On Analogue TMR System

Introduction

There are many methods on how to improve reliability of the system. One of the common methods is a concept of redundancy. Redundancy is simply the addition of information beyond what is needed for standard system operation. This information can be a physical value or electric signal, hardware element or subsystem, an application or software module. The concept of redundancy is based on Murphy’s idea: “If anything can go wrong, it will”. That means that there is no such thing as a never-failing system, because systems are designed and created by humans. Redundancy can improve our chance to ensure standard operation of the system for a long time.

The concept of redundancy is very often managed by a technique of fault masking. Fault masking is simply preventing faults (electric shorts, endless loop, electromagnetic interference, etc.) from introducing errors (incorrect values) within a system. Commonly used techniques for masking an error of a discrete signal are usually based on the TMR (Triple Modular Redundancy) system. The advantage of the TMR system is that it can easy solve the problem of what the correct output of the redundant structure should be and how to ensure that the faulty element does not produce an error within a system. For instance, if there are 3 discrete sensors in the measurement channel then the TMR simply chooses a majority signal from these sensors. One faulty sensor does not produce an incorrect value within a system.

The TMR system is a complex system. It consists of several sub-systems; each has its own reliability parameter. A common way how to describe reliability of the single element or sub-systems is to use the failure rate value (common symbol is λ and the unit is h^-1) or Mean Time Between Failure (the short is MTBF and the unit is h). If the exponential failure law is considered for the element, then the failure rate of the element is reciprocal for the MTBF (Johnson, 1976). Because of uniformity, only failure rate λ and reliability R are used as reliability parameters in this chapter.

If the analogue measurement channel is considered in Figure 1, then 3 sensors measuring the same physical value are within the TMR system (Sensor 1, 2 and 3). A sensor usually has a reliability parameter defined by a manufacturer (λ_s). However, each sensor in Figure 1 is connected by a medium (this chapter only considers metallic wiring) and this medium also has a reliability value (λ_w). How can the failure rate of this medium be declared and how does it influence the reliability parameter of the entire TMR system? It cannot be defined by the manufacturer of the sensor because it heavily depends on the concrete situation, i.e. where the sensor is installed, what the environment is, what the quality of this medium is, etc. A continuous signal from the analogue sensor must be converted from the analogue value into its discrete version. This discrete value is often represented by a number in the computer memory. This transformation is done by the Analogue-to-Digital converter (ADC). The ADC also has some reliability value, usually declared by the manufacturer.

Figure 1.

Analogue measurement of a TMR channel.

The modern control system, where the key control elements are redundant, usually relies on an industrial communication bus (fieldbus), like Profibus, AS-Interface, DeviceNet, EtherCat, etc. An industrial bus significantly improves reliability of the medium λ_w and it also enables the implementation of the ADC directly into the sensor. Such structure with a communication bus is shown in Figure 2. Modern sensors are equipped by a microcontroller (intelligent sensors), which brings many advantages in the area of diagnostic features of the sensor. It is easier for the TMR system to decide, what measurement channel is faulty and if the sensor is connected to the superior system by a fieldbus. Reliability of the single sensor then includes the reliability of the physical value sensor, microcontroller, ADC, and firmware. Modern approaches, like formal methods, ensure that this kind of sensor can be developed with a lower failure rate compared to the sensors considered in Figure 1 (Kucera, 2002).