Module Type:Triple Modular Redundant (TMR) Controller / Processor Module (one channel of a three-channel system).
Architecture: Functions as one node in a 3-channel fault-tolerant controller. Three T8442 modules (or equivalents) operate in parallel, synchronously executing the same application logic.
Processing Core: Incorporates a high-performance microprocessor, often with built-in floating-point capabilities, to execute complex safety logic and regulatory control algorithms with deterministic scan times.
Memory: Contains significant onboard RAM and Flash memory for the application program, operating system, and data. Memory is typically error-correcting code (ECC) protected.
Synchronization: Utilizes a high-speed, dedicated synchronization bus to maintain microsecond-level synchronization with the other two controller modules in the TMR set, ensuring all three channels process data identically.
Voting: Participates in continuous 2-out-of-3 (2oo3) hardware and software voting on inputs, intermediate data, and final outputs with the other two channels to detect and mask failures.
Communication: Integrates with the Trusted backplane to communicate with TMR I/O modules (like the T8314, T8293) and communication modules (like the T8151B). Supports peer-to-peer communication with other Trusted systems.
Diagnostics: Features comprehensive, continuous built-in self-test (BIST) routines that check the processor, memory, and internal buses. Faults are reported to the system’s diagnostic supervisor.
Safety Certification: Certified for use in Safety Integrity Level 3 (SIL 3) applications per IEC 61508/61511 standards.
Form Factor: A single-slot module designed for installation in the primary controller slots of a Trusted TMR chassis.
Input: Accepts digital command signals from the TMR processors (via backplane).
Output: Typically provides a high-current drive output (e.g., ±200 mA or similar) for direct connection to servo valve coils.
Feedback Monitoring: Includes dedicated channels for monitoring Linear Variable Differential Transformer (LVDT) or other position feedback signals from the actuator.
Diagnostics: Comprehensive continuous diagnostics for coil integrity (open/short circuit), feedback signal validity, and module hardware health.
Fault Tolerance: Full TMR architecture; operates in a 2-out-of-3 voting configuration to tolerate any single fault.
Response Time: Engineered for very high-speed, deterministic response suitable for fast control loops.
Certifications: Designed for use in safety systems meeting rigorous standards like IEC 61508, capable of supporting SIL 3 applications.
Module Type:Triple Modular Redundant (TMR) Digital Input Module.
Input Type: Typically designed for dry contact inputs (e.g., from switches, relay contacts). The module provides a wetting voltage (often 24V DC) to detect the open/closed state of the field contact.
Input Channels: Contains multiple independent input channels per module (e.g., 8, 16, or 32 channels). Each channel processes a single field contact.
Redundancy Architecture: Employs true hardware TMR at the channel level. Each field input is connected to three identical, but electrically isolated, input circuits within the module. These three circuits provide independent readings to the three controller channels.
Fault Tolerance: Can tolerate the failure of any one of the three internal input circuits for a given channel without corrupting the input data. The TMR controller performs a 2-out-of-3 vote on the three signals to determine the true state of the field contact.
Isolation: Provides high-grade channel-to-channel isolation and field-to-system isolation. This prevents ground loops, noise interference, and prevents a fault on one input or field wire from affecting others.
Diagnostics: Includes continuous online diagnostics that monitor the health of the internal power supplies, each of the three input circuits per channel, and the overall module logic. Faults are reported in detail to the main TMR controller.
Response Time: Very fast input response and filtering, suitable for high-speed safety interlock logic.
Safety Certification: Certified for use in Safety Integrity Level 3 (SIL 3) applications per IEC 61508/61511 standards.
Form Factor: A single-slot module designed for installation in the Trusted system’s main or expansion I/O chassis.
Input Type: Analog, configurable for current or voltage.
Input Channels: Typically 8 channels (configuration dependent).
Signal Ranges: 4-20mA, 1-5V DC, and other ranges via configuration.
Resolution: High-resolution (e.g., 16-bit) analog-to-digital conversion for precise measurement.
Isolation: Channel-to-channel and channel-to-system isolation to prevent noise and ground loop interference.
Diagnostics: Comprehensive continuous self-diagnostics, including open-circuit detection, short-circuit detection, and out-of-range alarms.
Fault Tolerance: TMR architecture; the module operates in a 2-out-of-3 voting configuration, allowing it to tolerate a single fault without compromising system integrity.
Communication: Interfaces via the trusted backplane with the TMR processors.
Certifications: Designed to meet stringent international safety standards (e.g., IEC 61508, SIL 3 capable).
Module Type:Triple Modular Redundant (TMR) Analog Output Module.
Output Type: Typically provides a single 4-20 mA DC current output signal per channel, though specifications may vary (e.g., 0-20 mA). The output is sourced from the module (active).
Redundancy Architecture: Employs true hardware TMR at the component level. The module contains three completely independent analog output circuits (one per controller channel). A sophisticated hardware voting network compares the three signals and delivers the correct 2-out-of-3 voted output to the field.
Fault Tolerance: Can tolerate the failure of any one of its three internal output circuits without interrupting the correct analog signal to the field. The system diagnostics will identify the faulty sub-circuit.
Load Capacity: Capable of driving a specified maximum load resistance (e.g., 750 Ohms or more), ensuring compatibility with most field devices and long cable runs.
Accuracy & Resolution: High accuracy (e.g., ±0.1% of span) and resolution (e.g., 16-bit) to ensure precise control signal generation.
Isolation: Provides high-grade channel-to-channel and channel-to-field isolation to prevent fault propagation and protect the controller from field-side transients.
Diagnostics: Extensive continuous online diagnostics monitor the health of each of the three internal output circuits, the voting logic, and the final output stage. Faults are reported back to the main TMR controller.
Safety Certification: Certified for use in Safety Integrity Level 3 (SIL 3) applications per IEC 61508/61511 standards.
Form Factor: A single-slot module designed for installation in the Trusted system’s main or expansion I/O chassis.
Compatibility: Designed for specific Tricon (e.g., v9, v10) and Trident chassis models. It is crucial to verify the exact chassis part number.
Input Voltage: Accepts a range of input voltages, typically 120/240V AC or 125V DC, from the plant’s uninterruptible power supply (UPS) or secure power source.
Output Power: Supplies multiple isolated and regulated DC voltage rails (e.g., +5V, ±12V, +24V) to power all modules within the chassis.
Redundancy: Employs a TMR architecture internally, featuring three independent power conversion and monitoring circuits. The outputs are voted upon to ensure a single internal fault does not disrupt power to the controller.
Hot-Swap Capability: Designed to be hot-swappable, allowing for replacement or maintenance without shutting down the safety controller, thus maximizing system uptime.
Diagnostics & Monitoring: Comprehensive self-diagnostics with LED status indicators for input power, output health, and module faults. Fault status is communicated to the main processor.
Certifications: Designed and tested for use in Safety Integrity Level (SIL) 3 applications, meeting rigorous standards such as IEC 61508.
Module Type: TMR Communication Interface Module / Network Controller.
System Compatibility: Designed for installation within the Trusted TMR system chassis (e.g., T8100 series), interfacing with the triple redundant backplane.
Primary Function: Acts as a communications front-end processor, managing data flow between the TMR controller’s three independent channels and external networks.
Supported Protocols: Typically supports industry-standard protocols for supervisory communication. Common protocols include:
Modbus TCP/IP and Modbus RTU (serial) for connectivity to HMIs, DCS, and other PLCs.
OPC (Classic or DA) for connection to SCADA and historian systems.
Proprietary Trusted Network (TNET) protocols for peer-to-peer communication between Trusted systems.
Redundancy: The module itself is typically configured in a redundant (dual or triple) pair to eliminate itself as a single point of failure in the communication path, aligning with the system’s overall high-availability design.
Data Handling: Manages the mapping of process data (both safe and unsafe values, diagnostics) from the TMR controller to the external network and vice-versa for setpoints or commands (with appropriate permissions).
Diagnostics: Includes comprehensive self-diagnostics and status reporting back to the main TMR controller and externally, indicating communication link health and module status.
Physical Interface: Features standard network ports (e.g., RJ45 for Ethernet, serial ports) on its front face for external connections.
Compatibility: Designed for integration with Tricon v9, v10, and Trident chassis.
Output Channels: Typically provides multiple channels (e.g., 4 or 8 channels per module) of analog output.
Output Signal: Standard 4-20 mA or 0-20 mA current output to field devices, with support for HART communication protocol on some versions.
Resolution: High-resolution output (e.g., 16-bit) for precise control.
Isolation: Provides channel-to-channel and channel-to-system isolation to prevent fault propagation and ensure signal integrity.
Architecture: Employs a full TMR design, with three independent output circuits per channel. The outputs are voted upon, and the module can diagnose and compensate for a fault in any single leg without loss of control.
Certifications: Certified for Safety Integrity Level (SIL) 3 applications per IEC 61508 / IEC 61511 standards.
Diagnostics: Extensive onboard diagnostics and LED status indicators for power, channel activity, and fault conditions.
System Architecture:Triple Modular Redundant (TMR). Three independent channels execute the same logic in parallel, with hardware voting on inputs and outputs.
Fault Tolerance: Designed to tolerate any single fault (CPU, power, I/O channel) and many multiple faults without causing a system shutdown or compromising the safety function.
Chassis/Backplane: The T8100 typically refers to the main system chassis or rack that houses:
Communication Interface Modules for peer-to-peer and host connectivity.
Voting Mechanisms: Employs sophisticated hardware-based voting at the I/O level, ensuring that a correct 2-out-of-3 (2oo3) vote determines the valid state before any output action is taken.
Diagnostics: Extensive continuous online diagnostics monitor the health of every component across all three channels, detecting failures at the module level.
Communication: Supports robust communication networks like Trusted Network (TNET) and interfaces for connection to DCS, HMIs, and engineering workstations.
Certifications: Certified for use in SIL 3 safety applications per IEC 61508/61511 standards by exida, TÜV, and other global agencies.
Environmental Ratings: Designed for harsh industrial environments with wide operating temperature ranges and high immunity to shock, vibration, and electromagnetic interference.
The ICS Triplex 9451 is a digital output module that is an important part of the AAdvance safety controller system5. It mainly receives digital signals from the controller and drives field devices such as motors and valves to perform corresponding actions
Input voltage: 24VDC.
Operating temperature: -20℃ to 60℃.
Communication interface: Ethernet, Modbus, etc.
Number of input channels: 8.
Number of digital outputs: 8.
Number of analog inputs: 4.
Number of analog outputs: 4.
