Triconex Tricon Fault-Tolerant Controller

What is Fault-Tolerant Control?

A fault-tolerant control system identifies and compensates for failed control

system elements and allows repair while continuing an assigned task

without process interruption. A high integrity control system such as the

Tricon is used in critical process applications that require a significant degree

of safety and availability.

What is the Tricon?

The Tricon is a state-of-the art controller that provides fault tolerance

by means of Triple-Modular Redundant (TMR) architecture. TMR integrates

three isolated, parallel control systems and extensive diagnostics in one control

system. The system uses two-out-of three voting to provide high-integrity,

error-free, uninterrupted process operation with no single point of failure.

The Tricon controller uses three identical channels. Each channel indepen

dently executes the control program inparallel with the other two channels.

Specialized hardware/software voting mechanisms qualify and verify all

digital inputs and outputs from the field, while analog inputs are subject to

a mid-value selection process.

Because each channel is isolated from the others, no single-point failure in any

channel can pass to another. If a hardware failure does occur on one channel,

the other channels override it. Mean while the faulting module can easily be

removed and replaced while the controller is online without interrupting 

the process.

Setting up control programs is simplified with the triplicated Tricon system,

because it operates as a single control system from the user’s point of view.

The user terminates sensors and actuators at a single wiring terminal and

programs the Tricon with one set of control program logic. The Tricon

controller manages the rest!

Extensive diagnostics on each channel,module, and functional circuit immedi

ately detect and report operational faults by means of indicators or alarms.

All diagnostic fault information is accessible by the control program and

the operator. The program or the operator can use diagnostic data to modify

control actions or direct maintenance procedures.

Other key features of the Tricon controller that ensure the highest

possible system integrity are:

• No single point of failure

• Ability to operate with 3. 2 or 1 Main Processor before shutdown

• Fully implemented and transparent triplication

• Comprehensive system diagnostics

• Complete range of I/O modules

• Dual and single I/O modules for safety-critical points with a limited

need for availability

• Remote I/O up to 7.5 miles (12 kilometers) away from MPs

• Simple, online module repair

• Unsurpassed reliability and availability

What are Typical User Applications?

Each day the Tricon supplies increased safety, reliability and availability to a

worldwide installed base. The following are a few typical applications. 

For more information on how a Tricon controller can add value to your

applications, ask your sales representative for additional documentation and

customer references.

Emergency Safety Shutdown (ESD)

The Tricon provides continuous protection for safety-critical units in refineries,

petrochemical/chemical plants and other industrial processes. For example,

in reactor and compressor units, plant trip signals—for pressure, product feed

rates, expander pressure equalization and temperature—are monitored and

shutdown actions taken if an upset condition occurs. Traditional shutdown

systems implemented with mechanical or electronic relays provide shutdown

protection but can also cause dangerous nuisance trips.

The Tricon increases system integrity, providing automatic detection and veri

fication of field sensor integrity, inte grated shutdown and control functionality,

and direct connection to the supervisory data highway for continuous monitoring

of safety-critical functions.

Boiler Flame Safety Process steam boilers function as a critical component in

most refinery applications. Protection of the boiler from