Safety Manager Safety Manual - Tuv-fs.com

2 – Architectural principle and standards of Safety Manager
The DMR architecture is realized with a non-redundant Controller. A
non-redundant architecture contains only one QPP (see Figure 2 on page 10),
which contains a redundant processor with 1oo2 voting between the processors
and memory.
Figure 2 Functional diagram: DMR architecture
QPP Control Processor
SD
Watchdog
SMOD
Sensor
xx
yyy
Input
Module
Processor
Processor
Output
Module
Input Interfaces
Output Interfaces
Final Element
In IO configurations, each path is primarily controlled by the Control Processor
and an independent switch (Secondary Means of De-energization, SMOD) which
is controlled by an independent watchdog.
Quadruple Modular Redundant (QMR) architecture
Typical applications of a QMR architecture are:
• process safeguarding applications for which continues operation is essential.
The Quadruple Modular Redundant (QMR) architecture is based on 2oo4D
voting, dual-processor technology in each QPP. This means that it is characterized
by a ultimate level of self diagnostics and fault tolerance.
The QMR architecture is realized with a redundant Controller. This redundant
architecture contains two QPPs (see Figure 3 on page 11), which results in
quadruple redundancy making it dual fault tolerant for safety.
The 2oo4D voting is realized by combining 1oo2 voting of both CPUs and
memory in each QPP, and 1oo2D voting between the two QPPs. Voting takes
place on two levels: on a module level and between the QPPs.
10 Release 131, Issue 4.2