapt to harsh on-site environments and complex wiring requirements, Tricon offers a diverse range of External Terminal Blocks (ETPs) and cable options.

1. External Terminal Board (ETP)

ETP is an electrically passive printed circuit board used to connect field wiring. It allows for disassembly or replacement of I/O modules without interfering with on-site wiring. Tricon offers standard terminal boards, basic terminal boards, non flammable terminal boards, and terminal boards with intermediate relays.

Non flammable terminal board: certified by T Ü V, suitable for Zone 2 and Class 1, Division 2 hazardous areas. Its internal circuit limits energy release, and even if the on-site wires are short circuited or disconnected, it will not ignite the surrounding atmosphere.

Relay terminal board: suitable for situations where the load current is greater than 2A or the voltage is higher than 115VAC, providing physical isolation and additional driving capability.

2. Fan out the cable

As a low-cost alternative, one end of the fan out cable is connected to the Tricon base plate, and the other end provides 50 dispersed numbered cables. Although it does not support analog signals, in digital I/O applications, it can effectively lead signal wiring out to the outside of the control cabinet, simplifying the wiring layout.

Environmental adaptability and certification standards

The design of the Tricon controller fully considers the harsh environment of industrial sites. Its operating temperature range can reach 0 ° C to 60 ° C, and it has anti vibration, anti impact, and high-level electromagnetic compatibility (EMC) capabilities, meeting CISPR 11 Class A standards.

In terms of safety certification, the Tricon v9 and v10 series have been certified by multiple international authoritative organizations, including T Ü V Rheinland, CSA, and FM. It complies with the IEC 61508 standard and can be used for emergency stop applications at SIL 1 to SIL 3 levels; It also complies with standards such as DIN V 19250 (AK 1-6), EN 54 (fire and gas detection), and NFPA 8501 (burner management). For nuclear industry applications, Tricon also meets the Class 1E equipment requirements of the US Nuclear Regulatory Commission (NRC). These certifications provide a solid compliance foundation for Tricon's global applications, particularly in the field of life safety.

Model Supplement

1、 Core module model (classified by category)

1. Chassis and expansion related

Host box: 8110 (high-density configuration)

Expansion chassis: 8111 (high-density configuration)

Remote expansion chassis: 8112 (high-density configuration)

Blank slot panel: 8105

Expansion cables: 9000 (I/O bus expansion cable, 3 pieces/set), 9001 (I/O-COMM bus expansion cable, 3 pieces/set)

Fan out cable: 9101-010 (standard 10 feet, customizable length)

2. Power module

120 VAC/VDC 175W：8310

24 VDC 175W：8311

230 VAC 175W：8312

3. Main processor module

3008 (16MB DRAM, 32-bit processor)

4. Communication module

TCM (Tricon Communication Module): 4351A, 4352A, 4353, 4354

EICM (Enhanced Intelligent Communication Module): 4119, 4119A

SMM (Safety Manager Module): 4409

NCM (Network Communication Module): 4329, 4329G

ACM (Advanced Communication Module): 4609

HIM (Hiway Interface Module): 4509

RXM (Remote Expansion Module): 4200-3 (multimode fiber, main site), 4201-3 (multimode fiber, remote site), 4210-3 (single-mode fiber, main site), 4211-3 (single-mode fiber, remote site)

5. Digital Input (DI) Module

TMR type: 3501E, 3501T (115VAC/VDC, 32 points), 3502E (48VAC/VDC, 32 points), 3503E (24VAC/VDC, 32 points), 3504E (24/48VDC, 64 points), 3505E (24VDC low threshold, 32 points)

Single channel type: 3564 (24VDC, 64 points)

Pulse input type: 3511 (20-20000Hz, 8 points)

Pulse accumulation type: 3515 (24VDC, 32 points)

6. Digital Output (DO) Module

TMR type: 3601E, 3601T (115VAC, 16 points), 3603B, 3603E, 3603T (120VDC, 16 points), 3604E (24VDC, 16 points), 3607E (48VDC, 16 points), 3611E (115VAC monitoring type, 8 points), 3617E (48VDC monitoring type, 8 points), 3623, 3623T (120VDC monitoring type, 16 points), 3624 (24VDC monitoring type, 16 points), 3625 (24VDC monitoring/non monitoring type, 32 points)

Dual redundancy type: 3664, 3674 (24VDC, 32 points)

Relay output type (non redundant): 3636R, 3636T (32 points)

7. Analog Input (AI) Module

Voltage input types: 3700, 3700A (0-5VDC, 32 points), 3701 (0-10VDC, 32 points), 3703E (0-5/0-10VDC isolated type, 16 points), 3704E (0-5/0-10VDC non isolated type, 64 points), 3720 (0-5VDC single ended input, 64 points), 3721 (0-5/-5+5VDC, 32 points)

Thermocouple input type: 3706A (J/K/T type, 32 points), 3708E (E/J/K/T isolation type, 16 points)

8. Analog Output (AO) module

Standard type: 3805E (4-20mA, 8 points)

High current type: 3806E (6 channels 4-20mA+2 channels 20-320mA)

2、 External terminal panel model (classified by adaptation module)

1. Digital input module adaptation terminal

9551-110 (adapted to 3501E/3501T), 9552-610 (adapted to 3502E), 9553-610 (adapted to 3503E/3505E), 9561-110/9561-810 (adapted to 3501E/3501T), 9562-810 (adapted to 3502E), 9563-810 (adapted to 3503E/3505E), 9564-810/9565-810 (adapted to 3504E), 9570-610/9571-610/9572-610 (intrinsic safety type)

2. Digital output module adaptation terminal

9651-110 (compatible with 3601E/3603E), 9652-610 (compatible with 3607E), 9653-610 (compatible with 3604E), 9661-110/9661-510/9661-610 (compatible with 3601E/3623), 9662-110/9662-610 (compatible with 3604E/3624/3625), 9667-110/9667-810 (compatible with 3607E), 9671-610 (intrinsically safe, compatible with 3604E/3624)

3. Simulation module adaptation terminal

9753-110 (compatible with 3700/3701/3703E), 9760-210/9760-410 (compatible with 3704E/3720), 9761-210/9761-410 (compatible with 3700/3701), 9762-210/9762-410 (compatible with 3703E), 9763-810 (compatible with 3700/3701), 9764-310 (RTD/TC/AI signal conditioning type), 9784-610/9785-610 (intrinsic safety type, compatible with 3706A)

4. Special function terminals

Bypass panel: BP9228-010, BP9229-010

Intrinsically safe terminals: 9570-610, 9571-610, 9572-610, 9671-610, 9784-610, etc

Relay terminal: 9668-110 (compatible with 3636R/3636T)

3、 Software and tool related models

TriStation 1131 v3.1.3：7244-4

CEMPLE Language Editor v3.1.3:7224-4

DDE Server Software: 7523-1

Network accessory kit: 7600-3

4、 Other key models

Cooling baffle: 2000361-001

Terminal panel associated ETA numbers (partial): 3000400-160, 3000410-260, 3000510-180, etc

Terminal panel associated cable numbers (partial): 4000093-110, 4000094-310, 4000103-510, etc