Foxboro DCS Field Control Processor FCP280

A message leaves the FCP280 only if the two FCP280s agree on the message to be sent (bit for bit match).

bit match). Once a fault is detected, both modules run self-diagnostics to determine which module is affected.

The modules run self-diagnostics to determine which module is affected. The unaffected module then takes over control without affecting the normal operation of the system.

This fault-tolerant solution offers the following key advantages over redundant-only controllers

Redundant controllers only:

- No error messages are sent to the field or to applications using the controller data, because unless the two modules match exactly bit-for-bit in sending a message, the

No information is allowed to flow out of the controller.

- The secondary controller is synchronised with the primary controller, which helps to ensure that the most up-to-date data is available in the event of a primary controller failure.

- Since the secondary controller performs exactly the same operations as the primary controller, potential defects can be detected prior to any switchover.