Rockwell Automation T3480 User Manual
ICS Regent
®
PD-6026
Guarded Analog Output Modules
4 to 20 mA
(T3480)
Issue 1,
Guarded analog output modules provide 4 to 20 mA current
outputs for a maximum of six user loads per module. These
modules are called Guarded because the module's dual
redundant design ensures that no single fault within a
module will inadvertently change an output's signal. The
module's triplicated Safetybus interface ensures that no
Regent system failure will inadvertently affect the output
signal. Extensive fault detection and annunciation of critical
redundant circuits ensures the modules will continue to
operate in a fail-safe mann
er.
March, 06
-
Features
·
Six 4 to 20 mA output circuits.
·
Dual, high resolution, 12-bit D/A converters per output.
·
Fault tolerant operation when connected in parallel with
another module of the same type.
·
Hot-replaceable.
·
Comprehensive self-testing of all critical circuits.
·
Front panel indicators on each module s
shutdown, and on status.
·
2500 volt minimum electrical isolation between field and logic
circuits.
·
TÜV certified, Risk Class 5, non-interfering.
Two Guarded output modules can be connected in parallel to
obtain fault tolerant control of current to the loads. In this
parallel module configuration, either module can be removed
and replaced while the other Guarded module continues to
control the loads without interruption.
how active/fault,
Industrial Control Services
1
Guarded Analog Output Modules
(T3480)
Module Operation
A block diagram of the Guarded analog output module is
shown in Figure 1.
The processor modules send triplicated write data commands
over the I/O Safetybus to the Guarded output module.
Onboard the Guarded output module the triplicated data are
routed to two independent voter and I/O Safetybus logic
sections. Each section independently votes the triplicated
data and drives one digital-to-analog (D/A) converter for each
of the six output channels.
2
Figure 1. Block Diagram of Guarded Analog Output Module.
For each output channel, one of the D/A converter output
signals is used for the actual analog output drive signal. The
other D/A converter output signal generates a redundant
reference output signal. When all circuits are operating
correctly each channel’s drive output and reference output
should be the same. These two signals are compared on the
module and must be the same in order for the module to
control the field outputs.
Industrial Control Services
Guarded Analog Output Modules
(T3480)
The combination of redundant interface circuits, D/A
converters, and comparison of drive and reference signals
produces a fail-safe signal to the load.
For fault tolerant operation, two Guarded analog output
modules can be used in parallel. In this configuration, the
STATUS OUT and STATUS IN signals are cross-strapped
between the two redundant modules. This connection causes
only one of the analog output modules to control the field
devices, while the redundant module is in a standby mode. In
the standby mode the module has its D/A converter output
signals shunted to AGND. This allows the module to
completely test and validate its analog drive circuits while the
other module controls the load devices. If the controlling
module fails, it turns off and the standby module becomes the
controlling module. This switch over occurs in less than 5
msec and is effectively bumpless for most field devices.
Testing and Diagnostics
The voter and I/O bus interface logic of the Guarded anal
og
output module are automatically tested by the processor
modules. Discrepant data are sent through one of three legs
of the I/O Safetybus to determine whether the module’s voters
are able to outvote the incorrect data. A failure to return the
correct majority-voted result to the processors produces an I/O
module error indication at the processor modules and a
module fault indication at the I/O module.
Each type of module has a unique identification code that is
read by the controller. This code lets t
he controller know
which type of module is installed in each I/O chassis slot and
how to address that module and its points specifically. If a
module is removed, or is replaced with a module of a different
type, the processor modules will indicate an I/O module error.
Loopback logic tests periodically write data to the module and
then read it back to determine whether the module’s I/O bus
interface logic is functioning correctly.
PD-6026
Mar-06
To detect a failure in the redundant analog drive circuits,
each channel’s redundant D/A converter output signals are
compared. If they are not the same, a fault signal is sent to
the fault summary circuits to disable the module’s outputs —
3
Important!
Note:
Guarded Analog Output Modules
shunting all six output channel signal outputs to AGND via
the diode matrix.
An open circuit wiring fault to a load will cause the output
signal comparison for that channel to fail. In single module
configurations this may produce undesirable effects. Refer to
page 11, Effects of Open Circuit Field Wiring,
details and recommendations.
(T3480)
for further
Front Panel Indicators
Figure 2 shows the physical features of a Guarded analog
output module. The front panel of each module contains
active and fault status indicators, an on status indicator, and
a shutdown indicator.
Active and Fault Status Indicators
These green and red LEDs indicate the overall health of the
module and its field circuits. During normal operation the
green ACTIVE indicator flashes at the controller's scan rate.
If a mod
and the green ACTIVE indicator turns off.
The module will indicate a FAULT if field power is not
applied.
On Status Indicator
In a single module, fail-safe configuration this green LED is
on when the module is operating correctly. If any output
channel’s dual D to A converters fail to compare, the module
shuts off and this LED turns off.
ule fault occurs the red FAULT indicator turns on
4
In a dual module, fault tolerant configuration only one of the
two parallel modules is controlling the load cu
other is in a standby mode. Only the ON status indicator on
the controlling module is turned on (the standby module's ON
indicator will remain off). If the controlling module fails, its
ON status indicator will turn off and the standby module's ON
status indicator will turn on (as it becomes the controlling
module).
Shutdown Indicator
Upon loss of communications with the controller, output
modules enter either a shutdown or hold fault mode. If the I/O
Industrial Control Services
rrent while the
Guarded Analog Output Modules
Note:
(T3480)
unit is set to shutdown, the red SHUTDOWN indicator will
turn on when the communications with the controller are lost.
If the I/O unit is set to hold, the SHUTDOWN indicator will
always be off (see page 11, Fault Mode Jumper).
When the module is installed in the I/O chassis or when logic
power (from the I/O power supply modules) is first applied to
the module, it will be in the shutdown mode until the first
output scan, regardless of the fault mode jumper settings.
Also, removing two I/O transceiver modules, tw
o I/O power
supply modules, or two power legs will cause the module to be
in the shutdown mode.
PD-6026
Mar-06
5
Guarded Analog Output Modules
(T3480)
6
Figure 2. Guarded Analog Output Module.
Industrial Control Services
Guarded Analog Output Modules
(T3480)
Application
Guarded analog output modules are suited for high integrity
control of analog output devices. Guarded output modules can
be used for fail-safe or fault tolerant operation.
Fail-Safe Configuration
As shown in Figure 3, fail-safe configuration uses a single
Guarded module. I
will cause the output to fail to the off state.
In a fail-safe configuration, a module failure and subsequent
removal of the module disables all of its outputs.
n this configuration, the worst case failure
PD-6026
Mar-06
Figure 3. Fail-Safe Configuration.
Fault Tolerant Configuration
For fault tolerant operation, two Guarded modules are
connected in parallel as shown in Figure 4. In this
configuration, operation continues even if on
In the fault tolerant configuration, a failed module can be
removed and replaced without interrupting operation of the
loads.
7
e module fails.
Important!
Guarded Analog Output Modules
(T3480)
Figure 4. Fault Tolerant Configuration.
Field Wiring
Field wiring terminal blocks on the I/O chassis are used to
connect power sources and loads to the module. The terminal
blocks are located directly above and below the slot where the
module is installed. Each terminal block consists of ten #6
wire clamp scr
wires. Figure 5 shows the proper field wiring for a single
module and Figure 6 shows the field wiring for fault tolerant
modules connected in parallel.
Two terminals are provided for connecting to each output load
device. All six analog output channels must be connected to a
load device or else the output circuit testing will fail. For each
unused spare output channel, short its two output terminals
t
ogether by installing a wire across the appropriate terminals
on the I/O chassis.
Each module has one-pair of terminals for connecting an
external 24 VDC field power supply to power the field-side D/A
circuits and output current signals. Output circuit testing
requires the presence of this field power. If the field power is
disconnected, output testing fails and a module fault is
indicated.
ew terminals capable of holding two 12 AWG
8
When two guarded analog output modules are used in a fault
tolerant configuration, the A and B termina
strapped between the two modules as shown in Figure 6.
Industrial Control Services
ls must be cross
Guarded Analog Output Modules
(T3480)
PD-6026
Mar-06
Figure 5. Fail Safe Field Wiring.
9
Loading...