Redundant controllers for Expansion chassis

[Jeremy.Stevens]

I have a customer requirement for redundant controllers using 5 cRIO expansion chassis. In this configuration, loss of one expansion chassis means reduced function, but not shutdown. If one controller stops working, the other will take control. Only one controller will be writing to the expansion chassis at a time, but both will be updating.

Does any one have any experience doing something like this? I'll be setting up two touchscreen computers to run with 5 NI 9149 expansion chassis.

[AndyClegg]

Here is a thread from 2017 about wider issues of using cRIO in safety applications, including a reply from me, that might have some points / links that are relevant to you:

https://forums.ni.com/t5/Real-Time-Measurement-and/cRIO-in-safety-application/td-p/3613203

[Jeremy.Stevens]

Perhaps I skimmed through a little too fast, but this answer only explains the advantages of redundancy. It offers to solutions available through NI. This is my problem. I'm trying to promote NI in Saudi refineries, but their requirement for redundancy is giving me a headache. There seems to be no actual solution. The expansion chassis can only talk to one controller. There is no system that allows two controllers or some level of health checking between two controllers. There is a SIL system of modules available, but they do not apply because this isn't a safety system, this is a control system.

My customer is pushing me to use Triconex controllers which has an option of two controllers in one chassis plus IO modules with a third processor dedicated to monitoring the health of the two controllers. Each are of the two controllers are independently selectable, They have the solution for the application. I was hoping NI had an equal. In all the research that I've been doing and talking to the NI AE's and engineering staff, there is no option of redundancy which surprises me. I've been dealing with NI for a long time now. I have never been failed by their equipment before. There has always been a solution. I've worked for them twice, once off of Bridgepoint in Austin (was there when they broke ground for the new campus off MOPAC) and again after the new facility off MOPAC was open. I am as loyal as it gets for NI and especially cRIO (I was also there when the product line was released and the controller was thrown off of Building B to measure the G forces of a controller falling 7 stories and hitting the ground).

For there to not be an option for redundancy in applications which require a cRIO controller doesn't really make sense. It limits their ability to sell for applications in so many of the industrial applications that are being targeted by things like Class 1 Div. II classification, high vibration resilience and conformal coatings for corrosive atmosphere applications. Single point of failure becomes a real issue in places where these factors apply. Gas refineries, high demand processing plants and other applications such as these will, generally, require some level of redundancy regardless of the ruggedness of the equipment.

I guess, to sum it all up, it's disappointing to find out that, while NI acknowledges the need for redundancy, they do nothing to make it accessible through their hardware which should be designed for applications where this would be required.

[MarkCG]

I don't think NI is interested in very seriously taking on industrial market and competing with the big PLC manufacturers. Sure compactRIO is great for a few niche applications where you can put the FPGA to good use, or take advantage of the Linux OS for some function that traditional PLC can't do, but overall I think you will have a very hard time trying to promote NI products for this segment. Test & Measurement is what the focus seems to be now.

[AndyClegg]

Yes it is a shame that redunancy functionality isn't a built-in feature of at least one cRIO and its firmware. When we looked at it previously it was apparent that it could be built programatically, but developing bespoke redundancy is never going to be attractive, especially when compared to PLCs where it is core.

However, using the tightly integrated FPGA to implement watchdog / independent safety functionality is very attractive where that is sufficient.