Product Overview
Model 3723X is a TMR (Triple Module Redundancy) analog input module with
a voltage range of 0 to 5 VDC. It provides HART communication (pass-through
function) to connected HART-enabled field devices. This module can only be
installed in the Tricon CX I/O expansion chassis.
KEY CAPABILITIES
• TÜV Certified up to SIL3 applications in accordance with International standard IEC61508
• Easily integrated with all major Distributed Control Systems
• On-line module replacement ensures plant availability by hot-swapping of modules
• Works with both centralized and distributed applications
• Comprehensive family of I/O modules
• HART protocol pass through to Asset Management Systems
• Fast program cycle time for TMC applications
• Expertise available from our TÜV certified Functional Safety Experts and Engineers
• Certified for use in non-incendive applications
TRICONEX TRIPLE MODULAR REDUNDANCY
Tricon operation is based on the principle of safety and high plant availability, which identifies and
compensates for failed control system elements and allows on line replacement while continuing
its assigned task without interrupting the controlled process. Fault Tolerance is achieved through
TMR technology.
TMR employs three isolated, parallel control systems and extensive diagnostics integrated into one
system. The Tricon system uses two-out-of-three (2oo3) voting to provide high integrity, error-free,
uninterrupted process operation with no single point of failure. Setting up applications is simplified
with the Tricon, because the TMR system operates as a single control system from the user’s point of
view. The extensive diagnostics are inherent and transparent to the programmer.
Use of the Tricon continues to expand into new industries and applications as customers require
increased system safety and/or high availability. Today, Invensys has delivered and installed Triconex
safety system solutions in over 70 countries, providing increased safety and high process uptime.
BENEFITS
• Maximizing process/plant uptime, productivity and yield
• Increased reliability and availability, performance and profitability
• Lowers investment and lifecycle costs
• Complies with International safety standards
• Meets safety targets
• Mitigates environmental impact
• Assists you in avoiding penalties or fines for non-compliance
• Enable you to achieve competitive advantage in your markets
KEY CAPABILITIES
• TÜV Certified up to SIL3 applications in accordance with International standard IEC61508
• Easily integrated with all major Distributed Control Systems
• On-line module replacement ensures plant availability by hot-swapping of modules
• Works with both centralized and distributed applications
• Comprehensive family of I/O modules
• HART protocol pass through to Asset Management Systems
• Fast program cycle time for TMC applications
• Expertise available from our TÜV certified Functional Safety Experts and Engineers
• Certified for use in non-incendive applications
OPERATIONAL CONTINUITY AND MANAGING OPERATIONAL RISKS
Invensys is the only automation company with the experience and
track record in safety and critical control as demonstrated by our 27
years of experience in safety systems, in excess of 8.000 installed systems,
the only approved Nuclear Regulatory Commission Commercial off-the-shelf
controller for Nuclear 1E applications, large number of TÜV certified Functional
Safety Experts and Engineers, deployed world wide, and patented Triple Modular
Redundant (TMR) technology.
A powerful, scalable design with assurance
of continuous operation, the Tricon system complies with international safety
standards such as IEC61508 and fulfils the requirements for applications such as
Emergency Shutdown (ESD), Fire and Gas Protection (F&G), Burner Management
(BMS), High Integrity Pressure Protection (HIPPS) and Turbomachinery Control
(TMC). The redundant high availability architecture provides a flexible, robust,
reliable and powerful solution that is ideal for clients looking to achieve
environmental and safety excellence.
The Tricon system is a must for clients who need to maximize the safety and
performance of their assets. If you are challenged with reducing investment and
lifecycle costs, meeting new safety standards, combating tough competitive
pressure in your markets as well as the welfare of your employees and the
environment, then the Tricon system is designed for you.
Turbine Control Systems
The control and protection of gas or steam turbines requires high integrity
as well as safety. The continuous operation of the fault-tolerant Tricon
controller provides the turbine operator with maximum availability while main
taining equivalent levels of safety.
Speed control as well as start-up and shutdown sequencing are implemented
in a single integrated system. Unscheduled outages are avoided by using hot
spares for the I/O modules. If a faultoccurs in a module, a replacement
module is automatically activated without operator intervention.
Offshore Fire and Gas Protection
The protection of offshore platforms from fire and gas threats requires
continuous availability as well as reliability. The Tricon provides this avail
ability through online replacement of faulty modules. Faults in individual
modules, field wiring and sensors are managed automatically by built-in
diagnostics. Analog fire and gas detectors are connected directly to the
Tricon, eliminating the need for tripamps. An operator interface monitors
fire and gas systems as well as diagnostics for the Tricon controller and its
attached sensors. Traditional fire and gas panels can be replaced with a single
integrated system, saving costly floor space while maintaining high levels of
safety and availability.
Emergency Safety Shutdown (ESD)
The Tricon provides continuous protection for safety-critical units in refineries,
petrochemical/chemical plants and other industrial processes. For example,
in reactor and compressor units, plant trip signals—for pressure, product feed
rates, expander pressure equalization and temperature—are monitored and
shutdown actions taken if an upset condition occurs. Traditional shutdown
systems implemented with mechanical or electronic relays provide shutdown
protection but can also cause dangerous nuisance trips.
The Tricon increases system integrity, providing automatic detection and veri
fication of field sensor integrity, inte grated shutdown and control functionality,
and direct connection to the supervisory data highway for continuous monitoring
of safety-critical functions.
Boiler Flame Safety Process steam boilers function as a critical component in
most refinery applications. Protection of the boiler from upset conditions, safety
interlock for normal startup and shutdown, and flame-safety applications are
combined by one integrated Tricon system. In traditional applications, these
functions had to be provided by separate, non integrated components.
But with the fault-tolerant, fail-safe Tricon controller, the boiler operations staff
can use a critical resource more productively while maintaining safety at or
above the level of electromechanical protection systems.
Other key features of the Tricon controller that ensure the highest
possible system integrity are:
• No single point of failure
• Ability to operate with 3. 2 or 1 Main Processor before shutdown
• Fully implemented and transparent triplication
• Comprehensive system diagnostics
• Complete range of I/O modules
• Dual and single I/O modules for safety-critical points with a limited
need for availability
• Remote I/O up to 7.5 miles (12 kilometers) away from MPs
• Simple, online module repair
• Unsurpassed reliability and availability
What are Typical User Applications?
Each day the Tricon supplies increased safety, reliability and availability to a
worldwide installed base. The following are a few typical applications.
For more information on how a Tricon controller can add value to your
applications, ask your sales representative for additional documentation and
customer references.
What is the Tricon?
The Tricon is a state-of-the art controller that provides fault tolerance
by means of Triple-Modular Redundant (TMR) architecture. TMR integrates
three isolated, parallel control systems and extensive diagnostics in one control
system. The system uses two-out-of three voting to provide high-integrity,
error-free, uninterrupted process operation with no single point of failure.
The Tricon controller uses three identical channels. Each channel indepen
dently executes the control program inparallel with the other two channels.
Specialized hardware/software voting mechanisms qualify and verify all
digital inputs and outputs from the field, while analog inputs are subject to
a mid-value selection process.
Because each channel is isolated from the others, no single-point failure in any
channel can pass to another. If a hardware failure does occur on one channel,
the other channels override it. Mean while the faulting module can easily be
removed and replaced while the controller is online without interrupting
the process.
Setting up control programs is simplified with the triplicated Tricon system,
because it operates as a single control system from the user’s point of view.
The user terminates sensors and actuators at a single wiring terminal and
programs the Tricon with one set of control program logic. The Tricon
controller manages the rest!
Extensive diagnostics on each channel,module, and functional circuit immedi
ately detect and report operational faults by means of indicators or alarms.
All diagnostic fault information is accessible by the control program and
the operator. The program or the operator can use diagnostic data to modify
control actions or direct maintenance procedures.
What is Fault-Tolerant Control?
A fault-tolerant control system identifies and compensates for failed control
system elements and allows repair while continuing an assigned task
without process interruption. A high integrity control system such as the
Tricon is used in critical process applications that require a significant degree
of safety and availability.
Offshore Fire and Gas Protection
The protection of offshore platforms from fire and gas threats requires
continuous availability as well as reliability. The Tricon provides this avail
ability through online replacement of faulty modules. Faults in individual
modules, field wiring and sensors are managed automatically by built-in
diagnostics. Analog fire and gas detectors are connected directly to the
Tricon, eliminating the need for tripamps. An operator interface monitors
fire and gas systems as well as diagnostics for the Tricon controller and its
attached sensors. Traditional fire and gas panels can be replaced with a single
integrated system, saving costly floor space while maintaining high levels of
safety and availability.
System Configuration
Physically, a basic Tricon controller consists of Main Processors and I/O modules,
communication modules, the chassis enclosing the modules, field wiring connections, and a
TriStation PC. This section briefly describes these components and provides general
specifications.
Tricon modules are field-replaceable units consisting of an electronic assembly housed in a
metal spine. Each module has a protective cover that ensures no components or circuits are
exposed even when a module is removed from the chassis. Offset backplane connectors make it
impossible to plug a module in upside down, and keys on each module prevent the insertion of
modules into incorrect slots. The Tricon controller supports digital and analog input and output
points, as well as pulse and thermocouple inputs and multiple communication protocols.
Tricon Controller Chassis
A Tricon controller can include a maximum of 15 chassis, housing any appropriate combination
of input, output, communication, interface, and hot-spare modules. There are three types of
chassis: Main, Expansion, and RXM.
• The Main Chassis houses the Main Processor modules and I/O modules. The Model
8110 Main Chassis houses up to six slot sets of I/O modules and the Model 8120E
Enhanced Performance Main Chassis houses up to five sets of I/O modules. The I/O
modules in a chassis are connected via I/O expansion bus ports that are triplicated RS
485 bi-directional communication ports.
• An Expansion Chassis (chassis 2 to 15) houses up to eight slot sets of I/O modules and
HART™ Interface Modules. The Expansion Chassis connects to the Main Chassis by
means of a triplicated RS-485 bi-directional communication port. Generally, the last
Expansion Chassis must be located no more than 100 feet (30 meters) from the Main
Chassis or an RXM Chassis.
• An RXM Chassis houses a Primary or Remote RXM Module set and six slot sets of I/O
modules. An RXM Chassis enables a system to extend to remote locations up to 7.5
miles (12 kilometers) from the Main Chassis, using SRXM modules.