Host Interface Unit (HIU)

The HIU is the point of access to the Inter Module Bus (IMB) for the Module.

It also provides power distribution and local programmable processing

power. The HIU is the only section of the I/O Module to directly connect to the

IMB Backplane. The HIU is common to most Trusted I/O types and has type

dependent and product range common functions. Each HIU contains three

independent slices, commonly referred to as A, B, and C.

All interconnections between the three slices incorporate isolation to prevent

any fault interaction between the slices. Each slice is considered a Fault

Containment Region (FCR), as a fault on one slice has no effect on the

operation of the other slices.

The HIU provides the following services common to the modules in the

family:

• High Speed Fault Tolerant Communications with the TMR Processor

via the IMB interface.

• FCR Interconnect Bus between slices to vote incoming IMB data and

distribute outgoing I/O Module data to the IMB.

• Optically isolated serial data interface to the FIU slices.

• Redundant power sharing of dual 24 Vdc chassis supply voltage and

power regulation for logic power to HIU circuitry.

• Magnetically isolated power to the FIU slices.

• Serial data interface to the FPU for Module status LEDs.

• SmartSlot link between active and standby modules for coordination

during Module replacement.

• Digital Signal Processing to perform local data reduction and self

diagnostics.

• Local memory resources for storing Module operation, configuration,

and field I/O data.

• Onboard housekeeping, which monitors reference voltages, current

consumption and board temperature.

Field Interface Unit (FIU)

The Field Interface Unit (FIU) is the section of the Module that contains the

specific circuits necessary to interface to the particular types of field I/O

signals. Each Module has three FIUs, one per slice. For the TMR 24 Vdc Digital

Input Module, the FIU contains an individual analog to digital (A/D) converter

for each of the 40 field inputs.

The FIU receives isolated power from the HIU for logic. The FIU provides

additional power conditioning for the operational voltages required by the

FIU circuitry. An isolated 6.25 Mbit/s serial link connects each FIU to one of

the HIU slices.

The FIU also measures a range of onboard “housekeeping” signals that assist

in monitoring the performance and operating conditions of the Module.

These signals include power supply voltages, current consumption, onboard

reference voltages and board temperature.

Features

• 40 Triple Modular Redundant (TMR) input channels per module.

• Comprehensive, automatic diagnostics and self-test.

• Selectable line monitoring per channel to detect open circuit and short

circuit field wiring faults.

• 2500 V impulse withstand opto/galvanic isolation barrier.

• Onboard Sequence of Events (SOE) reporting with 1 ms resolution.

• Module can be hot-replaced online using dedicated Companion

(adjacent) Slot or SmartSlot (one spare slot for many modules)

configurations.

• Front panel input status LEDs for each channel indicate input status

and field wiring faults.

• Front panel module status LEDs indicate module health and

operational mode (Active, Standby, Educated).

• TϋV Certified IEC 61508 SIL 3.

The Trusted® TMR 24 Vdc Digital Input Module is a member of the Trusted

range of Input/Output (I/O) modules. All Trusted I/O Modules share common

functionality and form. At the most general level, all I/O Modules interface to

the Inter-Module Bus (IMB) which provides power and allows communication

with the Trusted TMR Processor. In addition, all Modules have a field interface

that is used to connect to module specific signals in the field. All Modules are

Triple Modular Redundant (TMR).

Product overview

The Trusted® TMR 24 Vdc Digital Input module interfaces to 40 field input

devices. Fault tolerance is achieved through a Triple Modular Redundant

(TMR) architecture within the module for each of the 40 input channels.

Each field input is triplicated and the input voltage is measured using a

sigma-delta input circuit. The resulting field voltage measurement is

compared to user configurable threshold voltages to determine the reported

field input state. When a line-monitoring device is installed at the field switch,

the module can detect open and short circuit field cables. Line monitoring

functions are independently configured for each input channel. The

triplicated voltage measurement, coupled with onboard diagnostic testing,

provides comprehensive fault detection and tolerance.

The module provides onboard Sequence of Events (SOE) reporting with a

resolution of 1 ms. A change of state triggers an SOE entry. States are

determined by voltage thresholds that can be configured on a per channel

basis.

Overview 

The TMR Expander Processor is a fault tolerant design based on TMR architecture arranged 

in a lock-step configuration. Figure 1 shows, in simplified terms, the basic structure of the 

TMR Expander Processor. 

The Module has three main fault containment regions (FCR A, B and C). Each of the main 

FCRs contains interfaces to the Expander Bus and Inter-Module Bus (IMB), an active/standby 

interface to the other TMR Expander Processor in the Chassis, control logic, communications 

transceivers and power supplies. 

Communication between the Module and the TMR Processor is via the TMR Expander 

Interface Module and the triplicated Expander Bus. The Expander Bus is triplicated, point-to

point architecture. Each channel of the Expander Bus comprises separate command and 

response media. Voting is provided at the Expander Bus Interface to ensure that cable faults 

are tolerated, and the remainder of the Expander Processor operates in a fully triplicated 

mode, even in case of cable faults occurring. 

Communication between the Module and the I/O Modules in the Expander Chassis is via the 

IMB on the Backplane of the Expander Chassis. The IMB is identical to that within the 

Controller Chassis, providing the same fault tolerant, high bandwidth communications 

between the Interface Modules and the TMR Processor. As with the Expander Bus Interface 

all transactions are voted, localising faults to the IMB should they occur. 

A fourth FCR (FCR D) provides the non-critical monitoring and display functions and is also 

part of the inter-FCR Byzantine voting structure. 

Isolation is provided between FCRs wherever interfaces are required, to ensure that faults 

cannot propagate between them. 

Trusted TMR Expander Processor 

Product Overview 

The Trusted® TMR Expander Processor Module resides in the processor slots of the Trusted 

Expander Chassis and provides the ‘slave’ interface between the Expander Bus and the Expander 

Chassis Backplane. The Expander Bus allows multiple chassis systems to be implemented using 

Unshielded Twisted Pair (UTP) cable connections whilst maintaining the fault tolerant, high 

bandwidth Inter-Module Bus (IMB) capabilities. 

The Module provides fault containment for the Expander Bus, the Module itself and the Expander 

Chassis, ensuring that the effects of these potential faults are localised and system availability 

maximised. The Module is fault tolerant with HIFT TMR architecture. Comprehensive diagnostics, 

monitoring and testing provide rapid fault identification. Hot-standby and module spare 

configurations are supported, allowing automatic and manual repair strategies 

Features: 

• Triple Modular Redundant (TMR), fault tolerant (3-2-0) operation. 

• Hardware Implemented Fault Tolerant (HIFT) architecture. 

• Dedicated hardware and software test regimes which provide very fast fault recognition and 

response times. 

• Automatic fault handling without nuisance alarming. 

• Hot replacement. 

• Front Panel indicators that show module health and status.

Communications

Data is transferred between the TMR Processor and the Communications Interfaces using a

common interface called the Network Variable Manager. When data is read from a Trusted

System, the data is obtained from the local copy maintained on the Communications

Interface, providing a fast response.

Data writes are more complicated. If a data write simply updated the local copy and was

then relayed to the processor, the other Communications Interfaces in the system would

carry different data. This may cause problems for redundant links.

To overcome this problem, when data is written to a Communications Interface, it is first

passed to the TMR Processor and the write is acknowledged immediately by the

Communications Interface (to avoid communications delays). The processor updates its own

database and then sends the data back to all Communications Interfaces so that they all

have the same data. This can take one or two application scans. This means that subsequent

reads will receive the old data immediately after the write, until the new data has been

distributed.

All changes to CI parameters (.ini changes) loaded online do not require a power cycle, and

will take effect immediately. The Communications Interface disconnects all communications

and restarts. Communications is also restarted on an application online update and is shut

down when the application is stopped.

Hardware

The module has a Power PC Processor. Bootstrap software is stored on Erasable

Programmable Read Only Memory (EPROM). Operational firmware is stored in flash memory

and may be upgraded via the Front Panel Port.

The Trusted Operating System is used on both the TMR Processor and CI. The real time

kernel is a high speed, high functionality kernel made for fault tolerant distributed systems.

The kernel provides basic services (such as memory management) and interference free

software environments.

A module watchdog monitors processor operation and the power supply unit (PSU) output

voltages.

The module is supplied with a dual redundant +24 Vdc power feed from the chassis

backplane. An on-board power supply unit provides voltage conversion, supply conditioning

and protection.

The Trusted CI communicates with the Trusted TMR Processor via the triplicated Inter

Module Bus. When polled by the Trusted TMR Processor, the module’s bus interface votes

the data 2 out of 3 (2oo3) from the Inter-Module Bus and transmits back its reply via all

three Inter-Module Bus channels. The remainder of the Communications Interface is

simplex.

All communications transceivers are electrically isolated from each other and the module

and have additional transient protection measures.

The module internal supplies are isolated from the dual 24 Vdc feeds.

Product Overview

The Trusted® Communications Interface (CI) is an intelligent module that provides a range of

communication services for the Trusted Controller, minimising communication loading of the Triple

Modular Redundant (TMR) Processor.

A user-configurable module, the CI can support multiple communication media.

Up to four Communications Interfaces (CIs) can be supported by a Trusted System.

Features:

• Trusted Operating System.

• Dual Ethernet and four serial ports.

• Support for a wide range of communication protocols.

• Secure, dependable communications via high performance communications links.

• Modbus Slave.

• Optional Modbus Master (with T812X Trusted Processor Interface Adapter).

• Optional Sequence Of Events (SOE) Over Modbus.

• Front Panel serial diagnostic port, fault and status indicators.

Overview

The Trusted CI provides the Trusted System with an intelligent Communications Interface,

acting as a relay between the Processor, other Trusted Systems, the Engineering Workstation

and third-party equipment.