Maxiflex P3 PAC User Manual
100
-© Omniflex
UMM126XR18.pdf
13. Constructing a Redundant Controller System
13.1 Principles of Dual Redundancy
Availability of a system is defined in terms of the Mean Time To Failure (MTTF) of individual
components and the Mean Time to Repair(MTTR) of these components (MTBF =
MTTF+MTTR). As systems become more complex, the MTBF of these systems decreases
due to the in
creasing number of components. The principle of “dual redundancy” is to
duplicate those components identified as “critical” to the system, such that if any one of those
duplicated components were to fail, then the system would continue to operate uninterrupted,
(but with an alert of the failure).
“Critical” components are considered those components whose operation is central to a
significant part of the system, and/or whose MTBF is considered low in relation to other
components in the system.
There are number of requirements to be met before dual redundancy will provide the
theoretically promised system availability:
1. All failures of redundant components must be self-revealing.
2. Any failure of a redundant component must not be able affect the operation the
remaining system.
13.2 Functional Safety
Dual Redundant systems are not necessarily safety-related systems. In order for a control
system to be considered for use in a “safety related” role, the system, its design and
application must comply with the requirements of a standard such as IEC61508.
In some sense, high availability and Functional Safety are related, in that both concepts are
concerned with the detection of failures, and the increase of system MTBF. If the system
could be guaranteed to be 100% reliable, then the issue of failure to a safe state would not
be applicable.
But in another sense, high availability and Functional Safety are opposing concepts. Safety-
related systems are concerned with the safety of the process, and will attempt to put the
process into a safe state as an overriding requirement, with no regard for system availability
and therefore productivity. High Availability on the other hand is concerned with keeping the
equipment and therefore plant running in the face of component failure.
Safety-related systems have to meet defined requirements for safety as specified in
standards such as IEC61508, and require the analysis of every failure mode of every
component in the system into safe and dangerous failures. Safety-related systems are
concerned with the detection of every possible failure that can occur in the safety related
parts of the system.
High Availability systems, on the other hand, are concerned mainly with the detection of
failure of the redundant parts of the system only, and are not concerned with the
categorisation of these failures as “safe” or “dangerous”.
High Availability systems are only concerned with certain component failures, and their affect
on the performance of the system, in an attempt to increase the combined system MTBF to
acceptable levels.
