Rockwell Automation Trusted TMR User manual

Trusted TMR Analogue Output Module – 40 Channel Product Overview

Rockwell Automation Publication ICSTT-RM284O-EN-P Issue 15 i

Trusted TMR Analogue Output Module – 40

Channel

Product Overview

The Trusted® TMR Analogue Output Module interfaces to 40 field devices. Triplicated

diagnostic tests are performed throughout the Module including measurements for current,

and voltage on each portion of the voted output channel. Tests are also performed for stuck

on and stuck off failures. Fault tolerance is achieved through a Triple Modular Redundant

(TMR) architecture within the Module for each of the 40 output channels.

Automatic line-monitoring of the field device is provided. This feature enables the Module

to detect both open and short circuit failures in field wiring and load devices.

The Module provides on-board Sequence of Events (SOE) reporting with a resolution of 1

ms. An output change of state triggers an SOE entry. Output states are automatically

determined by voltage and current measurements on-board the Module.

This Module is not approved for direct connection to hazardous areas and should be used in

conjunction with Intrinsic Safety Barrier devices.

Features:

• 40 Triple Modular Redundant (TMR) output channels per Module.

• Comprehensive, automatic diagnostics and self-test.

• Automatic line monitoring per point to detect open circuit and short circuit field

wiring and load faults.

• 2500 V impulse withstand opto/galvanic isolation barrier.

• Automatic over-current protection (per channel), no external fuses required.

• On-board Sequence of Events (SOE) reporting with 1 ms resolution.

• Module can be hot-replaced on-line using dedicated Companion (adjacent) Slot or

SmartSlot (one spare slot for many Modules) configurations.

• Front Panel output status Light Emitting Diodes (LEDs) for each point indicate output

status and field wiring faults.

Features: Trusted TMR Analogue Output Module – 40 Channel

ii Issue 15 Rockwell Automation Publication ICSTT-RM284O-EN-P

• Front Panel Module status LEDs indicate Module health and operational mode

(Active, Standby, Educated).

• TϋV Certified for non-interfering applications, refer to the safety manual T8094.

• Outputs are powered in isolated groups of eight. Each such group is a Power Group

(PG).

Trusted TMR Analogue Output Module – 40 Channel PREFACE

Rockwell Automation Publication ICSTT-RM284O-EN-P Issue 15 iii

PREFACE

In no event will Rockwell Automation be responsible or liable for indirect or consequential damages

resulting from the use or application of this equipment. The examples given in this manual are

included solely for illustrative purposes. Because of the many variables and requirements related to

any particular installation, Rockwell Automation does not assume responsibility or reliability for

actual use based on the examples and diagrams.

No patent liability is assumed by Rockwell Automation, with respect to use of information, circuits,

equipment, or software described in this manual.

Allen-Bradley, LISTEN. THINK. SOLVE., Rockwell Automation, TechConnect, and Trusted are

trademarks of Rockwell Automation, Inc.

All trademarks are acknowledged.

DISCLAIMER

It is not intended that the information in this publication covers every possible detail about the

construction, operation, or maintenance of a control system installation. You should also refer to

your own local (or supplied) system safety manual, installation and operator/maintenance manuals.

REVISION AND UPDATING POLICY

This document is based on information available at the time of its publication. The document

contents are subject to change from time to time. The latest versions of the manuals are available at

the Rockwell Automation Literature Library under "Product Information" information "Critical

Process Control & Safety Systems".

TRUSTED RELEASE

This technical manual was updated for Trusted Release 4.0.

LATEST PRODUCT INFORMATION

For the latest information about this product review the Product Notifications and Technical Notes

issued by technical support. Product Notifications and product support are available at the Rockwell

Automation Support Centre at

http://rockwellautomation.custhelp.com

At the Search Knowledgebase tab select the option "By Product" then scroll down and select the

Trusted product.

Some of the Answer ID’s in the Knowledge Base require a TechConnect℠ Support Contract. For more

information about TechConnect Support Contract Access Level and Features, click on the following

link:

https://rockwellautomation.custhelp.com/app/answers/detail/a_id/50871

This will get you to the login page where you must enter your login details.

PREFACE Trusted TMR Analogue Output Module – 40 Channel

iv Issue 15 Rockwell Automation Publication ICSTT-RM284O-EN-P

IMPORTANT

A login is required to access the link. If you do not have an account then you can create one

using the "Sign Up" link at the top right of the web page.

DOCUMENTATION FEEDBACK

Your comments help us to write better user documentation. If you discover an error, or have a

suggestion on how to make this publication better, send your comment to our technical support

group at http://rockwellautomation.custhelp.com

Trusted TMR Analogue Output Module – 40 Channel PREFACE

Rockwell Automation Publication ICSTT-RM284O-EN-P Issue 15 v

SCOPE

This manual specifies the maintenance requirements and describes the procedures to assist

troubleshooting and maintenance of a Trusted system.

WHO SHOULD USE THIS MANUAL

This manual is for plant maintenance personnel who are experienced in the operation and

maintenance of electronic equipment and are trained to work with safety systems.

SYMBOLS

In this manual we will use these notices to tell you about safety considerations.

SHOCK HAZARD: Identifies an electrical shock hazard. If a warning label is fitted, it

can be on or inside the equipment.

WARNING: Identifies information about practices or circumstances that can cause

an explosion in a hazardous environment, which can cause injury or death,

property damage or economic loss.

ATTENTION: Identifies information about practices or circumstances that can cause

injury or death.

CAUTION: Identifies information about practices or circumstances that can cause

property damage or economic loss.

BURN HAZARD: Identifies where a surface can reach dangerous temperatures. If a

warning label is fitted, it can be on or inside the equipment.

This symbol identifies items which must be thought about and put in place when

designing and assembling a Trusted controller for use in a Safety Instrumented

Function (SIF). It appears extensively in the Trusted Safety Manual.

IMPORTANT Identifies information that is critical for successful application and understanding of

the product.

NOTE Provides key information about the product or service.

TIP Tips give helpful information about using or setting up the equipment.

PREFACE Trusted TMR Analogue Output Module – 40 Channel

vi Issue 15 Rockwell Automation Publication ICSTT-RM284O-EN-P

WARNINGS AND CAUTIONS

WARNING: EXPLOSION RISK

Do not connect or disconnect equipment while the circuit is live or unless the area is

known to be free of ignitable concentrations or equivalent

AVERTISSEMENT - RISQUE D’EXPLOSION

Ne pas connecter ou déconnecter l’équipement alors qu’il est sous tension, sauf si

l’environnement est exempt de concentrations inflammables ou équivalente

MAINTENANCE

Maintenance must be carried out only by qualified personnel. Failure to follow these

instructions may result in personal injury.

CAUTION: RADIO FREQUENCY INTERFERENCE

Most electronic equipment is influenced by Radio Frequency Interference. Caution

should be exercised with regard to the use of portable communications equipment

around such equipment. Signs should be posted in the vicinity of the equipment

cautioning against the use of portable communications equipment.

CAUTION:

The module PCBs contain static sensitive components. Static handling precautions

must be observed. DO NOT touch exposed connector pins or attempt to dismantle a

module.

Trusted TMR Analogue Output Module – 40 Channel PREFACE

Rockwell Automation Publication ICSTT-RM284O-EN-P Issue 15 vii

ISSUE RECORD

Issue Date Comments

7 Aug 05 Format /Text editing

8 Dec 06 Weights & Dims

9 Jul 07 Certification

10 Sep 07 Specification

11 Nov 07 STATE descriptions

12 Feb 08 Channel LED colours

13 Apr 10 Rack 7 table minor change

14 Jun 16 Rebranded and reformatted with correction to Relative Humidity Range

and Operating Temperature statements in the Specification Section, also

correction of any typographical errors

15 Jan 19 Updated Specifications section and main text to a more consistent

format.

Updated Front Panel section to updated product design.

Updated to display Rockwell Automation publication numbers.

Added trademarks statement.

PREFACE Trusted TMR Analogue Output Module – 40 Channel

viii Issue 15 Rockwell Automation Publication ICSTT-RM284O-EN-P

Page intentionally left blank

Trusted TMR Analogue Output Module – 40 Channel Table of Contents

Rockwell Automation Publication ICSTT-RM284O-EN-P Issue 15 1

Table of Contents

1. Description ............................................................................................................ 3

1.1. Output Field Termination Unit (OFTU)....................................................................................... 5

1.2. Analogue Output Field Interface Unit (AOFIU) .......................................................................... 5

1.3. Host Interface Unit (HIU) ........................................................................................................... 5

1.4. Front Panel Unit (FPU) ............................................................................................................... 6

1.5. Line Monitoring and Output States ........................................................................................... 7

1.6. Housekeeping ............................................................................................................................. 7

1.7. Fault Detection/Testing ............................................................................................................. 7

1.8. Sequence of Events Characteristics ........................................................................................... 8

1.9. Output Driver Structure ............................................................................................................. 8

1.9.1. Output Channel Diagnostics ............................................................................................. 10

1.9.2. Group Fail Safe Switches .................................................................................................. 11

2. Installation .......................................................................................................... 13

2.1. Module Insertion and Removal ................................................................................................ 13

2.2. Cable Selection ......................................................................................................................... 13

2.3. Termination .............................................................................................................................. 14

2.4. Module Pin-out Connections ................................................................................................... 14

2.5. Trusted Module Polarisation/Keying. ...................................................................................... 16

3. Application .......................................................................................................... 17

3.1. Module Configuration .............................................................................................................. 17

3.2. T8480 Complex Equipment Definition ..................................................................................... 17

3.2.1. Rack 1: AO......................................................................................................................... 18

3.2.2. Rack 2: State ..................................................................................................................... 19

3.2.3. Rack 3: AI ..........................................................................................................................

20

3.2.4. Rack 4: CI .......................................................................................................................... 20

3.2.5. Rack 5: LINE_FLT ............................................................................................................... 21

3.2.6. Rack 6: DISCREP ................................................................................................................ 21

3.2.7. Rack 7: HKEEPING ............................................................................................................. 22

3.2.8. Rack 8: INFO ..................................................................................................................... 24

3.3. Sequence of Events Configuration ........................................................................................... 26

3.4. System.INI File Configuration ................................................................................................... 26

4. Operation ............................................................................................................ 27

4.1. Front Panel ............................................................................................................................... 27

4.2. Module Status LEDs.................................................................................................................. 28

4.3. I/O Status LEDs ......................................................................................................................... 29

Table of Contents Trusted TMR Analogue Output Module – 40 Channel

2 Issue 15 Rockwell Automation Publication ICSTT-RM284O-EN-P

5. Fault Finding and Maintenance ............................................................................. 31

5.1. Fault Reporting ......................................................................................................................... 31

5.2. Field Wiring Faults .................................................................................................................... 31

5.3. Module Faults .......................................................................................................................... 31

5.4. Companion Slot ........................................................................................................................ 32

5.5. SmartSlot .................................................................................................................................. 32

5.6. Cold Start .................................................................................................................................. 32

5.7. Transfer between Active and Standby Modules ...................................................................... 33

6. Specifications ....................................................................................................... 35

Trusted TMR Analogue Output Module – 40 Channel 1. Description

Rockwell Automation Publication ICSTT-RM284O-EN-P Issue 15 3

1. Description

The TMR 4-20 mA Analogue Output Module is a member of the Trusted range of

Input/Output (I/O) Modules. All Trusted I/O Modules share common functionality and form.

At the most general level, all I/O Modules interface to the Inter-Module Bus (IMB) which

provides power and allows communication with the TMR Processor. In addition, all Modules

have a field interface that is used to connect to Module specific signals in the field. All

Modules are Triple Modular Redundant (TMR).

Figure 1 Module Architecture

All High Integrity I/O Modules are made up of 4 sections: Host Interface Unit (HIU), the Field

Interface Unit (FIU), the Field Termination Unit (FTU), and the Front Panel Unit (or FPU).

1. Description Trusted TMR Analogue Output Module – 40 Channel

4 Issue 15 Rockwell Automation Publication ICSTT-RM284O-EN-P

Figure 2 shows a simplified block diagram of the Trusted 24 Vdc Analogue Output Module.

Figure 2 Functional Block Diagram

HIU

OFIA

&

A/Ds

SIGNAL

ISOLATION

OFIU_LV

FIA

&

A/Ds

SIGNAL

ISOLATION

OFIU_LV

FIA

&

A/Ds

SIGNAL

ISOLATION

OFIU_LV

GFSS

V

FIELD

LOADS

PWR

ISOL

PWR

ISOL

PWR

ISOL

Output

Termination

V

FIELD RET

0 V

F

S

D

F

S

D

F

S

D

A

B

C

OFTU_LV

Trusted TMR Analogue Output Module – 40 Channel 1. Description

Rockwell Automation Publication ICSTT-RM284O-EN-P Issue 15 5

1.1. Output Field Termination Unit (OFTU)

The Output Field Termination Unit (OFTU) is the section of the I/O Module that connects all

three AOFIUs to a single field interface. The OFTU provides the Group Fail Safe Switches and

passive components necessary for signal conditioning, over-voltage protection, and EMI/RFI

filtering. When installed in a Trusted Controller or Expander Chassis, the OFTU field

connector interconnects to the Field I/O Cable Assembly attached at the rear of the Chassis.

The OFTU receives regulated power and drive signals from the HIU and provides

magnetically isolated power to each of the three AOFIU’s.

The SmartSlot link is passed from the HIU to the field connections via the OFTU. These

signals go directly to the field connector and maintain isolation from the I/O signals on the

OFTU. The SmartSlot link is the intelligent connection between Active and Standby Modules

for co-ordination during Module replacement.

1.2. Analogue Output Field Interface Unit (AOFIU)

The Analogue Output Field Interface Unit (AOFIU) is the section of the Module that contains

the specific circuits necessary to interface to the field I/O signals. Each Module has three

AOFIUs, one per slice. For the TMR 24 Vdc Analogue Output Module, the AOFIU contains

one slice of the output driver circuit, for each of the 40 field outputs.

The AOFIU receives isolated power from the OFTU for logic. The AOFIU provides additional

power conditioning for the operational voltages required by the AOFIU circuitry. An isolated

6.25 Mbit/sec serial link connects each AOFIU to one of the HIU slices.

The AOFIU also measures a range of on-board “housekeeping” signals that assist in

monitoring the performance and operating conditions of the Module. These signals include

power supply voltages, current consumption, on-board reference voltages, and board

temperature.

1.3. Host Interface Unit (HIU)

The HIU is the point of access to the Inter-Module Bus (IMB) for the Module. It also provides

power distribution and local programmable processing power. The HIU is the only section of

the I/O Module to directly connect to the IMB Backplane. The HIU is common to most high

integrity I/O types and has type dependent and product range common functions. Each HIU

contains three independent slices, commonly referred to as A, B, and C.

All interconnections between the three slices incorporate isolation to help prevent any fault

interaction between the slices. Each slice is considered a Fault Containment Region (FCR), as

a fault on one slice has no effect on the operation of the other slices.

1. Description Trusted TMR Analogue Output Module – 40 Channel

6 Issue 15 Rockwell Automation Publication ICSTT-RM284O-EN-P

The HIU provides the following services common to the Modules in the family:

• High Speed Fault Tolerant Communications with the TMR Processor via the IMB

interface.

• FCR Interconnect Bus between slices to vote incoming IMB data and distribute

outgoing I/O Module data to IMB.

• Galvanically isolated serial data interface to the FIU slices.

• Redundant power sharing of dual 24 Vdc chassis supply voltage and power

regulation for logic power to HIU circuitry.

• Magnetically isolated power to the HIU slices.

• Serial data interface to the FPU for Module status LEDs.

• SmartSlot link between Active and Standby Modules for co-ordination during

Module replacement.

• Digital Signal Processing to perform local data reduction and self-diagnostics.

• Local memory resources for storing Module operation, configuration, and field I/O

data.

• On-board housekeeping, which monitors reference voltages, current consumption

and board temperature.

1.4. Front Panel Unit (FPU)

The Front Panel Unit (FPU) contains the necessary connectors, switches, logic, and LED

indicators for the Front Panel. For every type of Trusted I/O Module, the FPU contains the

Slice Healthy, Active/Standby and Educated indicators (LEDs), also the Module removal

switches. Additional bi-colour LEDs provide status indication for the individual I/O signals.

Serial data interfaces connect the FPU to each of the HIU slices to control the LED status

indicators and monitor the Module removal switches.

Trusted TMR Analogue Output Module – 40 Channel 1. Description

Rockwell Automation Publication ICSTT-RM284O-EN-P Issue 15 7

1.5. Line Monitoring and Output States

The Module automatically monitors the output channel current and voltage to determine

the state of the output channel. The numerical output state and line fault status are

reported back to the application and are represented below.

Description

Numerical

Output State

Line Fault

Status

Field Short Circuit

(Not presently supported)

N/A N/A

Output Energised (On) 4 0

No Load, Field Open Circuit

(Vload > 16.5 V)

3 1

Output De-energised

(command < -1024)

2 0

No Field Supply Voltage

(Vfield < 18 V)

1 1

Table 1 Line Monitoring Fault Status

1.6. Housekeeping

The Output Module automatically performs local measurements of several on-board signals

that can be used for detailed troubleshooting and verification of Module operating

characteristics. Measurements are made within each slice’s HIU and FIU.

1.7. Fault Detection/Testing

Extensive diagnostics provide the automatic detection of Module faults. The TMR

architecture of the Output Module and the diagnostics performed verify the validity of all

critical circuits. Using the TMR architecture provides a Fault Tolerant method to withstand

the first fault occurrence on the Module and continue normal output controls without

interruption in the system or process. Faults are reported to the user through the Healthy

status indicators on the Front Panel of the Module and through the information reported to

the TMR Processor. Under normal operations all three Healthy indicators are green. When a

fault occurs, one of the Healthy indicators will be flashing red. It is recommended that this

condition is investigated and if the cause is within the Module, it should be replaced.

1. Description Trusted TMR Analogue Output Module – 40 Channel

8 Issue 15 Rockwell Automation Publication ICSTT-RM284O-EN-P

Module replacement activities depend on the type of spare Module configuration chosen

when the system was configured and installed. The Module may be configured with a

dedicated Companion Slot or with a SmartSlot for a spare replacement Module.

From the IMB to the field connector, the I/O Module contains extensive fault detection and

integrity testing. As an output device, most testing is performed in a non-interfering mode.

Data input from the IMB is stored in redundant error-detecting Random Access Memory

(RAM) on each slice portion of the HIU. Received data is voted on by each slice. All data

transmissions include a confirmation response from the receiver.

Periodically, the TMR Processor commands the on-board Digital Signal Processors (DSPs) to

perform a Safety Layer Test (SLT). The SLT results in the DSP verifying with the TMR

Processor its ability to process data with integrity. In addition, the DSP uses Cyclical

Redundancy Checks (CRCs) to verify the variables and configuration stored in Flash memory.

Between the HIU and AOFIU are a series of galvanically isolated links for data and power.

The data link is synchronized and monitored for variance. Both AOFIU and HIU have on-

board temperature sensors to characterize temperature-related problems.

The power supplies for both the HIU and AOFIU boards are redundant, fully instrumented

and testable. Together these assemblies form a Power Integrity Sub-system.

1.8. Sequence of Events Characteristics

The Module automatically measures the field voltage and current to determine the state of

each output channel. An event occurs when the output transitions from one state to

another. When a channel changes state, the on-board timer value is recorded. When the

TMR Processor next reads data from the Output Module, the channel state and real-time

clock value are retrieved. The TMR Processor uses this data to log the state change into the

system Sequence of Events (SOE) log. The user may configure each output to be included in

the system SOE log. Full details of SOE are contained in Trusted Sequence of Events and

Process Historian Package, publication ICSTT-RM243 (PD-T8013).

1.9. Output Driver Structure

The Analogue Output Module provides a TMR driver topology where the load is driven by a

total of three fully monitored, fail safe (6 element) driver channels, one physically resident

on each AOFIU in the Module. Any single driver or entire slice failure is designed to leave

two of the three fail safe driver channels operational to supply regulated current to the

load.

Trusted TMR Analogue Output Module – 40 Channel 1. Description

Rockwell Automation Publication ICSTT-RM284O-EN-P Issue 15 9

Figure 3 Output Driver Structure

The upper transistors shown in Figure 3 operate in the linear mode, and are controlled by

the AOFIU on which they are physically resident.

1

The lower switches are N.C. (Normally

Closed), and are controlled by the “upstream” neighbouring AOFIU.

2

Note: In this context, N.O. is defined as being in the off state in the absence of control signal power, and

similarly, N.C. is the on state in the absence of control signal power. These switches are constructed

from enhancement mode MOSFETs and are both guaranteed to be off in the absence of Module power

to create gate voltage signals to bias them on

3

(unlike electromechanical relays for example).

The reason that the lower switches are specified to be on in the absence of control signal

power is to allow two channels to power the load should an entire slice fail. Even if an entire

slice fails, the surviving output circuits will carry the necessary control.

1

Their “home” AOFIU.

2

The home AOFIU, supplies an independent control signal for the “downstream” AOFIU GFSS.

3

For an un-faulted transistor.

TOP_RAIL

PRM_A PRM_CPRM_B

ENABLE_C ENABLE_A ENABLE_B

LOAD

I

LOAD_A

I

LOAD_B

I

LOAD_C

I

LOAD

= I

LOAD_A

+ I

LOAD_B

+ I

LOAD_C

V

FIELD_RTN

R

SENSE_A

R

SENSE_C

R

SENSE_B

V

LOAD

1. Description Trusted TMR Analogue Output Module – 40 Channel

10 Issue 15 Rockwell Automation Publication ICSTT-RM284O-EN-P

The structure of each OFIU output driver is shown below:

Figure 4 Simplified Driver Circuit Diagram

A sense resistor provides a means of continuously monitoring the output current, as

measured with an analogue to digital converter (ADC) channel. Closed loop control logic in

the Field Programmable Gate Array (FPGA) provides a Pulse-Ratio-Modulated drive signal to

the gate of FET 1 to maintain a constant current equal to the commanded output, based on

the ADC feedback.

A level translator transistor is used to drive the gate of FET 2. It provides FET 2 with a

negative gate voltage, to minimize its on resistance, and serves to hold FET 2 on in the event

that the secondary gate control loses power.

1.9.1. Output Channel Diagnostics

The measured output channel current is continuously monitored relative to the commanded

output current, and compared to the current reported from each independent slice. In the

event that there is a discrepancy that falls outside the authority of the control loop to

overcome, then remedial action is engaged which disables FET 2 for the affected slice and

causes the surviving slices to compensate in order to maintain the commanded current to

the load.

The voltage across the load is also measured by each slice, and continuously compared for

equality. If there is a discrepancy between the slices, then the discrepant slice is removed

from service, and the survivors compensate to maintain the commanded current to the

load.

UPSTREAM

ENABLE

R

S

LOAD

ADC

PRM

5V

24V

V

FIELD

OPTO

COMMAND

POWER

OPTO

RESPONSE

FPGA

GFSS

DOWNSTREAM

ENABLE

C

F

R

F

FROM

HIU

FROM UPSTREAM

SLICE

I

LOAD

I

FET

I

VSENSE

TOP_RAIL

FET 1

FET 2

Trusted TMR Analogue Output Module – 40 Channel 1. Description

Rockwell Automation Publication ICSTT-RM284O-EN-P Issue 15 11

Each channel is continuously monitored to determine the presence of field faults, such as an

open circuit, or lack of field loop power.

Note that short circuits are not considered to be a fault condition for an analogue current

output channel such as provided by this Module. The Module is designed to drive 20 mA

indefinitely into 0 ohms. The channel voltages are provided to the application, where such a

fault determination may be made if it is required.

1.9.2. Group Fail Safe Switches

To support safe operation, the Output Module is equipped with a series of switches that

provide source power to a group of 8 output channels, a Power Group. The Output Module

Group Fail Safe Switch (GFSS) is intended as a final control switch which can de-energise any

outputs that cannot be de-energised in the normal way. For safety, the presence of two or

more faults within the Output Module will cause the Group Fail Safe Switches to de-

energise, resulting in all of the outputs in its group de-energising.

There are three switches in parallel, which comprise the GFSS, one associated with each

'slice' of the power group. The GFSS’ are controlled via a signal from one of the other two

neighbouring slices. This means that if one slice determines from the output states that an

output is not in a de-energised state when it should be, then it can command its own GFSS

and those of the other slices GFSS to de-energise. This results in two of the three elements

of the GFSS structure de-energising, leaving only one GFSS element energised. If two slices

do the same thing then the last GFSS output will de-energise. For example, this would occur

if two or more output switch elements fail in a 'stuck-on' state such that the output cannot

de-energise.

The GFSS control signal is generated by a charge pump driven from the comms clock to the

slice power group. If the clock fails then the GFSS bias collapses. This means that even if the

ability of the slice to communicate with a power group is lost, the GFSS can still be de-

energised by stopping the comms clock. If a slice fails, the watchdog on the HIU will time out

and reset the slice, this will shutdown the OFIU power supply and the associated GFSS

control signal will also de-energise.

1. Description Trusted TMR Analogue Output Module – 40 Channel

12 Issue 15 Rockwell Automation Publication ICSTT-RM284O-EN-P

Page intentionally left blank

Page is loading ...

Rockwell Automation Trusted TMR User manual

Rockwell Automation Trusted TMR User manual

Related papers

Other documents