Overview 

The TMR Expander Processor is a fault tolerant design based on TMR architecture arranged 

in a lock-step configuration. Figure 1 shows, in simplified terms, the basic structure of the 

TMR Expander Processor. 

The Module has three main fault containment regions (FCR A, B and C). Each of the main 

FCRs contains interfaces to the Expander Bus and Inter-Module Bus (IMB), an active/standby 

interface to the other TMR Expander Processor in the Chassis, control logic, communications 

transceivers and power supplies. 

Communication between the Module and the TMR Processor is via the TMR Expander 

Interface Module and the triplicated Expander Bus. The Expander Bus is triplicated, point-to

point architecture. Each channel of the Expander Bus comprises separate command and 

response media. Voting is provided at the Expander Bus Interface to ensure that cable faults 

are tolerated, and the remainder of the Expander Processor operates in a fully triplicated 

mode, even in case of cable faults occurring. 

Communication between the Module and the I/O Modules in the Expander Chassis is via the 

IMB on the Backplane of the Expander Chassis. The IMB is identical to that within the 

Controller Chassis, providing the same fault tolerant, high bandwidth communications 

between the Interface Modules and the TMR Processor. As with the Expander Bus Interface 

all transactions are voted, localising faults to the IMB should they occur. 

A fourth FCR (FCR D) provides the non-critical monitoring and display functions and is also 

part of the inter-FCR Byzantine voting structure. 

Isolation is provided between FCRs wherever interfaces are required, to ensure that faults 

cannot propagate between them.