Rockwell Automation T3485 User Manual

ICS Regent

®

PD-6034

Isolated Guarded Output Modules

24 to 120 VAC/DC

(T3485)

Issue 1,

The Isolated Guarded output module provides Guarded
control of eight isolated user output loads. One type of module
is available to interface to outputs powered from isolated field
power supplies operating between 12 to 130 VAC or 15 to 150
VDC. This module is called Guarded because the module's
dual-redundant design ensures that no single fault within the
module will inadvertently apply power to an output. The
module is ideally suited for controlling isolated, safety critical
inductive loads such as motor starters. Other applications
include output circuits that contain additional safety interlock
contacts or switches in series with the module outputs.

March, 06

Features

·

Eight isolated Guarded outputs.

•

Fault tolerant operation when connected in parallel with
another module of the same type.

•

Hot-replaceable.

•

Complete, automatic testing of all output circuits, independent
o

f load or field power connection.

•

Individual front panel indicators on each module show module
fault/active status and shutdown state; addi
show output on/off status and blown fuse for each point.

·

Fuses accessible from front panel.

•

2500 minimum electrical isolation between field and logic
circuits.

·

TÜV certified, Risk Class 5.

The module's triplicated Safetybus interface ensures that no
Regent system failure will inadvertently apply power to an
output. Extensive fault detection and redundant critical
circuits ensure that the module operates in a fail-safe manner.

tional indicators

Industrial Control Services

1

Isolated Guarded Digital Output Module (T3485)

Two isolated Guarded output modules can be connected in
parallel to obtain fault tolerant control of power to loads. In
this parallel module configuration, either module can be
removed and replaced while the other Guarded module
continues to control the loads without interr

uption.

Module Operation

A block diagram of a typical isolated Guarded digital output
module is shown in Figure 1.

2

Figure 1. Block Diagram of Isolated Guarded Digital Output Module.

The processor modules send triplicated write data commands
over the I/O Safetybus to the isolated Guarded output module.
Onboard the output module the triplicated data are routed to
two independent voters which provide voted data to associated

Industrial Control Services

Isolated Guarded Digital Output Module

Case

Commanded

Output State

Switch

Failed

State

Actual

Output

to Load

Remarks

1 On

On On

Continued correct control.
Automatic testing detects
stuck-on switch. If output is
subsequently commanded
off, output will turn off.

2 On

Off Off

Fail-safe output. Automatic
testing detects stuck-off
switch.

3 Off

On

Off

Continued correct control.
Automatic testing detects
stuck-on switch. If output is
subsequently commanded
on, output will turn on.

4 Off

Off Off

Fail-safe output. Automatic
testing detects stuck-off
switch. If output is subse

­quently commanded on,
output will remain off.

(T3485)

field programmable gate arrays (FPGA). Each FPGA
independently operates one of the two output control switches.
The two output switches are connected in series with the load.

When both output switches are on, current will flow through
the output and energize a field load. If either switch is off,
current will not flow through the output and the load will be
de-energized. This combination of series output switches and
independent drive signals produces fail-safe activation of the
load. Single failures can only affect one of the output drive
signals or switches. A single failure will result in either
continued correct control or a fail-safe output as shown in
Table 1.

Table 1. Output States After Switch Failure.

PD-6034

Mar-06

To achieve fault tolerance, two isolated Guarded output
modules are used with their outputs connected in parallel.
This configuration provides for continued correct control even
when one output switch fails off (cases two and four in
Table 1). The module failure is automatically detected and
the module can be removed and replaced without interrupting
output control.

3

Isolated Guarded Digital Output Module (T3485)

Testing and Diagnostics

Automatic testing is performed on the isolated Guarded
output modules and its internal output circuits. The output
circuits are completely tested independent of any field load or
power connections. The module does not per
monitoring of the wiring connections to field loads.

Module Testing

form line

Each voter and FPGA logic section of the isolated Guarded
output module is automatically tested by the processor
modules. Discrepant data are sent through one of three legs
of the I/O Safetybus to determine whether the module’s voters
are able to outvote the incorrect data. A failure to return the
correct majority-voted result to the processors produces an I/O
module error indication at the processor modules and a
module fault indication at the I/O module.

Each type of module has a unique identification code that is
read by the controller. This code lets the controller know
which type of module is installed in each I/O chassis slot and
how to address that module and its points specifically. If a
module is removed, or is replaced with a module of a different
type, the processor modules will indicate an I/O module error.

Loopback logic tests periodically write data to the module and
then read it back to determine whether the m
interface logic is functioning correctly.

Output Circuit Testing

odule’s I/O bus

The output circuits of the isolated Guarded output module are
automatically tested to detect failures in the redundant
output switch circuits on-board the module. The output fuses
are also checked for blown fuse conditions.

Output Switch Testing

To detect a failure in the redundant output switch circuits,
each output switch is checked for turn-on and turn-off
capability. Periodically, each output switch circuit on the
mod

ule is tested for its ability to change its current state.
During testing, the output state is changed; outputs that are
on are turned off and outputs that are off are turned on.
Output switch testing is no-coincident and does not produce a
turn-on pulse to the load. Two output test pulses are

4

Industrial Control Services

Isolated Guarded Digital Output Module

Note:

(T3485)

performed on each switch to eliminate the effects of AC phase
on the test.

When two isolated Guarded output modules are wired in
parallel for fault tolerance, the output circuit testing is non
coincident between t
disturb the load in either the on or off state.

he modules and the test pulses do not

-

When an output switch is tested, the test pulse duration is
nominally 125 msec, and is insufficient to affect the state of
most field loads. The output circuit test interval will range
from 1 to 60 seconds, depending on the quantity of I/O
configured in the system.

If an output switch doesn’t change state when tested, an
output switch fault is detected. An output switch failure is
annun

ciated as a module fault. An I/O module fault is
indicated by the module FAULT LED on the module, the red
I/O fault LEDs on the processor modules and the system
control relay fault bit for the module assembly and slot.

Output Fuse Monitoring

For each output, the voltage at the fuse terminal is monitored
and the optically coupled signal is sensed by the FPGAs. If a
fuse blows, the corresponding output’s blown fuse LED is
illuminated on the front of the module and a module fault is
also indicated.

There are three instances when a blown fuse will not be
detected. These are described below.

1)

For DC voltage applications, the positive side of the
field power source must be connected to the “IN”
terminal and the load must be connected to the fused

2)

“OUT” terminal for proper blown fuse detection.
If dual modules are wired in parallel for fault tolerance,

when an output is on and only one of the two modules’
fuse blows, the blown fuse is not detected. This effect

3)

will not normally occur, because if
circuit occurs, both modules’ fuse should blow.

When an output is fully connected to a load and power

an output load short

source, and the output is in the off state, if the field
power supply is not powered (i.e. the power source’s

PD-6034

Mar-06

5

Isolated Guarded Digital Output Module (T3485)

primary voltage is switched off) a blown fuse will not be
detected. This is illustrated in Figure 2.

Figure 2. Case 3: No Blown Fuse Detection.

Front Panel

Figure 3 shows the physical features of the isolated Guarded
output module. The front panel of the module contains a
module active and fault status indicator, a shutdown
indicator, as well as output fuses, output status indicators and
blown fuse indicators for the output circuits.

Active/Fault Status Indicators

These green and red LEDs indicate the overall health of the
module and output circuits. During normal operation, the
green ACTIVE indicator flashes at the controller's scan rate.
If a module fault
on and the green ACTIVE indicator turns off.

is detected, the red FAULT indicator turns

6

Industrial Control Services

Isolated Guarded Digital Output Module

(T3485)

PD-6034

Mar-06

Figure 3. Isolated Guarded Output Module.

7