Triconex is a Schneider Electric brand that supplies products, systems, and services for safety, critical control, and turbo-machinery applications. 

Triconex also use its name for its hardware devices that use its TriStation application software. Triconex products are based on patented Triple modular redundancy (TMR) industrial safety-shutdown technology. 

Today, Triconex TMR products operate globally in more than 11,500 installations.

System

The Triconex system is based on the TMR patented technology that supports up to Safety Integrity Level 3 (SIL 3) and is usually used as a safety rather than a control system

Fault tolerance in the Tricon is achieved by means of a Triple-Modular Redundant (TMR) architecture. The Tricon provides error-free, uninterrupted control in the presence of either hard failures of components, or transient faults from internal or external sources. 

The Tricon is designed with a fully triplicated architecture throughout, from the input modules through the Main Processors to the output modules. Every I/O module houses the circuitry for three independent legs.

 Each leg on the input modules reads the process data and passes that information to its respective Main Processor. The three Main Processors communicate with each other using a proprietary high-speed bus system called the TriBus. Once per scan,

 the three Main Processors synchronize and communicate with their two neighbors over the TriBus. The Tricon votes digital input data, compares output data, and sends copies of analog input data to each Main Processor. 

The Main Processors execute the user written application and send outputs generated by the application to the output modules. In addition to voting the input data, the TriBus votes the output data. 

This is done on the output modules as close to the field as possible to detect and compensate for any errors between the Tricon voting and the final output driven to the field.

Related product model

3501E/T 115Vac/Vdc Digital Input

3502E 48Vac/Vdc Digital Input

3503E 24Vac/Vdc Digital Input

3504E 24/48Vdc Digital Input

3505E 24Vdc Digital Input

3564 24Vdc Digital Input (simplex)

3511 Pulse Input

3515 Pulse Totalizer

3601E/T 115Vac Digital Output

3603B/E/T 120Vdc Digital Output

3604E 24Vdc Digital Output

3607E 48Vdc Digital Output

3611E 115Vac Digital Output

3617E 48Vdc Supervised Digital Output

3623E/T 120Vdc Digital Output

3624 24Vdc Supervised Digital Output

3625 24Vdc Digital Output

3664 24Vdc Digital Output (Dual)

3674 24Vdc Digital Output (Dual)

3636R/T Relay Output

3700A 0-5Vdc Analogue Input

3701 0-10Vdc Analogue Input

3703E 0-5, 0-10Vdc Analogue Input

3704E 0-5, 0-10Vdc (high density) Analogue Input

3706A Thermocouple Analogue Input

3708E Thermocouple Analogue Input

3720 0-5Vdc Analogue Input

3721 0 to 5 or –5 to +5Vdc Analogue Input

3805E/H 4-20mA Analogue Output

3806E 4-20mA and 20-320mA Analogue Output

3807 -60 to +60mA Bipolar Analogue Output

2770H Analog Input Interface Module

2870H Analog Output Interface Module

APPLICATIONS

• Emergency Shutdown (ESD)

• Burner Management Systems (BMS)

• Fire and Gas Systems (F&G)

• High Integrity Pressure Protection

systems (HIPPS)

• Turbomachinery Controls (TMC)

•Critical Control

OPERATING PRINCIPALS

• Fault Tolerant

• Fail Safe—De-energise to trip

• Energise to trip

COMMUNICATIONS

• Peer to Peer

• OPC DA and A&E (embedded server)

• Modbus TCP/IP Master and Slave

• Modbus Serial Master and Slave

• Triconex System Access Application

(TSAA)

• Achilles Level 1 Certified

CERTIFICATION

• IEC 61508

• DIN V 1925

• DIN V VDE 0801

• EN 54

• NFPA 72

• DIN V VDE 0116

• NFPA 8501

• NFPA 8502

• EMC Directive 89/336/EEC

• ATEX 94/9/EC

• Canadian Standards Association (CSA)

• Factory Mutual Research (FM)

• G3 Corrosion level

OPERATING CONDITIONS

• Operating Temperature:32° to 140°F (0 to 60°C) ambient

• Storage Temperature: -40° to 167°F (-40°C to 75°C)

• Relative Humidity:5% to 95% non-condensing

Hardware

The Triconex system usually consists of the following typical modules:[2]

Main Processor modules (triple).Communication module(s) .Input and output modules: can be analog and/or digital and work singularly or in hot-spare (standby).

Power supply modules (redundant).Backplane(s) (chassis) that can hold the previous modules.System cabinet(s): can compact one or more chassis in one cabinet.

Marshalling cabinets to adapt and standardize interface connections between the field instruments and the Triconex system cabinets.

Human machine interface (HMI) to monitor the events.Engineering workstation (EWS) for programming. monitoring, troubleshooting, and updating.

Software

The Triconex main processors can communicate with the so-called TriStation 1131 application software to download, update and/or monitor programs.[3] These programs are either written in:

Function Block Diagram language,Ladder diagram language, orStructured text (Pascal like) Language.Cause and Effect Matrix Programmable Language (CEMPLE).

(Function Block Diagram, Ladder diagram and Structured Text are defined in IEC1131-3)

customer case

In December 2017, it was reported that the safety systems of an unidentified power station, 

believed to be in Saudi Arabia were compromised when the Triconex industrial safety technology made by Schneider Electric SE was targeted in what is believed to have been a state sponsored attack.

 The computer security company Symantec claimed that the malware, known as "Triton", exploited a vulnerability in computers running the Microsoft Windows operating system.[4]

Tricon Safety Instrumented System (SIL3)

Invensys is the only automation company with the experience and track record in safety and critical control as demonstrated by our 27 years of experience in safety systems, in excess of 8,000 installed systems, 

the only approved Nuclear Regulatory Commission Commercial off-the-shelf controller for Nuclear 1E applications, large number of TÜV certified Functional Safety Experts and Engineers, deployed world wide, and patented Triple Modular Redundant (TMR) technology.

A powerful, scalable design with assurance of continuous operation, the Tricon system complies with international safety standards such as IEC61508 and fulfils the requirements for applications such as Emergency Shutdown (ESD),

 Fire and Gas Protection (F&G), Burner Management (BMS), High Integrity Pressure Protection (HIPPS) and Turbomachinery Control (TMC). 

The redundant high availability architecture provides a flexible, robust, reliable and powerful solution that is ideal for clients looking to achieve environmental and safety excellence.

The Tricon system is a must for clients who need to maximize the safety and performance of their assets. 

If you are challenged with reducing investment and lifecycle costs, meeting new safety standards, combating tough competitive pressure in your markets as well as the welfare of your employees and the environment, then the Tricon system is designed for you.

KEY CAPABILITIES•

 TÜV Certified up to SIL3 applications in accordance with International standard IEC61508 •

 Easily integrated with all major Distributed Control Systems •

On-line module replacement ensures plant availability by hot-swapping of modules •

Works with both centralized and distributed applications •

Comprehensive family of I/O modules •

HART protocol pass through to Asset Management Systems •

Fast program cycle time for TMC applications •

Expertise available from our TÜV certified Functional Safety Experts and Engineers •

Certified for use in non-incendive applications 

TRICONEX TRIPLE MODULAR REDUNDANCY 

Tricon operation is based on the principle of safety and high plant availability, which identifies and compensates for failed control system elements and allows on line replacement while continuing its assigned task without interrupting the controlled process. 

Fault Tolerance is achieved through TMR technology. TMR employs three isolated, parallel control systems and extensive diagnostics integrated into one system. 

The Tricon system uses two-out-of-three (2oo3) voting to provide high integrity, error-free, uninterrupted process operation with no single point of failure. Setting up applications is simplified with the Tricon, 

because the TMR system operates as a single control system from the user’s point of view. 

The extensive diagnostics are inherent and transparent to the programmer. Use of the Tricon continues to expand into new industries and applications as customers require increased system safety and/or high availability. Today, 

Invensys has delivered and installed Triconex safety system solutions in over 70 countries, providing increased safety and high process uptime.

BENEFITS •

 Maximizing process/plant uptime, productivity and yield •

Increased reliability and availability, performance and profitability •

Lowers investment and lifecycle costs • Complies with International safety standards •

Meets safety targets • Mitigates environmental impact •

Assists you in avoiding penalties or fines for non-compliance •

Enable you to achieve competitive advantage in your markets

Triple modular redundancy

In the field of computer science, triple module redundancy (sometimes also referred to as three-mode redundancy) [1] (TMR) is a fault-tolerant form of N-module redundancy. 

In this redundancy, three systems perform one process, and the result is processed by a majority voting system to generate an output. If any one of the three systems malfunctions, the other two systems can correct and mask the fault.

The TMR concept can be applied to various forms of redundancy, such as software redundancy in the N-version programming form, and is commonly found in fault-tolerant computer systems.

A safety instrumented system is often the last line of defense before a hazardous event occurs at a plant or operation. A safety instrumented system is composed of logic solvers, sensors, and final elements. 

These systems detect “out of control” process conditions that could lead to an unwanted incident, and then automatically return the process to a safe state. 

But it’s important to remember that safety instrumented systems (SIS) are different from process control systems.

Safety systems are applied across many industries. Emergency shutdown systems and fire and gas detection are among the most common applications. But there are other areas where a SIS can help protect workers and operations such as:

Burner managementTurbomachinery control and protectionHigh integrity pressure protection

How does a safety instrumented system work?

Over the past 40 years, EcoStruxure Triconex Safety and Critical Control has become synonymous with safety and critical control. Our SIS uses a high availability, highly fault tolerant triple modular redundant (TMR) architecture. 

Through the decades, it has delivered over 1 billion safe operating hours without a known dangerous failure on demand. Incorporating a TÜV Rheinland-certified SIS into a plant will lower operational risk and help enable continuous safe operation.

A SIS considers the integrity of a safety loop (known as a safety instrumented function, or SIF), and consists of three major elements:

Sensors – look for the initiating event that could lead to an eventLogic 

solvers – decide how to deal with the hazard and then signal the final element(s)

Final elements – return the process, or processes, to a safe state

Once a risk has been assessed, a SIS may implement one or more safety instrumented functions to address the specific hazardous event and help reduce the risk to an acceptable level.

Why do I need a safety instrumented system?

A safety instrumented system reduces the consequence of hazardous events to an acceptable level. This helps businesses reach their true potential by protecting their people, production, and the environment. 

For this to work properly, all EcoStruxure Triconex Safety Instrumented Systems follow IEC 61508 functional safety standards. 

This specific standard addresses functional safety in industrial process industries and covers the design, implementation, and management requirements for SIS from cradle to grave.

Meeting stringent international safety standards into EcoStruxure Triconex SIS is a must-have when it comes to best practices in process safety management.

What is a safety PLC?

A standard programmable logic controller (PLC) automates specific processes. When it comes to hazards or hazardous events, a standard PLC will not know there is a problem until it needs to take an action. 

Then the problem becomes self-evident. This is especially important for safety applications that often remain in the same operating state for long periods of time.

 Such applications only need to activate on demand if, or when, a hazardous situation arises (often referred to as “low demand”).

For example, an emergency shutdown system is usually normally energized, holds the outputs on for long periods of time, and will de-energize to trip and take the process to a safe state.

 If the system itself fails, then it will fail safe. So, a safety PLC operates with very specific and quantifiable failure modes. Essentially, a safety PLC is designed to work so that you can expect the equipment to work when it is needed to work.

A safety PLC is designed so that when a demand occurs, they do so with a level of certainty and within a specific probability that corresponds to safety integrity levels. 

This is achieved in a variety of ways, including incorporation of a high degree of internal diagnostics and automatic testing, hardware backup, and redundancy. As well as voting of independent signals within the PLC.

When it comes to the destiny and health of employees, plant operations, and the environment, it’s important to incorporate such safety instrumented systems – especially ones that are tested and verified by recognized certification bodies such as TÜV.

What is safety integrity level?

Safety integrity levels (SIL) define the tolerable failure rate of a specific safety function. The higher the SIL level, the lower the probability of a failure on demand. 

The SIL also defines that, in the event of a failure, to what extent can a process fail safely. Safety integrity levels range from 1 to 4, one being the lowest, 4 being the highest. 

These levels indicate the probability of failure on demand for a particular safety function.

A safety integrity level defines the amount of safety risk needed to mitigate a specific hazard. The level assignment is based on the amount of risk reduction that is necessary to reduce risk at an acceptable level.

EcoStruxure Triconex safety instrumented systems, like the safety PLCs and the Tricon CX “one versatile system,” have been certified by TÜV Rheinland to safety integrity level 3 so can be used for SIL 1, 2, and 3. 

This third-party verification uses international standards such as IEC 61508 and is put through rigorous test procedures.

Implementing a safety instrumented system in your operation

EcoStruxure Triconex safety instrumented systems bring superior uptime and high productivity to an operation. A SIS is an independent layer of protection that reduces the likelihood of an incident or event. 

That way, businesses can focus on driving efficiency and remaining competitive. Learn more about how our dedicated safety experts can assess, design, and implement trusted safety standards into your operations.