Quadruple Modular Redundant

Technology for Safety Systems

Honeywell’s Quadruple Modular Redundant (QMR) technology with award winning 2oo4D architecture sets the standard for
how Safety Instrumented Systems should be designed.

This unique QMR technology, based on a high level of self- Honeywell’s QMR technology features:
testing and diagnostics, has proven that QMR is the best • IEC 61508 / IEC61511 compliant
available technology for Safety Instrumented Systems (SIS). It
• Fully Integrated with Experion PKS and the C300
has an optimal safety integrity level (SIL 3) for the process controller
industries with a safety availability of more than 99.99%. It also
• Highly scalable system
offers 20% higher availability than what is offered for most other
safety systems. • One platform for
all safety
applications
Experts agree that QMR, with its multi-fault-tolerant capabilities,
is the future towards which safety systems should be heading. • High safety
integrity
QMR offers a basic SIL 3 architecture, irrespective of the chosen
configuration. Unrestricted runtime is no longer an issue, whether • High process
in dual or single channel operation. availability

• Choice of today’s
The importance of diagnostics has gained full recognition; not experts SIL 3
just by end-users but also by official global approval bodies. single
configuration
Whereas other vendors are still trying to take their first steps in
this area, Honeywell has been applying self-testing and • Unrestricted
diagnostics technology for over 20 years. runtime

• Lower
Online self-testing and diagnostics have the advantage that the maintenance costs
proof test interval, as required by IEC-61508 and IEC61511, can Design
be extended to more than 15 years, depending on the required
SIL level. The extended proof test interval will provide far more The QMR technology has two processors running in parallel
process uptime, leading to more profit and lower operational and verifying each other. The processors are completely verified and
maintenance costs. tested for correct functioning, thus redundancy is established on
one module. The results are also communicated with the second
QPP module, establishing true quadruple modular redundancy.
This has the advantage that it does not result in a ‘heavy’ and
complex hardware system, which reduces the footprint and
lowers the installed costs.

QMR perfectly serves the two most important purposes of a

Safety Instrumented System (SIS): the safety integrity and the
availability of the process.
QMR Technology for Safety Systems 2

Safety Integrity Reliability

Safety integrity is a measure of the reliability of the safety The QMR safety system uses software for self testing and has a
system. The higher the safety integrity, the higher the probability high level of diagnostics, all the way from the field up to the
that the safety PLC will function properly. The quad modules are processors. This makes the QMR Safety System far more
designed for optimal safety integrity relevant to the process reliable than any other system not using extensive self-testing
industries served and are suitable for applications up to SIL 3, and diagnostics, including 2oo3 or 2oo4 systems.
even when applied in a single configuration.
Lower Operational Costs
Process Availability
Besides being capable of performing internal system self-testing,
The safety system should be highly reliable in that it should not the QMR system is also capable of testing and diagnosing field
cause an undesired process shutdown. The QMR modules can loops. For both inputs and outputs, loop monitoring can be used.
be configured with redundancy, allowing multiple faults without As soon as a short circuit or an open loop is discovered, an alarm
any interruption of the process. will be generated. This automatic approach of testing and
diagnosis reduces overall costs for maintenance and proof
Scalable System testing.

The safety system with QMR technology is highly scalable. Not 2oo4D: Two-Fault Tolerant
only can the QPP module be configured with redundancy, the I/O Multiple Faults Tolerant
section and I/O buses are able to be similarly configured.
The QMR system with diagnostics is capable of dealing with
multiple faults, due to its ability to find and isolate faults anywhere
Online Self-Testing and Diagnostics
in the system. As long as faults are not in the same section of the
Proven in use system, it is possible to have several faults without losing the
safety function. Diagnostics combined with the 2oo4D technology
The QMR Safety System has evolved from the DMR-1oo2D makes the system capable of discovering and isolating even
system. This system has been using a high level of self-testing more faults before a nuisance trip will occur.
and diagnostics over 15 years. During this period, it has proven
its reliability and ability to boost availability. Safety Integrity: Two Faults

Software Checks Hardware The QMR-based safety system is the first system that uses a
truly two fault- tolerant architecture. It is capable of having two
Contrary to hardware, software will never degrade. Therefore, processor faults while retaining its ability to perform its safety
when the hardware is tested via software, faults can be function up to SIL3.
discovered before a spurious trip will ever take place.
The following minimum failure scenarios are required before a
safety function will be lost:

• A dangerous undetected failure of at least three

microprocessors

• A detected failure on one module (which results in isolation

of the module), in combination with a dangerous undetected
failure on both microprocessors of the remaining board.
QMR Technology for Safety Systems 3

With these extremely remote and practically non-conceivable average cycle time has been decreased with another 30% -40%
failure probabilities, the QMR system can operate as a single allowing fast processing with average cycle times well below the
channel safety system at SIL 3 integrity with no limitation. 100 milliseconds. This fast processing is accomplished without
additional configuration and without affecting the SIL.
Process Availability Applications with high I/O volumes (such as fire and gas) can
also be handled with Safety Manager while keeping the cycle
With regard to system availability, the 2oo4D concept is entirely time far below limits defined by the application.
one-fault tolerant. The following minimum failure scenarios are
required before a spurious process trip will be initiated: The new QPP-0002 can be used along with the existing QPP-
0001.
• A safe undetected failure on one module (one
microprocessor) in combination with a detected failure on the Comprehensive Safety Services
other module
At Honeywell, our services go beyond just supplying hardware
• A safe undetected failure of at least two microprocessors and software. Honeywell has established a unique safety
knowledge community located in expertise centers around the
• A detected failure on both modules.
world. More than 250 safety engineers employed in these centers
Common Cause Failure offer a wide range of Consulting, Project, and Lifecycle Support
Services. With more than 30 years of safety management
Because the QMR system consists of two processor packs, each experience solving complex design safety issues and offering
containing two microprocessors, which operate completely unparalleled safety solutions, Honeywell is indeed your ideal
independently from each other, a nuisance trip due to common process safety partner.
cause is almost negligible.
Key engineers around the world are TÜV Certified Functional
Online Swap-Over and Repair Safety Experts (CFSE), demonstrating the extensive knowledge
and expertise that is available for your QMR projects and
With the QMR Safety System, replacing faulty modules is easy applications. With this knowledge, Honeywell can assist you with
and can be done online without the need for hot standby or consultancy services, preparation of software requirement
intermediate modules, and without interrupting the safeguarded specifications, system requirement specifications, SIL validation,
process. Because the two channels are running independently, it and much more.
is possible to work on one channel without reducing the safety
functionality of the system at all. The self learning principles in It is not just the QMR Safety System that complies with IEC
Safety Manager guarantee that application and system software 61508 and IEC61511. The complete development, engineering
is automatically synchronized without the need of a manual and manufacturing also complies with the IEC 61508 and
download to the system. IEC61511 standard. Honeywell was the first safety organization
in the world to be IEC 61508 certified as an organization. The
Moreover, a full download can be completed online without Safety Manager was the first SIS to receive the IEC61511
interrupting the process and reducing the safety integrity of the certification. The Safety Manager System therefore is a truly
system. Before changing to the new application a check will be integrated SIL 3 compliant system.
performed and values will be copied to ensure safe and correct
continuous operation. With more than 5000 QMR-based systems installed and
operating, Honeywell has become the market leader for
Performance diagnostic-based safety systems.

With the new QPP-0002, another major improvement with

respect to cycle time and I/O size has been established: the
QMR Technology for Safety Systems 4

More Information
For more information on Honeywell’s Safety
Manager, visit our website
www.honeywell.com/ps, or contact your
Honeywell account manager.

Automation & Control Solutions

Process Solutions
Honeywell
2500 W. Union Hills Dr.
Phoenix, AZ 85027
Tel: +1-602-313-6665 or 877-466-3993 PN-08-21-ENG
May 2008
www.honeywell.com/ps © 2008 Honeywell International Inc.