Archives

Turbine Control Systems

The control and protection of gas or steam turbines requires high integrity

as well as safety. The continuous operation of the fault-tolerant Tricon

controller provides the turbine operator with maximum availability while main

taining equivalent levels of safety.

Speed control as well as start-up and shutdown sequencing are implemented

in a single integrated system. Unscheduled outages are avoided by using hot

spares for the I/O modules. If a faultoccurs in a module, a replacement

module is automatically activated without operator intervention.

Offshore Fire and Gas Protection

The protection of offshore platforms from fire and gas threats requires

continuous availability as well as reliability. The Tricon provides this avail

ability through online replacement of faulty modules. Faults in individual

modules, field wiring and sensors are managed automatically by built-in

diagnostics. Analog fire and gas detectors are connected directly to the

Tricon, eliminating the need for tripamps. An operator interface monitors

fire and gas systems as well as diagnostics for the Tricon controller and its

attached sensors. Traditional fire and gas panels can be replaced with a single

integrated system, saving costly floor space while maintaining high levels of

safety and availability.

Emergency Safety Shutdown (ESD)

The Tricon provides continuous protection for safety-critical units in refineries,

petrochemical/chemical plants and other industrial processes. For example,

in reactor and compressor units, plant trip signals—for pressure, product feed

rates, expander pressure equalization and temperature—are monitored and

shutdown actions taken if an upset condition occurs. Traditional shutdown

systems implemented with mechanical or electronic relays provide shutdown

protection but can also cause dangerous nuisance trips.

The Tricon increases system integrity, providing automatic detection and veri

fication of field sensor integrity, inte grated shutdown and control functionality,

and direct connection to the supervisory data highway for continuous monitoring

of safety-critical functions.

Boiler Flame Safety Process steam boilers function as a critical component in

most refinery applications. Protection of the boiler from upset conditions, safety

interlock for normal startup and shutdown, and flame-safety applications are

combined by one integrated Tricon system. In traditional applications, these

functions had to be provided by separate, non integrated components.

But with the fault-tolerant, fail-safe Tricon controller, the boiler operations staff

can use a critical resource more productively while maintaining safety at or

above the level of electromechanical protection systems.

Other key features of the Tricon controller that ensure the highest

possible system integrity are:

• No single point of failure

• Ability to operate with 3. 2 or 1 Main Processor before shutdown

• Fully implemented and transparent triplication

• Comprehensive system diagnostics

• Complete range of I/O modules

• Dual and single I/O modules for safety-critical points with a limited

need for availability

• Remote I/O up to 7.5 miles (12 kilometers) away from MPs

• Simple, online module repair

• Unsurpassed reliability and availability

What are Typical User Applications?

Each day the Tricon supplies increased safety, reliability and availability to a

worldwide installed base. The following are a few typical applications. 

For more information on how a Tricon controller can add value to your

applications, ask your sales representative for additional documentation and

customer references.

What is the Tricon?

The Tricon is a state-of-the art controller that provides fault tolerance

by means of Triple-Modular Redundant (TMR) architecture. TMR integrates

three isolated, parallel control systems and extensive diagnostics in one control

system. The system uses two-out-of three voting to provide high-integrity,

error-free, uninterrupted process operation with no single point of failure.

The Tricon controller uses three identical channels. Each channel indepen

dently executes the control program inparallel with the other two channels.

Specialized hardware/software voting mechanisms qualify and verify all

digital inputs and outputs from the field, while analog inputs are subject to

a mid-value selection process.

Because each channel is isolated from the others, no single-point failure in any

channel can pass to another. If a hardware failure does occur on one channel,

the other channels override it. Mean while the faulting module can easily be

removed and replaced while the controller is online without interrupting 

the process.

Setting up control programs is simplified with the triplicated Tricon system,

because it operates as a single control system from the user’s point of view.

The user terminates sensors and actuators at a single wiring terminal and

programs the Tricon with one set of control program logic. The Tricon

controller manages the rest!

Extensive diagnostics on each channel,module, and functional circuit immedi

ately detect and report operational faults by means of indicators or alarms.

All diagnostic fault information is accessible by the control program and

the operator. The program or the operator can use diagnostic data to modify

control actions or direct maintenance procedures.

What is Fault-Tolerant Control?

A fault-tolerant control system identifies and compensates for failed control

system elements and allows repair while continuing an assigned task

without process interruption. A high integrity control system such as the

Tricon is used in critical process applications that require a significant degree

of safety and availability.

Offshore Fire and Gas Protection

The protection of offshore platforms from fire and gas threats requires

continuous availability as well as reliability. The Tricon provides this avail

ability through online replacement of faulty modules. Faults in individual

modules, field wiring and sensors are managed automatically by built-in

diagnostics. Analog fire and gas detectors are connected directly to the

Tricon, eliminating the need for tripamps. An operator interface monitors

fire and gas systems as well as diagnostics for the Tricon controller and its

attached sensors. Traditional fire and gas panels can be replaced with a single

integrated system, saving costly floor space while maintaining high levels of

safety and availability.

System Configuration

Physically, a basic Tricon controller consists of Main Processors and I/O modules,

communication modules, the chassis enclosing the modules, field wiring connections, and a

TriStation PC. This section briefly describes these components and provides general

specifications.

Tricon modules are field-replaceable units consisting of an electronic assembly housed in a

metal spine. Each module has a protective cover that ensures no components or circuits are

exposed even when a module is removed from the chassis. Offset backplane connectors make it

impossible to plug a module in upside down, and keys on each module prevent the insertion of

modules into incorrect slots. The Tricon controller supports digital and analog input and output

points, as well as pulse and thermocouple inputs and multiple communication protocols.

Tricon Controller Chassis

A Tricon controller can include a maximum of 15 chassis, housing any appropriate combination

of input, output, communication, interface, and hot-spare modules. There are three types of

chassis: Main, Expansion, and RXM.

• The Main Chassis houses the Main Processor modules and I/O modules. The Model

8110 Main Chassis houses up to six slot sets of I/O modules and the Model 8120E

Enhanced Performance Main Chassis houses up to five sets of I/O modules. The I/O

modules in a chassis are connected via I/O expansion bus ports that are triplicated RS

485 bi-directional communication ports.

• An Expansion Chassis (chassis 2 to 15) houses up to eight slot sets of I/O modules and

HART™ Interface Modules. The Expansion Chassis connects to the Main Chassis by

means of a triplicated RS-485 bi-directional communication port. Generally, the last

Expansion Chassis must be located no more than 100 feet (30 meters) from the Main

Chassis or an RXM Chassis.

• An RXM Chassis houses a Primary or Remote RXM Module set and six slot sets of I/O

modules. An RXM Chassis enables a system to extend to remote locations up to 7.5

miles (12 kilometers) from the Main Chassis, using SRXM modules.

Fault Tolerance

Fault tolerance, the most important capability of the Tricon controller, is the ability to detect

transient and steady-state error conditions and to take appropriate corrective action online.

With fault tolerance, there is an increase in safety and an increase in the availability of the

controller and the process being controlled.

The Tricon controller provides fault tolerance through Triple Modular Redundant (TMR)

architecture. The controller consists of three identical system channels, except for the Power

Modules which are dual-redundant. Each channel independently executes the control program

(also referred to as the TriStation application) in parallel with the other two channels. Hardware

voting mechanisms qualify and verify all digital inputs and outputs from the field; analog

inputs are subject to a mid-value selection process.

Because each channel is isolated from the others, no single-point failure in any channel can pass

to another. If a hardware failure occurs in one channel, the faulty channel is overridden by the

other channels. Repairs consist of removing and replacing the failed module in the faulty

channel while the Tricon controller is online and without process interruption. The controller

then reconfigures itself to full TMR operation.

Extensive diagnostics on each channel, module, and functional circuit immediately detect and

report operational faults by means of indicators or alarms. The diagnostics also store

information about faults in system variables. If faults are detected, the operator can use the

diagnostic information to modify control actions or direct maintenance procedures.

Because the triplicated system operates as one control system, the Tricon controller can be

programmed with one control program that terminates sensors and actuators at a single wiring

terminal.

Controller Features

The Tricon controller is a state-of-the-art programmable logic and process controller that

provides a high level of system fault tolerance. To ensure the highest possible system integrity

at all times, the Tricon controller includes these features:

• Provides Triple Modular Redundant (TMR) architecture whereby each of three

identical system channels independently executes the control program, and specialized

hardware/software mechanisms “vote” all inputs and outputs.

• Withstands harsh industrial environments.

• Enables field installation and repair to be done at the module level while the controller

remains online. Replacing an I/O module does not disturb field wiring.

• Supports up to 118 I/O modules (analog and digital) and optional communication

modules that interface with Modbus masters and slaves, Foxboro® and Honeywell™

Distributed Control Systems (DCS), other Triconex controllers in Peer-to-Peer

networks, and external host applications on Ethernet networks.

• Provides integral support for remote I/O modules located as far away as 7.5 miles

(12 kilometers) from the Main Chassis, using SRXM modules.

• Executes control programs developed and debugged with TriStation™ 1131

Developer’s Workbench Software or TriStation MSW software.

• Provides intelligence in the input and output modules to reduce the workload of the

Main Processors. Each I/O module has three microprocessors. Input module

microprocessors filter and debounce the inputs and diagnose hardware faults on the

module. Output module microprocessors supply information for the voting of output

data, check loopback data from the output terminal for final validation of the output

state, and diagnose field-wiring problems.

• Provides integral online diagnostics with adaptive-repair capabilities.

• Allows normal maintenance while the Tricon controller is operating, without

disturbing the controlled process.

• Supports transition to a hot-spare I/O module for critical applications where prompt

service may not be possible.