Fault tolerant control systems can identify and compensate for faults in control system components, and allow for repair of faulty components while continuing to complete specified tasks without interrupting process control. That is, the Tricon control system can repair system faults without affecting normal production. It has the following characteristics: high safety -/depends on the TMR hardware structure, self diagnosis and online maintenance high availability - eliminates false parking and high maintenance - replaces faulty cards online without the need for parking, Maintenance operations do not require training 1. No single point of failure Adopting isolation technology: The triple circuits inside each channel of Douding are independent; Three redundant main processors; Each component box is equipped with two redundant power supplies (redundant power supplies with evenly distributed loads); There are no shared components within the I/O component; Complete isolation between channels (to avoid problems caused by grounding of on-site instruments); Isolation between the system and the site (to avoid the failure of the whole system due to the strong electric breakdown of a single module); 2. Online maintenance The faulty hardware can be replaced online, reflecting the high availability of the Tricon system. 3. Online diagnosis (self diagnosis) -Seize potential hazards before they occur in the system. The self diagnosis function is built into Tricon's hardware and does not require users to write application programs. It is the difference between long-term reliability and availability and short-term reliability and availability, and also the technical advantage of Tricon TMR system compared to other PLCs.