For over 30 years, the foundation of the EcoStruxure Triconex Safety System has been a triple modular redundant (TMR) architecture. Real-world field experience has demonstrated the value of this TMR foundation. One of our customers recently reported operating more than 70 Triconex systems in their plant, some for over 30 years, without a single nuisance trip. For a company that measures its revenue in millions of dollars per hour, our safety systems deliver measurable business value. This is just an example of more than 25,000 installations in over 80 countries.
What is a TMR and why does it matter in safety systems?
Before I talk about what TMR is, I’d like to discuss what it is not.
TMR is not a technology. It’s an architecture.
Technology is ever evolving. Electronics, for example, continue to get smaller, faster, and more powerful. On the other hand, architecture is how a system is fundamentally designed and behaves.
TMR is a two-out-of-three (2oo3) architecture that provides an ideal balance for industrial safety systems between being fail-safe and fault-tolerant. With a TMR approach, redundancy is inherently provided, and the two-out-of-three voting algorithm and diagnostics mean that there are no single points of failure. This allows continuous, safe operation even during fault conditions. Our 2oo3 architecture differentiates Schneider Electric’s safety system apart from approaches taken by many other safety system vendors. They often adopt a one-out-of-two (1oo2) design to lower costs, but a majority can’t be assured of only two channels. Therefore, when a fault occurs, the system must go to the fail-safe state and halt operations. While this may fail safely, it can have a significant economic impact and increase risk during complex process restarts.
Mathematically speaking, an average safety system using a 1oo2 architecture is highly likely to incur spurious trips resulting in downtime costs to the owner-operator. To avoid this business disruption, fault tolerance is often a stated requirement. To comply, 1oo2 vendors often add an additional I/O module in a “pair and a spare” scheme, also referred to as 2oo4. However, this creates four channels instead of three, which increases the overall lifecycle costs, creates more potential points of failure, and still provides no assurance of a majority vote. With a Triconex TMR system, multiple simultaneous faults can be handled while maintaining safe operation.
Delivering value-added safety for industrial systems
The TMR architecture is just the foundation of our safety system solutions. Users also benefit from:
- Lower engineering effort and reduced training, maintenance, and support costs by having the same high-availability, fault-tolerant system for both safety- and critical control applications, including:
-
- Emergency shutdown
- Fire and gas
- Burner management
- High-integrity pressure protection
- Turbomachinery control and protection
- Strengthen safety and cybersecurity compliance with one TÜV certificate for both industrial safety and cybersecurity for the highest levels of integrity and resilience against hazardous events and threats.
- Simplify system design and deployment through a flexible architecture that reduces engineering time, construction time, and installation costs.
- Flexible form factor options enable more efficient use of physical space.
