Category: ICS TRIPLEX

Features

• 40 Triple Modular Redundant (TMR) input channels per module.

• Comprehensive, automatic diagnostics and self-test.

• Selectable line monitoring per channel to detect open circuit and short

circuit field wiring faults.

• 2500 V impulse withstand opto/galvanic isolation barrier.

• Onboard Sequence of Events (SOE) reporting with 1 ms resolution.

• Module can be hot-replaced online using dedicated Companion

(adjacent) Slot or SmartSlot (one spare slot for many modules)

configurations.

• Front panel input status LEDs for each channel indicate input status

and field wiring faults.

• Front panel module status LEDs indicate module health and

operational mode (Active, Standby, Educated).

• TϋV Certified IEC 61508 SIL 3.

The Trusted® TMR 24 Vdc Digital Input Module is a member of the Trusted

range of Input/Output (I/O) modules. All Trusted I/O Modules share common

functionality and form. At the most general level, all I/O Modules interface to

the Inter-Module Bus (IMB) which provides power and allows communication

with the Trusted TMR Processor. In addition, all Modules have a field interface

that is used to connect to module specific signals in the field. All Modules are

Triple Modular Redundant (TMR).

Product overview

The Trusted® TMR 24 Vdc Digital Input module interfaces to 40 field input

devices. Fault tolerance is achieved through a Triple Modular Redundant

(TMR) architecture within the module for each of the 40 input channels.

Each field input is triplicated and the input voltage is measured using a

sigma-delta input circuit. The resulting field voltage measurement is

compared to user configurable threshold voltages to determine the reported

field input state. When a line-monitoring device is installed at the field switch,

the module can detect open and short circuit field cables. Line monitoring

functions are independently configured for each input channel. The

triplicated voltage measurement, coupled with onboard diagnostic testing,

provides comprehensive fault detection and tolerance.

The module provides onboard Sequence of Events (SOE) reporting with a

resolution of 1 ms. A change of state triggers an SOE entry. States are

determined by voltage thresholds that can be configured on a per channel

basis.

Overview 

The TMR Expander Processor is a fault tolerant design based on TMR architecture arranged 

in a lock-step configuration. Figure 1 shows, in simplified terms, the basic structure of the 

TMR Expander Processor. 

The Module has three main fault containment regions (FCR A, B and C). Each of the main 

FCRs contains interfaces to the Expander Bus and Inter-Module Bus (IMB), an active/standby 

interface to the other TMR Expander Processor in the Chassis, control logic, communications 

transceivers and power supplies. 

Communication between the Module and the TMR Processor is via the TMR Expander 

Interface Module and the triplicated Expander Bus. The Expander Bus is triplicated, point-to

point architecture. Each channel of the Expander Bus comprises separate command and 

response media. Voting is provided at the Expander Bus Interface to ensure that cable faults 

are tolerated, and the remainder of the Expander Processor operates in a fully triplicated 

mode, even in case of cable faults occurring. 

Communication between the Module and the I/O Modules in the Expander Chassis is via the 

IMB on the Backplane of the Expander Chassis. The IMB is identical to that within the 

Controller Chassis, providing the same fault tolerant, high bandwidth communications 

between the Interface Modules and the TMR Processor. As with the Expander Bus Interface 

all transactions are voted, localising faults to the IMB should they occur. 

A fourth FCR (FCR D) provides the non-critical monitoring and display functions and is also 

part of the inter-FCR Byzantine voting structure. 

Isolation is provided between FCRs wherever interfaces are required, to ensure that faults 

cannot propagate between them. 

Trusted TMR Expander Processor 

Product Overview 

The Trusted® TMR Expander Processor Module resides in the processor slots of the Trusted 

Expander Chassis and provides the ‘slave’ interface between the Expander Bus and the Expander 

Chassis Backplane. The Expander Bus allows multiple chassis systems to be implemented using 

Unshielded Twisted Pair (UTP) cable connections whilst maintaining the fault tolerant, high 

bandwidth Inter-Module Bus (IMB) capabilities. 

The Module provides fault containment for the Expander Bus, the Module itself and the Expander 

Chassis, ensuring that the effects of these potential faults are localised and system availability 

maximised. The Module is fault tolerant with HIFT TMR architecture. Comprehensive diagnostics, 

monitoring and testing provide rapid fault identification. Hot-standby and module spare 

configurations are supported, allowing automatic and manual repair strategies 

Features: 

• Triple Modular Redundant (TMR), fault tolerant (3-2-0) operation. 

• Hardware Implemented Fault Tolerant (HIFT) architecture. 

• Dedicated hardware and software test regimes which provide very fast fault recognition and 

response times. 

• Automatic fault handling without nuisance alarming. 

• Hot replacement. 

• Front Panel indicators that show module health and status.

Communications

Data is transferred between the TMR Processor and the Communications Interfaces using a

common interface called the Network Variable Manager. When data is read from a Trusted

System, the data is obtained from the local copy maintained on the Communications

Interface, providing a fast response.

Data writes are more complicated. If a data write simply updated the local copy and was

then relayed to the processor, the other Communications Interfaces in the system would

carry different data. This may cause problems for redundant links.

To overcome this problem, when data is written to a Communications Interface, it is first

passed to the TMR Processor and the write is acknowledged immediately by the

Communications Interface (to avoid communications delays). The processor updates its own

database and then sends the data back to all Communications Interfaces so that they all

have the same data. This can take one or two application scans. This means that subsequent

reads will receive the old data immediately after the write, until the new data has been

distributed.

All changes to CI parameters (.ini changes) loaded online do not require a power cycle, and

will take effect immediately. The Communications Interface disconnects all communications

and restarts. Communications is also restarted on an application online update and is shut

down when the application is stopped.

Hardware

The module has a Power PC Processor. Bootstrap software is stored on Erasable

Programmable Read Only Memory (EPROM). Operational firmware is stored in flash memory

and may be upgraded via the Front Panel Port.

The Trusted Operating System is used on both the TMR Processor and CI. The real time

kernel is a high speed, high functionality kernel made for fault tolerant distributed systems.

The kernel provides basic services (such as memory management) and interference free

software environments.

A module watchdog monitors processor operation and the power supply unit (PSU) output

voltages.

The module is supplied with a dual redundant +24 Vdc power feed from the chassis

backplane. An on-board power supply unit provides voltage conversion, supply conditioning

and protection.

The Trusted CI communicates with the Trusted TMR Processor via the triplicated Inter

Module Bus. When polled by the Trusted TMR Processor, the module’s bus interface votes

the data 2 out of 3 (2oo3) from the Inter-Module Bus and transmits back its reply via all

three Inter-Module Bus channels. The remainder of the Communications Interface is

simplex.

All communications transceivers are electrically isolated from each other and the module

and have additional transient protection measures.

The module internal supplies are isolated from the dual 24 Vdc feeds.

Product Overview

The Trusted® Communications Interface (CI) is an intelligent module that provides a range of

communication services for the Trusted Controller, minimising communication loading of the Triple

Modular Redundant (TMR) Processor.

A user-configurable module, the CI can support multiple communication media.

Up to four Communications Interfaces (CIs) can be supported by a Trusted System.

Features:

• Trusted Operating System.

• Dual Ethernet and four serial ports.

• Support for a wide range of communication protocols.

• Secure, dependable communications via high performance communications links.

• Modbus Slave.

• Optional Modbus Master (with T812X Trusted Processor Interface Adapter).

• Optional Sequence Of Events (SOE) Over Modbus.

• Front Panel serial diagnostic port, fault and status indicators.

Overview

The Trusted CI provides the Trusted System with an intelligent Communications Interface,

acting as a relay between the Processor, other Trusted Systems, the Engineering Workstation

and third-party equipment.

The Trusted® Processor is the main processing component in a Trusted System. It is a powerful,

user-configurable module providing overall system control and monitoring facilities and processes

input and output data received from a variety of analogue and digital Input / Output (I/O) modules

across a Trusted TMR Inter-Module Communications Bus.

The range of applications for the Trusted TMR Processor vary in integrity level and include fire and

gas control, emergency shutdown, monitoring and control, and turbine control.

Security Section

The above display is also used to configure a password allowing the user to interrogate a

Trusted System using the Windows-based HyperTerminal facility or a similar terminal

program. The password is configured by selecting the New Password button and entering

the new password twice in the displayed dialogue box.

ICS2000 Section

This section only applies to Trusted Systems connected via a Trusted to ICS2000 Interface

Adapter to an ICS2000 system. This allows the data sources for the three mimic tables to be

selected. Please refer to your Trusted supplier for further information.

The Trusted® Processor is the main processing component in a Trusted System. It is a powerful,

user-configurable module providing overall system control and monitoring facilities and processes

input and output data received from a variety of analogue and digital Input / Output (I/O) modules

across a Trusted TMR Inter-Module Communications Bus.

The range of applications for the Trusted TMR Processor vary in integrity level and include fire and

gas control, emergency shutdown, monitoring and control, and turbine control.

Security Section

The above display is also used to configure a password allowing the user to interrogate a

Trusted System using the Windows-based HyperTerminal facility or a similar terminal

program. The password is configured by selecting the New Password button and entering

the new password twice in the displayed dialogue box.

ICS2000 Section

This section only applies to Trusted Systems connected via a Trusted to ICS2000 Interface

Adapter to an ICS2000 system. This allows the data sources for the three mimic tables to be

selected. Please refer to your Trusted supplier for further information.

Application

Module Configuration

The Trusted TMR Processor requires no hardware configuration.

Every Trusted System requires a System.INI configuration file. Details of how to design this

are given in PD-T8082 (Trusted Toolset Suite). The configuration has a Processor assigned to

the left slot of the Processor chassis by default. The System Configurator allows the

selection of options on ports, IRIG and system functions. The use of the System Configurator

is described in PD-T8082. The options are described below.

Updater Section

If Auto Protect Network Variables is selected, this configures the Trusted System to use a

reduced Modbus Protocol map. See product description PD-8151B (Trusted Communication

Interface Module) for further details.

Inter Group Delay equates to the Modbus update cycle. This is the minimum period

between successive Modbus update messages sent to each of the Communications

Interface Modules. The default value (as shown) is 50 ms which provides a compromise

between latency and performance. Adjustment is made in 32 integer ms increments, i.e. a

value of 33 will equal 64 ms as will 64.This may be increased or decreased as required,

however since only one update message is sent per application scan, and an application

scan may often be more than 50 ms, there is little benefit in adjusting this variable.