products

I/O architectures

The Trusted System has comprehensive internal diagnostics that reveal both covert and overt failures. The hardware implementation of many of the fault tolerance and fault detection mechanisms provides for rapid fault detection for most system elements. Self-test facilities used to diagnose faults within the remainder of the system are defined to provide optimum safety availability. These self-test facilities may require short periods of offline operation to introduce conditions, i.e. alarm or fault test conditions, which effectively result in the point being offline within that redundant channel. Within TMR configurations, this period of offline operation only affects the system’s ability to respond under multiple fault conditions. The Trusted TMR Processors, Interfaces, Expander Interfaces, and Expander Processors are all naturally redundant and have been designed to withstand multiple faults and support a fixed online repair configuration in adjacent slots and therefore require little further consideration. The input and output modules support a number of architecture options, the effects of the chosen architecture should be evaluated against the system and application-specific requirements. FTA modules and other ancillaries are suitable for use as part of Trusted safety system even though they may not explicitly include a TÜV mark.

Trusted high-density I/O The Trusted High-Density I/O modules are either inherently triplicated or dual redundant with comprehensive self-test and diagnosis facilities. Selftests are coordinated so that a majority can be completed, even when there is a demand during the execution of the tests. Discrepancy and deviation monitoring further enhance the verification and fault detection. The TMR Processor tests internal interfaces to the controller. The culmination of these measures results in high levels of fault detection and tolerance, ultimately leading to fail-safe operation if there are multiple fault conditions. The worst case fault detection times on system memory for Trusted Modules are as follows:

In all cases, even in the presence of a fault during this period, the system will continue to be able to respond. Under multiple fault conditions the second fault detection period within the repair time may need to be considered where the system is used in high or continuous demand safety applications. All High-Density I/O modules include line-monitoring facilities; it is recommended that these facilities be enabled for safety-related I/O. For energize to trip I/O these facilities shall be enabled, see Energize to trip configurations on page 42

The system supports a single High-Density TMR I/O module architecture, where it is acceptable to either stop the system or allow the signals corresponding to that module to change to either their default state, or to their active-standby configuration. The first active-standby configuration is to accommodate the active and spare modules in adjacent slot positions; the second is to use the SmartSlot configuration where a single module position may be used as the spare for a number of active modules. All configurations may be used for safety-related applications; the choice between the configurations supporting live online repair is dependent on the end-user’s preference and the number of faulty modules to be repaired simultaneously