## 4 Creating a Dual Architecture from sPLCs
### The Safety Integrity against Systematic Failures  
General assumptions for achieving safety integrity against systematic failures of dual architecture were described in Section 3.2. This section focuses more on the problems associated with the created dual architecture based on sPLC. It solves two problems, namely synchronization and the comparison of channels (in summary, it can be said that this is a solution to the problem of controlling a dual architecture). These problems are very closely related to each other. Comparison would not be possible without synchronization. Conversely, synchronization depends on the method of comparison. These problems can be solved by two approaches. The first consists of integrating the safety function with the architecture, and the second consist of the separation of these two parts. The first method will be more advantageous for the implementation of program code for one safety function. However, if we want to use such a procedure universally, we must design the architecture control independently of the implemented safety functions. The authors strive to propose a general approach, so we will continue to deal with the second option. In the simplest case, the comparison would take place only at the level of outputs. This would not place high demands on synchronization accuracy, but it is the weakest option in terms of fault detection because there may be a fault in one of the channels, but the changed internal state may not be reflected immediately at the output. Ultimately, this will extend the fault detection time. This will negatively affect the dangerous failure rate of the dual architecture (this follows from relation (4)). From the point of view of the fast detection of each failure, the comparison of the internal states of channels A and B (not only the comparison of outputs) is ideal. This represents the comparison on the channel data bus. However, such a comparison would require accurate external synchronization, which would be very difficult to implement. Comparisons in each bus cycle would not be possible for today's computer systems, which are also used in PLCs. Therefore, some compromises need to be reached in this case, for example, comparing data hash functions (CRC totals) at regular intervals. However, this solution cannot be used in the case of dual architecture based on sPLC because the sPLC is  
\begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline  & \multicolumn{6}{c}{**SIL**} \\ \cline{2-10}  & \multicolumn{2}{c}{**1**} & \multicolumn{2}{c}{**2**} & \multicolumn{2}{c}{**3**} & \multicolumn{2}{c}{**4**} \\ \hline \multirow{2}{*}{\(\lambda\) [h\({}^{-1}\)]} & min & max & min & max & min & max & min & max \\ \cline{2-10}  & 1\(\cdot\)10\({}^{-6}\) & 1\(\cdot\)10\({}^{-5}\) &  
available to the user only at the application level and cannot be synchronized externally at the bus level because its buses cannot be accessed, changes cannot be made in its firmware, and so on. Therefore, the authors have proposed a comparison approach that is applicable at the application level and, at the same time, is sufficiently detailed (captures the internal states of the sPLC, not just its outputs). This approach consists of comparing the states of the performed function in the application program. It is assumed that the safety function always has an identifiable state. This can be achieved by modelling the function using a state-based model. A typical representative of such a model is the state diagram. The model based on the state diagram can be rewritten practically in any language, or software tools can be used to generate an application program in the selected programming language or directly for the selected sPLC. If the proposed procedure is combined with a suitably designed synchronization method, then channels A and B can be implemented not only from the same sPLCs but also using sPLCs from different manufacturers. Channel synchronization and comparison will form the control strategy for dual architecture.