Siemens Safety Systems: Flexible Modular Redundancy (FMR) vs Triple Modular Redundancy (TMR)

Siemens SIMATIC Safety Integrated does not employ rigid Triple Modular Redundancy (TMR / 2oo3 hardware) or Quadruple Modular Redundancy (QMR / 2oo4 hardware), but instead utilizes Flexible Modular Redundancy (FMR). Under FMR, safety integrity (SIL 3 / PL e) and system availability are decoupled: 1oo1D fail-safe hardware achieves SIL 3 safety through internal microcontroller self-testing and channel passivation, while fault tolerance and availability can be selectively scaled to 1oo2D or 2oo3 on a loop-by-loop basis via software configuration. This eliminates the excessive hardware, footprint, and lifecycle costs of mandatory hardware triplication.

Architectural Foundations: FMR vs Rigid TMR and QMR

For decades, safety instrumented systems (SIS) in the oil & gas and chemical sectors relied on rigid hardware voting architectures:

Triple Modular Redundancy (TMR): Employs three identical hardware processors and three parallel I/O channels per loop, executing two-out-of-three (2oo3) hardware voting. Every transmitter and actuator must be tripled to maintain architecture consistency.
Quadruple Modular Redundancy (QMR): Employs four processors configured as dual redundant 1oo2D pairs, executing 2oo4 voting.
Flexible Modular Redundancy (FMR): Developed by Siemens for SIMATIC S7 F-Systems and Safety Integrated. FMR relies on high-frequency internal hardware diagnostics (1oo1D) certified by TÜV to achieve SIL 3 on a single channel, while enabling engineers to configure 1oo1D, 1oo2D, or 2oo3 voting selectively in software per instrument loop.

Decoupling Safety Integrity (SIL 3) from Availability

The core engineering philosophy of Siemens FMR is the formal decoupling of Safety Integrity from Operational Availability:

Safety Integrity (IEC 61508 / IEC 61511): Governed by the Safe Failure Fraction (SFF > 99%) and diagnostic coverage. Siemens fail-safe modules (e.g. SM 326, SM 336, ET 200SP HA F-modules) utilize dual internal microprocessors executing cross-checks and bit-pattern testing. If an internal fault occurs, the module safely passivates the channel without CPU intervention. Thus, SIL 3 is fully certified even with a single sensor and single module (1oo1D).
Operational Availability (Fault Tolerance): Determines whether a component failure causes a plant shutdown. Under FMR, if high availability is required for a specific critical loop, the engineer adds a second redundant module (1oo2D). If one module fails, the partner module maintains process operation without plant trip.

Hardware Scalability: Loop-by-Loop Configuration

Unlike TMR where every I/O point incurs 300% hardware costs regardless of consequence, FMR allows granular customization:

Standard SIL 3 Safety Loops (e.g. Emergency Vents): Configured as single 1oo1D transmitter and fail-safe channel.
High-Availability Critical Loops (e.g. Main Gas Feed): Configured as dual redundant transmitters (1oo2D) or triple transmitters (2oo3) evaluated inside CFC using the F_2oo3 or Safety Matrix block.
Controller Redundancy: An AS 410-5H fault-tolerant pair executes safety logic redundantly. If one half-CPU stops, the partner CPU continues executing safety programs bumplessly.

Economic and Engineering Advantages of FMR over TMR

When presenting FMR to clients and engineering procurement contractors:

Capital Expenditure (CAPEX): FMR reduces I/O module count, cabinet footprint, and field cabling by 30% to 50% compared to rigid TMR architectures.
Unified Architecture: Siemens FMR eliminates separate third-party safety gateways. The S7-400FH / CPU 410-5H executes both standard basic process control system (BPCS) logic and safety instrumented functions (SIF) within the same controller, utilizing certified PROFIsafe protocol over standard Industrial Ethernet.
Lifecycle Maintenance (OPEX): Spare part inventory is unified between BPCS and SIS, reducing long-term stocking costs.

Architectural Comparison: FMR vs TMR vs QMR

The table below contrasts the safety architectures across operational criteria:

| Architectural Parameter | Siemens Flexible Modular Redundancy (FMR) | Triple Modular Redundancy (TMR) | Quadruple Modular Redundancy (QMR) |
|---|---|---|---|---|
| Safety Concept | Certified 1oo1D diagnostics + PROFIsafe | Hardware 2oo3 voting | Dual 1oo2D hardware voting |
| SIL 3 on Single Channel| Yes (Certified by TÜV) | No (Requires 3 channels) | No (Requires 4 channels) |
| Scalability | Granular (1oo1D, 1oo2D, 2oo3 per loop) | Rigid 3-channel multiplier | Rigid 4-channel multiplier |
| Hardware Footprint | Low (Optimized cabinet space) | Very High (3x I/O & wiring) | Highest (4x I/O & wiring) |
| BPCS Integration | Fully integrated (Common PCS 7 OS/ES) | Separate dedicated SIS gateway | Separate dedicated SIS gateway |
| Engineering Tool | SIMATIC CFC / Safety Matrix | Proprietary TriStation tool | Proprietary Workbench |

Verification

Verify safety loop configuration and diagnostic coverage:

Open SIMATIC Safety Matrix or CFC; verify the safety runtime group compiles with valid safety CRC checksum.
In STEP 7 HW Config, verify the fail-safe module F-Parameters confirm SIL 3 capability.
Disconnect one sensor channel on a redundant 1oo2D safety loop; verify the channel passivates while the controller continues normal operation without triggering a spurious trip.
Confirm that the WinCC OS generates a maintenance alarm indicating channel passivation without interrupting production.

Limitations and Operational Precautions

Observe the following safeguards when engineering fail-safe systems:

Proof Test Interval Adherence: Adhere to manufacturer proof test intervals specified in the safety manual to maintain target PFDavg / PFH figures over the plant lifecycle.
Separation of Safety and Standard Logic: Maintain strict logical separation between BPCS logic and safety interlocks inside CFC safety runtime groups to prevent uncertified code modifications.
Commercial Procurement Guardrail: Sizing safety hardware requires specifying exact fail-safe MLFBs (e.g. 6ES7336-4GE00-0AB0) and verifying safety engineering software licenses (S7 F-Systems Engineering 6ES7833-1CC02-0YA5).

Engineer FAQ

Does Siemens FMR satisfy the same safety standards as Triconex TMR?

Yes. Siemens FMR is certified by TÜV up to SIL 3 according to IEC 61508 / IEC 61511 and Cat. 4 / PL e according to ISO 13849, matching the safety integrity rating of rigid TMR systems.

Can Siemens FMR implement 2oo3 voting if a client specification requires it?

Yes. In SIMATIC CFC or Safety Matrix, three independent transmitter inputs can be routed into an F_2oo3 voting block to provide identical 2oo3 functional voting while maintaining FMR flexibility elsewhere.

Why is FMR more cost effective than TMR?

FMR avoids mandatory triplication. Loops that do not require high availability can be deployed with single SIL 3 channels, saving 30-50% in hardware, wiring, cabinet space, and maintenance costs.