## 4 Creating a Dual Architecture from sPLCs
### The Safety Integrity against Systematic Failures
#### 4.2.1 Model of the Dual Architecture Control System  
Dual architecture control must address:  
* Synchronization of units A and B;
* Comparison of internal states of units A and B;
* Negation of the fault after detecting a mismatch between units A and B. The fault detection and negation mechanism must place the system in a safe state; in our case, the safe state will be defined as logical zero at the system's outputs. As already indicated above, the control of the dual architecture would be most easily implemented using an external element cooperating with both sPLCs. However, such a solution would be unsatisfactory from the point of view of safety since the failure of this element could cause a dangerous failure of the dual architecture (it could induce the same failure in both channels; such a failure would be undetectable utilizing channel comparison). For this reason, the control of the architecture must be two-channel, and in case of failure of one channel, it must also terminate the operation of the system in a safe state. The proposed solution consists of two parts. The first part represents the template for the safety function. The template ensures cooperation with the architecture control algorithm and is shown in Figure 4. The safety function model must be inserted into the red-framed state marked as \"Logic\" (the safety function model is realized by a state diagram; the \"Logic\" state represents a macro state). The \"Do not execute\" status is used to synchronize the operation of the safety functionsin both units. In this state, the safety function awaits a command from the comparator. After matching the second unit, the safety function continues in the \"Logic\" macro state. If there is no match, the dual architecture goes into the safe state \"Safe_state\". The mentioned template is used in both sPLCs, forming a dual architecture. The second part cooperates with the first part. It is designed to exclude external synchronization, which would represent a potential source of errors. The principle is that after state changes in one unit, this state is compared with the state in the other unit. The system is waiting for a predefined time for the states to become identical. If the states of the units do not become identical within a predefined time, the architecture goes into the safe state (\"Safe_state\" in Figure 4). If the states of the units become identical within the specified time, the architecture evaluates the next potential transition between states. This method of evaluation is implemented in both units, and its detailed operation is described by the state diagram shown in Figure 5. Unit A (resp. B) compares the status of the safety function with the status in unit B (resp. A). The results of the comparison are exchanged between the units, and for the continuation of the operation of unit A (B), a positive result of the comparison of unit A (B) and unit B (A) is necessary. This ensures a two-channel unit comparison and a two-channel control of the mismatch tolerance time of channels A and B. This time is important and must not be exceeded because the response time of the system depends on it. Figure 4: Template for the safety function (H means a marker for initial state after transition to back to state _Execute_.). The meaning of the states in the status diagram of the comparator is as follows (Figure 5). State _Safe_state_ is the safe state in which the comparator lies after the PLC is restarted. It is the initialization state. The _comp_A_ variable is set to _false_ and the _diag_code_ variable to 0. The _Recovery_ status is used to restore the functionality of the comparator after a PLC restart or after a fault by a sequence of logical values _true_ and _false_ at the recovery input within three seconds. If the _true_ value is not followed by a _false_ value within three seconds, the comparator goes into the _Missing_ state. Then, the sequence of signals at the _recovery_ input must be repeated.