## 4 Creating a Dual Architecture from sPLCs
### The Safety Integrity against Systematic Failures
#### 4.2.1 Model of the Dual Architecture Control System
After a successful recovery sequence, the comparator goes to the _Setting_ state, where it sets the variables _diag_code_ to the value of 8 and _comp_A_ to the value of _true_. In this state, the comparator waits for the comparison result from comparator B. If this value of the _comp_B_ variable is equal to _true_, the comparator goes into the \"macro state\" _Evaluation_. In the \"macro state\" _Evaluation_, two parallel sub-states are executed, namely the _Change_status_ sub-state and the _Comparison_ sub-state. The _Change_status_ sub-state monitors the execution of the safety function, and when its state changes, the comparator goes into the _Different_states_ state, in which it saves the current state of the safety function in the variable _previous_state_ and sets the _wait_ variable to the value of _true_. If the status  
Figure 5: Comparator state diagram. of the safety function in PLC A equals the status of the safety function in PLC B, then the _Change_status_ sub-state acquires the status _Same_states_, in which the _wait_ variable is reset to the value of _false_, and the value of the status of the safety function from PLC A is continuously stored in variable _status_act_. When entering \"macro state\" _Evaluation_, in the _Comparison_ sub-state, the initialized state is _Wait_, and the variable _diag_code_ is set to the value 3. If the state of the safety function in PLC A and the state of the safety function in PLC B are equal, the comparator goes to the state _Ok_, and the output of the comparator _comp_A_ is set to the value _true_ and _diag_code_ to the value 4. If the status of the safety function in PLC A and the status of the safety function in PLC B are not equal, the comparator goes back to status _Wait_, and _diag_code_ is set to the value of 3. The comparator will remain in this state if the state of the safety function in PLC A and the state of the safety function in PLC B are not equal, but for the longest time, however, up to the allowed discrepancy time set at the _discrepancy_time_ input. If there is a match between the states of the safety function in PLC A and the safety function in PLC B within the allowed discrepancy time, the comparator goes back to the _Ok_ state, and the output of the comparator _comp_A_ is set to the value of _true_ and _diag_code_ to the value of 4. If the allowed discrepancy time expires, then the comparator goes into the _Discrepancy_ state, where the output of the _comp_A_ comparator is set to the value of _false_, the auxiliary variable _in_time_ to the value of _true_, and the _diag_code_ is set to the value of 5. When the comparator reaches the _Discrepancy_ state, the setting of the auxiliary variable _in_time_ to value _true_ leaves the comparator \"macrostate\" _Evaluation_ and transitions into the safe state _Safe_status_, in which the auxiliary variable _in_time_ is reset to _false_. From the \"macro state\" _Evaluation_, the comparator goes into the safe state, _Safe_state_, even in the event of a communication failure between PLC A and PLC B, in which case the _diag_code_ is set to the value 7. Even from the _Recovery_ and _Setting_ states, in the event of a communication failure, the comparator goes into the safe state, _Safe_state_, and _diag_code_ is set to the value of 7. The comparator can still transform into a \"macro state\" _Evaluation_ from the _Ok_ state to the _Error_comp_B_ state with a value of _false_ at the input _comp_B_, and then the variable _comp_A_ is set to the value of _false_, the auxiliary variable _error_comp_B_ to the value of _true_, and _diag_code_ to the value of 6. After setting variable _error_comp_B_ to the value of _true_, the comparator goes into the safe state, _Safe_status_, and the auxiliary variable _error_comp_B_ is reset to the value of _false_. Table 3 shows the input interface, and Table 4 shows the output interface of the comparator shown in Figure 5.