Trusted
TM
PD-T8472
TMR 120VAC Digital Output
Module – 16 Channel
Introduction
M
The Trusted
tests are performed throughout the module including measurements for current and voltage on each
portion of the voted output channel. Tests are also performed for stuck on and stuck off failures. Fault
tolerance is achieved through a Triple Modular Redundant (TMR) architecture within the System Side
and ‘Quad Element’ redundancy for each of the 16 output channel circuits.
The module provides on-board Sequence of Events (SOE) reporting with a resolution of 1ms. An
output change of state triggers an SOE entry. Output states are automatically determined by multiple
voltage and current measurements for each of the 16 channels of the module.
T
120VAC Digital Output module interfaces to 16 field devices. Triplicated diagnostic
Features
• Triplicated TMR system architecture, with fault tolerant output switching.
• 16 Output Channels: 120Vac, 0.5A per channel, field powered as two groups of 8
• Comprehensive, automatic diagnostics and self-test.
• Short circuit monitoring per channel when energised (requires regular proof testing for
safety related normally de-energised outputs, e.g. F&G)
• Open circuit monitoring when energised or de-energised2500Vdc optical and magnetic
isolation barrier.
• Automatic channel over-current protection, no fuses required.
• On-board Sequence of Events (SOE) reporting with 1ms resolution.
• Module can be hot-replaced on-line using dedicated ‘Companion Slot’ (adjacent slot) or
SmartSlot (one spare slot for many modules) configurations.
• Front panel output status LED’s for each channel indicate output status and field wiring
faults.
• Front panel module status LED’s indicate module health and operational mode (Active,
Standby, Educated)
=V Certified IEC 61508, SIL 3
• T
Issue 13 Sep 11 PD-T8472 1
Trusted
TM
Module T8472
Table of Contents
1. Description...................................................................................................................................... 6
Field Termination Unit (FTU) .......................................................................................................... 7
1.1.
Field Interface Unit (FIU) ................................................................................................................ 7
1.2.
1.3.
Host Interface Unit (HIU) ................................................................................................................ 8
Front Panel Unit (FPU) ................................................................................................................... 8
1.4.
Line monitoring and output states .................................................................................................. 9
1.5.
Housekeeping ................................................................................................................................ 9
1.6.
Fault Detection / Testing ................................................................................................................ 9
1.7.
Sequence of Events Characteristics ............................................................................................ 10
1.8.
1.9. Output Switch Structure................................................................................................................ 10
2. Installation .................................................................................................................................... 11
2.1. Module Insertion/Removal ............................................................................................................ 11
2.2. Field Power Connection ............................................................................................................... 12
2.2.1. Cable Impedance ......................................................................................................................... 12
2.3. Termination .................................................................................................................................. 12
2.4. Module Pinout Connections .......................................................................................................... 12
2.5. Trusted module polarisation / keying ............................................................................................ 13
3. A p p l i c a t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
3.1. Module Configuration ................................................................................................................... 14
3.2. T8472 Complex Equipment Definition .......................................................................................... 14
3.2.1. Rack 1: DO ................................................................................................................................... 15
3.2.2. Rack 2: STATE ............................................................................................................................. 15
3.2.3. Rack 3: AI - Channel Field Voltage .............................................................................................. 16
3.2.4. Rack 4: CI – Channel Field Current ............................................................................................. 17
3.2.5. Rack 5: LINE_FLT ........................................................................................................................ 17
3.2.6. Rack 6: DISCREP ........................................................................................................................ 17
3.2.7. Rack 7: Housekeeping ................................................................................................................. 18
3.2.8. Rack 8: INFO ................................................................................................................................ 19
3.3. Sequence of Events Configuration ............................................................................................... 20
3.4. SYSTEM.INI File Configuration .................................................................................................... 20
4. O p e r a t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
4.1. Front Panel Indications ................................................................................................................. 21
4.2. Module Status LEDs ..................................................................................................................... 22
4.3. I/O Status LEDs ............................................................................................................................ 23
5. Fault Finding and Maintenance .................................................................................................... 24
5.1. Fault Reporting ............................................................................................................................. 24
5.2. Field Wiring Faults ........................................................................................................................ 24
Issue 13 Sep 11 PD-T8472 2
Trusted
5.3. Module Faults ............................................................................................................................... 24
5.4. Companion Slot ............................................................................................................................ 24
5.5. S m a r t S l o t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
5.6. Cold Start ...................................................................................................................................... 25
5.7. Active and Standby Transfers ...................................................................................................... 26
6. 120VAC Digital Output Module Specification ............................................................................... 27
TM
Module T8472
Figures
Figure 1 Module Architecture .................................................................................................................... 6
Figure 2 FIU Architecture.......................................................................................................................... 7
Figure 5 Module polarisation .................................................................................................................. 13
Figure 6 Module Front Panel .................................................................................................................. 21
Tables
Table 1 Line Monitoring Fault Status ........................................................................................................ 9
Table 3 Complex Equipment Definition .................................................................................................. 14
Table 4 OEM Parameters ....................................................................................................................... 15
Table 5 Rack 1: DO descriptions ............................................................................................................ 15
Table 6 Rack 2: STATE descriptions...................................................................................................... 15
Table 7 Rack 2: STATE Output descriptions .......................................................................................... 16
Table 8 Rack 3: AI descriptions .............................................................................................................. 16
Table 9 Rack 4: CI descriptions .............................................................................................................. 17
Table 10 Rack 5: LINE_FLT descriptions ............................................................................................... 17
Table 11 Rack 6: DISCREP bit descriptions .......................................................................................... 17
Table 12 Rack 7: Housekeeping descriptions ........................................................................................ 18
Table 13 Rack 8: INFO descriptions ....................................................................................................... 19
Table 14 Rack 8: INFO bit descriptions .................................................................................................. 19
Table 15 Rack 8: FCR bit descriptions ................................................................................................... 20
Table 16 Module Status LEDs ................................................................................................................ 22
Table 17 Default I/O Status LEDs .......................................................................................................... 23
Issue 13 Sep 11 PD-T8472 3
Trusted
TM
Module T8472
Notice
he content of this document is confidential to ICS Triplex Technology Ltd. companies and their
T
partners. It may not be given away, lent, resold, hired out or made available to a third party for any
purpose without the written consent of ICS Triplex Technology Ltd.
This document contains proprietary information that is protected by copyright. All rights are reserved.
Microsoft, Windows, Windows 95, Windows NT, Windows 2000, and Windows XP are registered
trademarks of Microsoft Corporation.
The information contained in this document is subject to change without notice. The reader should, in
all cases, consult ICS Triplex Technology Ltd. to determine whether any such changes have been
made. From time to time, amendments to this document will be made as necessary and will be
distributed by ICS Triplex Technology Ltd.
Information in this documentation set may be subject to change without notice and does not represent
a commitment on the part of ICS Triplex Technology Ltd..
The contents of this document, which may also include the loan of software tools, are subject to the
confidentiality and other clause(s) within the Integrator Agreement and Software License Agreement.
No part of this documentation may be reproduced or transmitted in any form or by any means,
electronic or mechanical, including photocopying and recording, for any purpose, without the express
written permission of ICS Triplex Technology Ltd.
Disclaimer
The illustrations, figures, charts, and layout examples in this manual are intended solely to illustrate the
text of this manual.
The user of, and those responsible for applying this equipment, must satisfy themselves as to the
acceptability of each application and use of this equipment.
This document is based on information available at the time of its publication. While efforts have been
made to be accurate, the information contained herein does not purport to cover all details or variations
in hardware or software, nor to provide for every possible contingency in connection with installation,
operation, or maintenance. Features may be described herein which are present in all hardware or
software systems. ICS Triplex Technology Ltd. assumes no obligation of notice to holders of this
document with respect to changes subsequently made.
ICS Triplex Technology Ltd. makes no representation or warranty, expressed, implied, or statutory with
respect to, and assumes no responsibility for the accuracy, completeness, sufficiency, or usefulness of
the information contained herein. No warranties of merchantability or fitness for purpose shall apply.
Issue 13 Sep 11 PD-T8472 4
Trusted
TM
Module T8472
Revision and Updating Policy
All new and revised information pertinent to this document shall be issued by ICS Triplex Technology
Ltd. and shall be incorporated into this document in accordance with the enclosed instructions. The
change is to be recorded on the Amendment Record of this document.
Precautionary Information
WARNING
Warning notices call attention to the use of materials, processes, methods, procedures or limits which
must be followed precisely to avoid personal injury or death.
CAUTION
Caution notices call attention to methods and procedures which must be followed to avoid damage to
the equipment.
Notes:
Notes highlight procedures and contain information to assist the user in the understanding of the
information contained in this document
Warning
RADIO FREQUENCY INTERFERENCE
Most electronic equipment is influenced by Radio Frequency Interference (RFI). Caution should be
exercised with regard to the use of portable communications equipment around such equipment.
Signs should be posted in the vicinity of the equipment cautioning against the use of portable
communications equipment.
MAINTENANCE
Maintenance must be performed only by qualified personnel, otherwise personal injury or death, or
damage to the system may be caused.
Caution
HANDLING
Under no circumstances should the module housing be removed.
Associated Documents
Product Descriptions (PD) provide product specific information.
The Safety Manual contains the recommended safety requirements for the safety system design.
The PD8082B – Toolset Suite provides specific guidance on system configuration and application
generation.
The Operator and Maintenance Manual contains general guidelines on maintenance and diagnostic
procedures.
For technical support email: support@icstriplex.com
Issue 13 Sep 11 PD-T8472 5
Trusted
SmartSlot
Switched Outputs
Switched Outputs
MON
MON
TMR IMB
TM
Module T8472
1. Description
The TMR 120VAC Digital Output module is a member of the TrustedTM range of Input/Output (I/O)
modules. All Trusted
M
T
I/O modules share common functionality and form. At the most general level,
all I/O modules interface to the Inter-Module Bus (IMB) which provides power and allows
communication with the TMR Processor. In addition, all modules have a field interface that is used to
connect to module specific signals in the field. All modules system circuits are Triple Modular
Redundant (TMR). The AC Output Module has 16 Quad fully isolated and monitored channel AC
output switches. configured as two Groups of 8, each group having its own field supply input and field
supply monitoring.
FTU
FIU
Bus
A
B
C
INTERNAL
VOTER BUS
SmartSlot
Link
HIU
Ch 1
Ch
Link
FIELD
SUPPL
1
to
Ch
SLICE
A
Ch 16
2oo3
Voters
2
Ch
3
Group 1 (G1)
Ch
4
FIELD
SLICE
B
SUPPL
Y Ch
Ch 9
Ch
10
Ch
SLICE
C
11
Ch
Group 2 (G2)
12
Ch
Ch1 -Ch16 Dual
FPU
FRONT PANEL DISPLAY
2500 Vdc
ISOLATION
Redundant Isolated
AC O/P Channel
Switches
Figure 1 Module Architecture
This ‘High Integrity I/O module’ comprises 4 PCB’s: Host Interface Unit (HIU), the Field Interface Unit
(FIU), the Field Termination Unit (FTU), and the Front Panel Unit (or FPU).
Issue 13 Sep 11 PD-T8472 6
Trusted
QAQBQC
QD
SLICE
SLICE
SLICE
TM
Module T8472
1.1. Field Termination Unit (FTU)
The Field Termination Unit (FTU) contains the circuitry for the ‘Quad Element’ Channel Switches Ch 9
to Ch 16. (Circuitry for Switches Ch1 to Ch 8 are located on the FIU.)
The FTU contains the Field Output Connector, therefore all Field Connections come from or route via
the FTU.
When installed in a Chassis, the FTU field connector accepts the Field I/O Cable Assembly attached at
the rear of the chassis.
1.2. Field Interface Unit (FIU)
The Field Interface Unit (FIU) is the section of the module that contains the specific circuits necessary
to interface to the particular types of field I/O signals. Unlike other Trusted
has four FIUs. References to OFIU refer to specifically OUTPUT Module functions. Each FIU slice
operates one switch element (QA,QB, QC or QD) in each of the 16 output channels, as shown in the
figure below:
TMR
TMR
TMR
TMR
TMR
(Quad
FIU-
FIU-
FIU-
FIU-
{ }
{ }
{ }
{ }
(Quad Element
Switches)
TM
I/O modules, the T8472
Field
Supply
Live
Switched
Channel
Field
Output
HIU FIU
TMR (Inter
Modular
Figure 2 FIU Architecture
Issue 13 Sep 11 PD-T8472 7
2500V dc
ISOLATIO
FTU
FTU
Field
Load
Field Supply
Return
Trusted
he switch commands from each HIU slice are voted by each FIU switch interface circuit and
T
conversely, each FIU slice relays diagnostic information back to the three HIU slices for further
processing. The overall functions of the FIU are summarised below:
Control function – The FIU receives and decodes ON/OFF commands from the HIU for each of the
switch elements and forwards the commands to the appropriate switches.
onitoring function – The FIU receives and processes measurement data from each of the switch
M
elements and forwards the results to the HIU.
Isolation – The FIU provides galvanic isolation between logic and field.
The majority voting carried out in the FIU ensures that any single slice failure in the HIU does not
degrade the output switch operation. Under those circumstances, all output switches would continue to
function correctly so long as two out of the three control circuits were operational. A second slice failure
would therefore ensure the quad output switches degraded to a known (‘OFF’ or ‘Normally – Open’)
state.
TM
Module T8472
1.3. Host Interface Unit (HIU)
The HIU is the point of access to the Inter-Module Bus (IMB) for the module, it is the only section of the
I/O module to directly connect to the IMB backplane. The HIU also provides power distribution and
local programmable processing power. The HIU is common to most high integrity I/O types and has
type dependent and product range common functions. Each HIU contains three independent sections,
known as ‘slices’, commonly referred to as A, B, and C. All interconnections between the three slices
incorporate isolation to prevent any fault interaction between the slices. Each slice is considered a
Fault Containment Region (FCR), as a fault on one slice has no effect on the operation of the other
slices.
The HIU provides the following services common to the modules in the family:
• High Speed Fault-Tolerant Communications with the TMR Processor via the IMB interface.
• FCR Interconnect Bus between slices to vote incoming IMB data and distribute outgoing I/O
module data to IMB.
• Optically isolated serial data interface to the FIU slices.
• Redundant power sharing of dual 24V dc chassis supply voltage and power regulation for logic
power to HIU circuitry.
• Serial data interface to the FPU for module status LED’s.
• Digital Signal Processing to perform local data reduction and self-diagnostics.
• Local memory resources for storing module operation, configuration, and field I/O data.
• On-board housekeeping, which monitors reference voltages, current consumption and board
temperature.
1.4. Front Panel Unit (FPU)
The Front Panel Unit (FPU) contains the necessary connectors, switches, logic, and LED indicators for
the front panel. For every module, the FPU contains the Slice Healthy, Active/Standby, the Educated
indicators (LED’s), and the module removal switches. Additional bi-colour LED’s provide status
indication for the individual I/O signals. Serial data interfaces connect the FPU to each of the HIU
slices to control the LED status indicators and monitor the module removal switches
•
Issue 13 Sep 11 PD-T8472 8
Trusted
TM
Module T8472
1.5. Line monitoring and output states
The module automatically monitors the output channel current and voltage (indirectly) to determine the
state of the output channel. The numerical output state and line fault status are reported back to the
application and are represented below.
Description
Field Short Circuit
Output Energised (On) 4 0
No Load, Field Open Circuit 3 1
Output De-energised (Off) 2 0
No Field Supply Voltage 1 1
1 Short circuits are not detected when the output is de-energized.
1
Table 1 Line Monitoring Fault Status
Numerical
Output State
5 1
Line Fault
Status
1.6. Housekeeping
The output module automatically performs local measurements of on-board signals that can be used
for troubleshooting and verification of module operating characteristics. Measurements are made
within each slice’s HIU and FIU.
1.7. Fault Detection / Testing
Extensive diagnostics provide the automatic detection of module faults. The TMR architecture of the
output module and the diagnostics performed ensure the validity of all critical circuits. Using the TMR
architecture provides a Fault Tolerant method to withstand the first fault occurrence on the module and
continue normal output controls without interruption in the system or process. Faults are reported to
the user through the Healthy status indicators on the front panel of the module and through the
information reported to the TMR Processor. Under normal operations all three Healthy indicators are
green. When a fault occurs, one of the Healthy indicators will be flashing red. It is recommended that
this condition is investigated and if the cause is within the module, it should be replaced.
Module replacement activities depend on the type of spare module configuration chosen when the
system was configured and installed. The module may be configured with a dedicated Companion Slot
or may use a separate Smart Slot. The I/O module contains extensive fault detection and integrity
testing. As an output device, all testing is performed in a non-interfering mode. Data input from the
IMB is stored in redundant error-correcting RAM (Random Access Memory) on each slice portion of
the HIU. Received data is voted on by each slice. All data transmissions include a confirmation
response from the receiver.
Periodically, the TMR Processor commands the onboard DSPs (digital signal processors) to perform a
Safety Layer Test (SLT). The SLT results in the DSP verifying with the TMR Processor its ability to
process data with integrity. In addition, the DSP uses Cyclical Redundancy Checks (CRC) to verify the
variables and configuration stored in Flash memory.
Between the FIU and the Field Output Switch Element circuits are a series of magnetically isolated
links for data and power. The data link is synchronised and monitored for variance. The HIU has
onboard temperature sensors to characterise temperature-related problems. The power supply for the
HIU board is redundant, fully monitored and testable.
Issue 13 Sep 11 PD-T8472 9
Trusted
TM
Module T8472
1.8. Sequence of Events Characteristics
The module automatically measures the field voltage and current to determine the state of each output
channel. An event occurs when the output transitions from one state to another. When a channel
hanges state, the on-board timer value is recorded. When the TMR Processor next reads data from
c
the output module, the channel state and real-time clock value are retrieved. The TMR Processor
uses this data to log the state change into the system Sequence of Events (SOE) log. The user may
configure each output to be included in the system SOE log.
Full details of SOE are contained in PD-T8013 SOE and Process Historian.
1.9. Output Switch Structure
The Digital Output Module provides a QUAD ELEMENT switch topology where each load is driven by a
total of four fully monitored, fail-safe (4 element) ‘high-side’ switches configured as a dual redundant
series / parallel combination. With this configuration a failed Switch Element (either failed open or
failed short circuited) can be isolated and switch channel functionality maintained.
The 16 output channels are configured as two groups of 8 each and each group has its own field
supply connections.
Group 1 Output Channels (Ch1 to Ch8) are physically resident on the FIU board.
Group 2 Output Channels (Ch9 to Ch16) are physically resident on the FTU board.
Due to the majority voting scheme incorporated on FIU-QA, QB, QC and QD voters, any single HIU
main slice A, B & C failure will not result in the loss of any Switch Element operation.
Issue 13 Sep 11 PD-T8472 10
Trusted
TM
Module T8472
2. Installation
2.1. Module Insertion/Removal
CAUTION:
The module contains static sensitive parts. Static handling precautions must be observed. Specifically
ensure that exposed connector pins ARE NOT TOUCHED. Under no circumstances should the
module housing BE REMOVED.
Before installation, visually inspect the module for damage. Ensure that the module housing appears
undamaged and inspect the I/O connector at the back of the module for bent pins. If the module
appears damaged or any pins are bent, do not install the module. Do not try to straighten bent pins.
Return the module for replacement.
Ensure that the module is of the correct type.
Record the module type, revision and serial number of the module before installation.
To install the module:
1. Ensure that the field cable assembly is installed and correctly located.
2. If I/O module keys are used, verify that all keys are installed in the correct positions and
properly seated in their slots.
3. Release the ejector tabs on the module using the release key. Ensure that the ejector tabs
are fully open.
4. Holding the ejectors, carefully insert the module into the intended slot.
5. Push the module fully home by pressing on the top and bottom of the module fascia.
6. Close the module ejectors, ensuring that they click into their locked position.
The module should mount into the chassis with a minimum of resistance. If the module does not
mount easily, do not force it. Remove the module and check it for bent or damaged pins. If the pins
have not been damaged, try reinstalling the module.
Issue 13 Sep 11 PD-T8472 11
Trusted
TM
Module T8472
2.2. Field Power Connection
May be connected at the T8871 Field Termination Adapter. However Field Power may be connected
any where along the cable by pulling the Field Power Cables (Grey & White) out of the outer sheath
nd connecting onto suitable junction boxes.
a
2.2.1. Cable Impedance
Custom length multi-core FTA cables are 0.5mm2with a resistance of 40M/km. eg a 50m cable will
have 4M loop impedance at 0.5A, this equates to a 2Vdc volt drop.
2.3. Termination
Unused channels should be commanded OFF and may be fitted with a 33k 2W resistor to prevent noload detection.
2.4. Module Pinout Connections
Field Connections are made to the Modules DIN41612 type D Field Connector:
Pin No. Row a Row c
2 (SMART_SLOT_A) (SMART_SLOT_B)
4 (SMART_SLOT_C) spare
6 V_RET_CH9_16 V_RET_CH1_8
8 V_FIELD_CH9_16 V_FIELD_CH1_8
10 V_FIELD_CH9_16 V_FIELD_CH1_8
12 V_FIELD_CH9_16 V_FIELD_CH1_8
14 V_FIELD_CH9_16 V_FIELD_CH1_8
16 V_FIELD_CH9_16 V_FIELD_CH1_8
18 LOAD_CH9 LOAD_CH1
20 LOAD_CH10 LOAD_CH2
22 LOAD_CH11 LOAD_CH3
24 LOAD_CH12 LOAD_CH4
26 LOAD_CH13 LOAD_CH5
28 LOAD_CH14 LOAD_CH6
30 LOAD_CH15 LOAD_CH7
32 LOAD_CH16 LOAD_CH8
Table 2 Field Connector Pin-Out
Issue 13 Sep 11 PD-T8472 12
Trusted
identified below)
TM
Module T8472
2.5. Trusted module polarisation / keying
Due to the high voltages used by the T8472 AC DO Module it differs from other I/O Modules. The
T8472 AC DO Module Field Connector is a 32 way DIN 41612 Type ‘d’. (Contact spacing on the type
d’ is 0.2 inches and a larger contact is used.)
‘
Therefore the T8472 AC DO Module has a specific unique set of Field Cables, TC-221 or TC-521.
Refer to product descriptions PD-TC200 and PD-TC500 for further information. Other I/O Modules use
the 96 way DIN 41612 Type ‘c’ as their Field Connector, note however a type ‘c; connector will in fact
mate to a type ‘d’ connector.
For this reason Modules may be ‘Keyed’ to prevent insertion into the wrong connector within a chassis.
The polarisation comprises two parts. The module has key holes and the associated chassis / field
cable connectors have key pegs. Holes may be plugged with small plastic ‘bungs’ and the
corresponding connector pegs removed in a designated pattern to set the Modules Key Code.
Each module type will be keyed during manufacture. The organisation responsible for the integration of
the Trusted system must key the cable by removing the keying pieces from the cable so that they
correspond with the bungs fitted to the associated module prior to fitting.
Cable Exit
1
Polarising/Keying
Pins.
(Remove using
side cutters where
12
Trusted Cable
hood
Release button
Figure 3 Module polarisation
For Companion slot installations both keying strips must be polarised
For This Module (T8472) remove keying pins 1, 5, 9
Smart
Swap
Connector
if Fitted
Issue 13 Sep 11 PD-T8472 13
Trusted
TM
Module T8472
3. Application
3.1. Module Configuration
There is no configuration required to the physical output module. All configurable characteristics of the
module are performed using tools on the EWS and become part of the application or system.ini file
that is loaded into the TMR Processor. The TMR Processor automatically configures the output
module after applications are downloaded and during Active/Standby changeover.
The IEC1131 toolset provides the main interface to configure the output module. Details of the
configuration tools and configuration sequence are provided in PD-8082B Trusted
There are three procedures necessary to configure the output module. These are:
1. Define the necessary I/O variables for the field output data and module status data using the
Dictionary Editor of the IEC1131 toolset.
2. Create an I/O module definition in the I/O Connection Editor for each I/O module. The I/O
module definition defines physical information, e.g. Chassis and Slot location, and allows
variables to be connected to the I/O channels of the module.
M
T
3. Using the Trusted
per-channel default or fail-safe states, and other module settings.
System Configuration Manager, define custom LED indicator modes,
TM
Toolset Suite.
3.2. T8472 Complex Equipment Definition
The T8472 I/O Complex Equipment Definition includes 8 I/O boards, referenced numerically by Rack
number:
Rack I/O Board Description Data Type Direction No. of
Channels
1 DO
2 STATE Field Output State Integer In 16
3 AI Output voltage Integer In 16
4 CI Output current Integer In 16
5 LINE_FLT Line Fault Status Boolean In 16
6 DISCREP Channel Discrepancy Integer In 1
7 HKEEPING Housekeeping Registers Integer In 57
8 INFO I/O Module Information Integer In 11
OEM Parameters - - -
Field Output Status Boolean Out 16
Table 3 Complex Equipment Definition
There are two OEM parameters included in the first rack (DO Board). These OEM parameters define
the primary module position; declaring the module’s chassis and slot location. There is no need to
define the secondary module position within the IEC1131 toolset. Where systems may be required to
start-up with modules in the secondary position as the active module, e.g. primary module is not
installed when application is started, the secondary module’s position should be declared in the module
definition of the System Configuration Manager.
Issue 13 Sep 11 PD-T8472 14
Trusted
OEM Parameter Description Notes
TICS_CHASSIS The number of the Chassis
T
TM
Module T8472
where the Primary I/O
module is installed
ICS_SLOT The slot number in the
chassis where the Primary
I/O module is installed
Table 4 OEM Parameters
The Controller Chassis is 1, and Expander
Chassis are 2 to 15
he I/O module slots in the Controller chassis are
T
numbered from 1 to 8. The I/O Module slots in the
Expander Chassis are numbered from 1 to 12
3.2.1. Rack 1: DO
This board provides the connection to the logical output control signal for each of the field outputs.
Channel Description
1 Field output channel 1 logical state
2 Field output channel 2 logical state
16 Field output channel 16 logical state
Table 5 Rack 1: DO descriptions
The user application should set the output control signal to true (logic ‘1’) to turn ON or energise an
output, and false (logic ‘0’) to turn OFF or de-energise an output.
3.2.2. Rack 2: STATE
This board provides the majority voted numerical output state. This indicates the operational status of
the output channel and associated field connection.
Channel Description
1 Field output channel 1 state
2 Field output channel 2 state
16 Field output channel 16 state
Table 6 Rack 2: STATE descriptions
Issue 13 Sep 11 PD-T8472 15
Trusted
TM
Module T8472
Value Description
7 Channel fault
6 Field fault (e.g. field leakage to 0V or 24V)
5 Short circuit in field wiring or load
4
Output energised (ON)
3 Open circuit in field wiring or load
2 Output de-energised (OFF)
1 No field supply voltage
0 Unused
Table 7 Rack 2: STATE Output descriptions
3.2.3. Rack 3: AI - Channel Field Voltage
The AI board returns the field loop voltage at the output.
Channel Description
1 Field output channel 1 voltage
2 Field output channel 2 voltage
16 Field output channel 16 voltage
Table 8 Rack 3: AI descriptions
The voltage is the median value taken from the triplicated module. The voltage level is reported as an
integer, with the units being
1
/
V. This may be used directly, scaled arithmetically or scaled using the
125
IEC1131 toolset conversion tables.
To scale the value arithmetically simply divide the returned ‘integer’ by 125 to return the voltage as
either a REAL or INTEGER as required.
Issue 13 Sep 11 PD-T8472 16
Trusted
he IEC1131 toolset conversion tables may be used to convert the value to engineering units, in this
T
case voltage. The full-scale range for this number format is decimal ±256, corresponding to physical
range –32000 to +32000.
TM
Module T8472
3.2.4. Rack 4: CI – Channel Field Current
he CI board returns the field loop current at the output.
T
Channel Description
1 Field output channel 1 current
2 Field output channel 2 current
16 Field output channel 16 current
Table 9 Rack 4: CI descriptions
The current is the sum value taken from the triplicated module. The current level is reported as an
integer, with the units being
IEC1131 toolset conversion tables.
To scale the value arithmetically simply divide the returned ‘integer’ by 1000 to return the current as
either a REAL or INTEGER as required.
The IEC1131 toolset conversion tables may be used to convert the value to engineering units, in this
case current. The full-scale range for this number format is decimal ±32, corresponding to physical
range –32000 to +32000.
1
/
A. This may be used directly, scaled arithmetically or scaled using the
1000
3.2.5. Rack 5: LINE_FLT
Channel Description
1 Field output channel 1 line fault
2 Field output channel 2 line fault
16 Field output channel 16 line fault
Table 10 Rack 5: LINE_FLT descriptions
The line fault input state is reported as true (logic ‘1’) for a line fault condition (open circuit, short circuit,
and no field supply voltage). The logic state is the majority voted value.
3.2.6. Rack 6: DISCREP
Channel Description
1 Discrepancy status outputs 1 to 16 (output
1 is LSB)
Table 11 Rack 6: DISCREP bit descriptions
Each of the bytes reports the discrepancy status of 8 output channels. The corresponding bit within
the byte is set to ‘1’ when a discrepancy condition is detected on that output channel’s output state
(rack 2).
Issue 13 Sep 11 PD-T8472 17
Trusted
TM
Module T8472
3.2.7. Rack 7: Housekeeping
Description
Channel
FCR Units (Full Scale Range)
Internal supply voltage (post regulator) -32768 32767 mV
Internal supply current (post regulator) -32768 32767 mA
Output voltage (post isolation) -32768 32767 mV
24V2 Output Voltage -32768 32767 mV
24V1 Output Voltage -32768 32767 mV
HIU Board Temperature -32768 32767 -
Front Panel Load Current -32768 32767 mA
SmartSlot Link Voltage -32768 32767 mV
FIU Output Group 1 Field Supply Voltage -32768 32767
FIU Output Group 2 Field Supply Voltage -32768 32767
Field Supply Frequency -32768 32767 Hz
FIU Board Temperature, Output Group 1 Average -32768 32767 -
FIU Board Temperature, Output Group 1 Peak -32768 32767 -
FIU Board Temperature, Output Group 1Peak Channel # -32768 32767
FIU Board Temperature, Output Group 2 Average -32768 32767 -
FIU Board Temperature, Output Group 2 Peak -32768 32767 -
FIU Board Temperature, Output Group 2Peak Channel -32768 32767
Update Count (Diagnostic only) -32768 32767
Diagnostic error code
Table 12 Rack 7: Housekeeping descriptions
Note: Slice A, B and C not applicable for all channels
Issue 13 Sep 11 PD-T8472 18
Trusted
Each input within the housekeeping rack is reported as an integer. In general, the application engineer
will not normally require these inputs. They are provided to aid fault finding and diagnosis and may be
used for reporting and display purposes. If a slice is Fatal, then all reported housekeeping inputs are
set to zero.
TM
Module T8472
3.2.8. Rack 8: INFO
Channel Description
1
2 Active Module slot number
3 Active Module Healthy
4 Active Module Mode
5 Standby Module Chassis Number
6 Standby Module Slot Number
7 Standby Module Healthy
8 Standby Module Mode
9 FCR Status
10 Primary module is active
11 Active module is simulated
Active Module chassis number
Table 13 Rack 8: INFO descriptions
The active module chassis and slot numbers indicate the position of the currently active module.
These values will change to match the primary or secondary module position, depending on their active
status, i.e. active/standby changeover will “swap” the values for the active module chassis and slot
number channels with those in the standby module chassis and slot number channels. The chassis
and slot numbers are set to zero if the module is not present.
The Active and Standby module healthy channel is returned as an integer, however only the least
significant bit is used. A value of 0 indicates that a fault has been detected, a non-zero value indicates
that the module is healthy.
The Active and Standby Module Mode is an integer indicating the current operating mode of the
associated module. The value indicates the current internal operating mode of the module.
Value Module Mode
5 Shutdown
4 Maintain
3 Active
2 Standby
1 Configuration
0 Unknown, no module present
Table 14 Rack 8: INFO bit descriptions
Issue 13 Sep 11 PD-T8472 19
Trusted
The FCR Status channel reports the fault status of the active and standby modules. The value is bitpacked as shown below, the least significant byte is used with the most significant 8-bits set to zero:
Bit
7 6 5 4 3 2 1 0
Standby Module Active Module
Ejector open FCR C
The ‘Primary Module is active’ channel is set to non-zero if the primary module is the current active
module, i.e. the active module is in the chassis and slot numbers defined within the OEM parameters.
The ‘Active Module is simulated’ channel is set to non-zero if the active module is being simulated, this
will only be set if the module is not present or the simulation enable has been set within the module’s
configuration in the system.ini file.
TM
Module T8472
Healthy
FCR B
Healthy
Table 15 Rack 8: FCR bit descriptions
FCR A
Healthy
Ejector
open
FCR C
Healthy
FCR B
Healthy
FCR A Healthy
3.3. Sequence of Events Configuration
Each Boolean Output Variable can be configured for automatic Sequence of Events (SOE) logging.
This applies to the Output Status and Line Fault Status variables. A Boolean variable is configured for
SOE during the variable definition in the Data Dictionary Editor. To select SOE, press the Extended
Button in the Boolean Variable Definition Dialog Box to open the Extended Definition Dialog. Then
check to box for Sequence of Events to enable the variable for automatic SOE logging.
During operation, the output module automatically reports time-stamped change of state information
for the output data. The TMR Processor automatically logs change of state for configured SOE
variables into the system SOE Log. The SOE Log can be monitored and retrieved using the SOE and
Process Historian Package running on the EWS. This software package is described in PD-8013.
3.4. SYSTEM.INI File Configuration
Certain characteristics apply to the entire module and are considered Module Configurable Items.
Other characteristics apply to individual output channels and are considered Channel Configurable
Items. There are specific default settings for each of the configurable items. If the default settings are
appropriate for a given application, then customisation of the module definition in the System
Configuration Manager is not required.
Issue 13 Sep 11 PD-T8472 20
Trusted
tuptu
Ola
tigiDca
V
021RMTdetsu
r
T
274
8
T
TM
Module T8472
4. Operation
4.1. Front Panel Indications
Status indicators on the front panel of the module provide visual indications of the module’s operational
status and field output status. Each indicator is a bicolour LED. Located at the top and bottom of each
module is an ejector lever that is used to remove the module from the chassis. Limit switches detect
the open/closed position of the ejector levers. The ejector levers are normally latched closed when the
module is firmly seated into the Controller or Expander Chassis.
Healthy
Active
Standby
Educated
21
43
65
87
109
1211
1413
1615
Figure 4 Module Front Panel
Issue 13 Sep 11 PD-T8472 21
Trusted
TM
Module T8472
4.2. Module Status LEDs
There are six module status indicators on the module front panel: three Healthy, one Active, one
Standby, and one Educated. The Healthy indicators are controlled directly by each module slice. The
Active, Standby, and Educated indicators are controlled by the FPU. The FPU receives data from
each of the module slices. The FPU performs a 2-oo-3 vote on each data bit from the slices and sets
the indicators accordingly.
The module status indicator modes and their meanings are described as follows:
Indicator State Description
Healthy Off No power applied to the module.
Amber Slice is in the start-up state (momentary after
installation or power-up)
Green Slice is healthy.
Red – flashing Fault present on the associated slice but the slice is still
operational.
Red (momentary) On installation – power applied to the associated slice.
Red The associated slice is in the fatal state. A critical fault
has been detected and the slice disabled..
Active Off Module is not in the Active state.
Green Module is in the Active (or Maintain) state.
Red – flashing Module is in the shutdown state (application stopped) if
the Standby LED is off.
Red – flashing Module is in the fatal state if the Standby LED is also
flashing.
Standby Off Module is not in the Standby state.
Green Module is in the Standby state.
Red – flashing Module is in the fatal state. The Active LED will also be
flashing red.
Educated Off Module is not educated.
Green Module is educated.
Green – flashing Module is recognised by the Processor but education is
not complete.
Amber - Flashing Active/standby changeover in progress
Table 16 Module Status LEDs
Issue 13 Sep 11 PD-T8472 22
Trusted
TM
Module T8472
4.3. I/O Status LEDs
There are 16 output channel status indicators on the module front panel, one for each field output.
These indicators are controlled by the FPU. The FPU receives data from each of the module slices.
he FPU performs a 2-oo-3 vote on each data bit from the slices and sets the indicators accordingly.
T
The output status indicator mode is dependent upon the numerical state of the output channel. Each
output state can be defined to have a particular indicator mode: off, green, red, flashing green, or
flashing red.
The configurable indicator modes allow users to customise the output status indications to suit
individual application requirements. Without customisation, the default indicator modes are suitable for
line-monitored digital output devices as described below:
Indicator State Description
Off Output is Off.
Green Output is On.
Green – flashing No Load, output open circuit.
Red Field short circuit, output over current protection triggered and output
channel is latched off.
Red – flashing Channel fault, or no field supply voltage
Table 17 Default I/O Status LEDs
Note: The LED’s indicating channel status may be configured to suit user requirements by
implementing the procedure for configuring the System.INI file detailed in PD-T8082.
Issue 13 Sep 11 PD-T8472 23
Trusted
TM
Module T8472
5. Fault Finding and Maintenance
5.1. Fault Reporting
Output module faults are reported to the user through visual indicators on the front panel of the module
and through status variables which may be automatically monitored in the application programs and
external system communications interfaces.
There are generally two types of faults that must be remedied by the user: external wiring and module
faults. External wiring faults require corrective action in the field to repair the fault condition. Module
faults require replacement of the output module.
5.2. Field Wiring Faults
By measuring the output channel voltage and current, the module automatically detects field-wiring and
load faults. When a field signal fails open circuit, short circuit or there is no field supply voltage
connected, the output status indicator will display the configured LED mode, the corresponding output
state will be reported and the line fault status for that channel will be set to ‘1’. All other output
channels will be unaffected, except in the case of common cause wiring and supply voltage faults in
the field.
The field output voltage and current variables can be monitored to determine the actual operating
conditions of each output channel. This additional information assists the user in determining the
specific type of wiring fault.
Once the specific field-wiring fault has been identified and corrected, the output status variables and
output status indicator will display the normal on/off status of the field device.
Note that short circuits are only detected when the output is energized.
5.3. Module Faults
Extensive diagnostics provide the automatic detection of module faults. The TMR architecture of the
output module and the diagnostics performed ensure the validity of all critical circuits. Using the TMR
architecture provides a Fault Tolerant method to withstand the first fault occurrence on the module and
continue normal output controls without interruption in the system or process. Faults are reported to
the user through the Healthy status indicators on the front panel of the module and through the INFO
and HKEEPING variables. Under normal operations all three Healthy Indicators are green. When a
fault occurs, one of the Healthy Indicators will be flashing red. It is recommended that this condition is
investigated and if the fault is within the module, it should be replaced.
Module replacement activities depend on the type of spare module configuration chosen when the
system was configured and installed. The module may be configured with a Dedicated ‘Companion’
Slot or with a Smart Slot for a spare replacement module.
5.4. Companion Slot
For a Companion Slot configuration, two adjacent slots in a Chassis are configured for the same input
module function. One slot is the primary slot and the other a unique secondary (also known as ‘spare’
or ‘hot-repair’) slot. The two slots are joined at the rear of the Chassis with a double-wide I/O Interface
Cable that connects both slots to common field wiring terminations. During normal operations, the
primary slot contains the active module as indicated by the Active indicator on the front panel of the
Issue 13 Sep 11 PD-T8472 24
Trusted
module. The secondary slot is available for a spare module that will normally be the standby module
as indicated by the Standby indicator on the front panel of the module.
Depending on the installation, a hot-spare module may already be installed, or a module blank will be
installed in the standby slot. If a hot-spare module is already installed, transfer to the standby module
occurs automatically when a module fault is detected in the active module. If a hot spare is not
installed, the system continues operating from the active module until a spare module is installed.
TM
Module T8472
5.5. SmartSlot
For a SmartSlot configuration, the secondary slot is not unique to each primary slot. Instead, a single
secondary slot is shared among many primary slots. This technique provides the highest density of
modules to be fitted in a given physical space. At the rear of the Trusted
Cable connects the secondary slot directly to the I/O Cable connected to the failed primary module.
With a spare module installed in the SmartSlot and the SmartSlot I/O Cable connected to the failed
primary module, the SmartSlot can be used to replace the failed primary module.
Output module Smart Slot jumper cable TC-310-02.
Smart Slot between chassis can be performed if the chassis are version 2 (or higher). These have the
connector fitted to enable connection of a TC-006 that ensures the 0 Volt of each chassis is at the
same potential.
TM
Chassis, a single-width I/O
5.6. Cold Start
If an I/O module has shut down (due, for example, to two existing faults), the three Healthy LEDs will
be red, the Active and Standby LEDs will be flashing red and the Educated LED will be flashing amber.
The I/O functions provided by this module will have been lost if a hot swap partner has not taken over
control. The module can only be restarted by removing it from its slot and re-inserting it.
If an I/O module is inserted into a functional system slot which previously had no active module (e.g.
removing and reinserting as above), then the processor will educate the module once it has booted.
Once educated, the Educated LED will be steady green and the Active LED will be red flashing.
Input modules will now be reading and reporting their inputs. Output modules have not yet energised
their outputs. To activate outputs and to set the module’s Active LED and the processor’s System
Healthy LED steady green, press the processor Reset pushbutton.
Issue 13 Sep 11 PD-T8472 25
Trusted
module is installed. If no standby I/O module is available, the TMR Processor will continue to utilise
TM
Module T8472
5.7. Active and Standby Transfers
The TMR Processor is responsible for managing a pair of I/O modules through an active/standby
changeover. The following rules apply to active/standby changeovers, though the TMR Processor and
ot the I/O module enforce them:
n
• The user must define the primary, and optionally the secondary, I/O module location for each I/O
module pair. Each primary module location must be unique and is defined as part of the complex
equipment definition within the IEC1131 toolset. Secondary module locations can be unique or
shared between multiple secondary modules and are defined within the module’s section within the
System.INI file. The system will automatically determine the secondary module position if the
primary module is installed and is operable.
• On initial start-up, if the primary module is installed, it will become the active module by default. If
the secondary module has been defined within the System.INI file and no primary module is
present, and if the secondary module location is unique, the secondary module will become the
active module by default. In order for a module to become the active module, the TMR Processor
will verify that the module is the correct I/O module type and that both Module Removal switches
are closed. At this point the I/O module is configured and eventually placed in the active state.
• A module in the active state should never be removed.
• If a fault occurs on the active module, the TMR Processor will be informed. Once it becomes
aware of the fault, the TMR Processor will attempt an active/standby changeover.
• An active/standby changeover starts with the TMR Processor checking to see if a standby I/O
the active module and will continue to check for an available standby I/O module. Once a standby
module is found, the TMR Processor will verify that the I/O module is of the correct type, that both
Module Removal switches are closed, and that the I/O module is a part of the correct module pair
by using the SmartSlot link. At this point, the TMR Processor will configure the standby I/O module
with the same configuration information as the currently active I/O module and place the standby
I/O module into the standby state. The active module is then placed in the maintain state (which
suspends field loop testing), and any module specific changeover data is transferred. The
educated light flashes amber before the active/standby changeover takes place, to indicate transfer
of dynamic change over data (COD). The previous standby module then becomes the active
module and the original module becomes standby. If the currently active module does not
successfully complete the self-tests, the TMR Processor will revert it to the standby state, and the
module in the maintain state will revert back to the active state. When both Module Removal
switches are opened on an active module, regardless of the module fault status, the TMR
Processor will treat it as a request to perform an active/standby changeover.
Under normal conditions, an active/standby changeover will only occur if the new active module is
fault-free. Under some circumstances, it is desirable to be able to force a changeover to a known
faulted module. This can be accomplished by opening the Module Removal switches on the currently
active module and pressing the push-button reset on the TMR Processor. This will force the
changeover to proceed even if the new active module is not fault free.
Issue 13 Sep 11 PD-T8472 26
Trusted
TM
Module T8472
6. 120VAC Digital Output Module Specification
System Supply Voltage Range 20 to 32Vdc
ircuit Type Fault tolerant, fully triplicated with quad output
C
switch circuits.
Number of Outputs 16 Channels
Independent Power Groups 2 each of 8 outputs
Operational Output/Field Voltage Range 90 to 150VAC, 47Hz < freq < 63Hz
Output Voltage
Measurement Range 150VAC(RMS)
Maximum Withstanding 175VAC(RMS)
Output Current Rating
Continuous ( Imax per channel )
Continuous ( Imax per power group )
Channel surge
Minimum On State Load Current 10mA
Power Consumption
System Supply (24V)
Field Common Isolation
Sustained Working
Maximum Withstanding
Output Off State Leakage 2mA max at 150VAC
Output On State Switch Voltage Drop 1VAC (RMS) max at 0.5A loading
Output Short Circuit Protection Electronic
Output Turn-on/off Delay 1.5 AC cycle max. (zero crossing)
Channel Monitor Update Every 16 AC cycles
Sequence of Events
Event Resolution
Channel Test Interval 1 minute
Intrinsic Safety External barrier
Operating Temperature
Non-operating Temperature
Temperature change 0.5ºC/min
Operating Humidity 5 – 95% RH non-condensing
Environmental Specifications Refer to document 552517
Dimensions
Height
Width
Depth
Weight 1.342Kg (3lb)
0.5A
4A
8A peak (1 AC cycle)
17W
±250Vdc
±2.5kVdc
1ms
-5°C to 60°C (23°F to 140°F)
-25°C to 70°C (-13°F to 158°F)
266mm (10.5ins)
31mm (1.2ins)
303mm (12ins)
Issue 13 Sep 11 PD-T8472 27
Loading...