Fault Detection/Testing; Sequence Of Events Characteristics - Rockwell Automation Trusted TMR Product Overview

Trusted TMR 120 Vdc Output Module – 32 Channel 1. Description

1.7. Fault Detection/Testing

Extensive diagnostics provide the automatic detection of Module faults. The TMR
architecture of the Output Module and the diagnostics performed verify the validity of all
critical circuits. Using the TMR architecture provides a Fault Tolerant method to withstand
the first fault occurrence on the Module and continue normal output controls without
interruption in the system or process. Faults are reported to the user through the Healthy
status indicators on the Front Panel of the Module and through the information reported to
the TMR Processor. Under normal operations all three Healthy indicators are green. When a
fault occurs, one of the Healthy indicators will be flashing red. It is recommended that this
condition is investigated and if the cause is within the Module, it should be replaced.
Module replacement activities depend on the type of spare Module configuration chosen
when the system was configured and installed. The Module may be configured with a
dedicated Companion Slot (SmartSlot operation is not available).
From the IMB to the field connector, the I/O Module contains extensive fault detection and
integrity testing. As an output device, most testing is performed in a non-interfering mode.
Data input from the IMB is stored in redundant error-correcting RAM on each slice portion
of the HIU. Received data is voted on by each slice. All data transmissions include a
confirmation response from the receiver.
Periodically, the TMR Processor commands the on-board Digital Signal Processors (DSPs) to
perform a Safety Layer Test (SLT). The SLT results in the DSP verifying with the TMR
Processor its ability to process data with integrity. In addition, the DSP uses Cyclical
Redundancy Checks (CRC) to verify the variables and configuration stored in Flash memory.
Between the HIU and FIU are a series of optically isolated links for data and power. The data
link is synchronized and monitored for variance. Both FIU and HIU have on-board
temperature sensors to characterize temperature-related problems. Each FIU is also fitted
with a condensation sensor.
The power supplies for both the HIU and FIU boards are redundant, fully instrumented and
testable. Together these assemblies form a Power Integrity Sub-system.

1.8. Sequence of Events Characteristics

The Module automatically measures the field voltage and current to determine the state of
each output channel. An event occurs when the output transitions from one state to
another. When a channel changes state, the on-board timer value is recorded. When the
TMR Processor next reads data from the Output Module, the channel state and real-time
clock value are retrieved. The TMR Processor uses this data to log the state change into the
system Sequence of Events (SOE) log. The user may configure each output to be included in
the system SOE log. Full details of SOE are contained in Trusted Sequence OE of Events and
Process Historian Package, publication ICSTT-RM243 (PD-T8013).
Rockwell Automation Publication ICSTT-RM281P-EN-P (PD-T8471) Issue 16 7