SHARED VOTING Sample Clauses

SHARED VOTING. Software Implemented Fault Tolerance (SIFT) and hardware voting are utilized by the ▇▇▇▇ V TMR control system. At the beginning of each computing time frame, each controller independently reads its sensors and exchanges this data with the data from the other two controllers. The median value of each analog input is calculated in each controller and then used as the resultant control parameter for that controller. Diagnostic algorithms monitor a predefined deadband for each analog input to each controller, and if one of the analog inputs deviates from this deadband, a diagnostic alarm is initiated to advise maintenance personnel. Contact inputs are voted in a similar manner. Each contact input connects to a single terminal point and is parallel wired to three contact input cards. Each card optically isolates the 125 or 24 V dc input, and then a dedicated 80196 processor in each card time stamps the input to within 1 ms resolution. These signals are then transmitted to the [R], [S], and [T] controllers for voting and execution of the application software. This technique eliminates any single point failure in the software voting system. Redundant contact inputs for certain functions such as low lube oil pressure are connected to three separate terminal points and then individually voted. With this SIFT technique, multiple failures of contact or analog inputs can be accepted by the control system without causing an erroneous trip command from any of the three controllers as long as the failures are not from the same circuit. Another form of voting is accomplished through hardware voting of analog outputs. Three coil servos on the valve actuators are separately driven from each controller, and the position feedback is provided by three LVDTs. The normal position of each valve is the average of the three commands from [R], [S], and [T]. The resultant averaging circuit has sufficient gain to override a gross failure of any controller, such as a controller output being driven to saturation. Diagnostics monitor the servo coil currents and the D/A converters in addition to the LVDTs.