Chapter 2
Description
14
Rockwell Automation Publication ICSTT-RM451D-EN-P - March 2021
Periodically, the TMR Processor commands the onboard Digital Signal
Processors (DSPs) to perform a Safety Layer Test (SLT). The SLT results in the
DSP verifying with the TMR Processor its ability to process data with
integrity. In addition, the DSP uses Cyclical Redundancy Checks (CRC) to
verify the variables and configuration stored in Flash memory.
Between the HIU and FIU are a series of galvanically isolated links for data
and power. The data link is synchronized and monitored for variance. Both
FIU and HIU have onboard temperature sensors to characterize temperature-
related problems.
The power supplies for both the HIU and FIU boards are redundant, fully
instrumented and testable. Together these assemblies form a Power Integrity
Subsystem.
The Module automatically measures the field voltage and current to
determine the state of each output channel. An event occurs when the output
transitions from one state to another. When a channel changes state, the
onboard timer value is recorded. When the TMR Processor next reads data
from the Output Module, the channel state and real-time clock value are
retrieved. The TMR Processor uses this data to log the state change into the
system Sequence of Events (SOE) log. The user may configure each output to
be included in the system SOE log. Full details of SOE are contained in
Trusted Sequence of Events and Process Historian Package Product
Description, publication
The Digital Output Module provides a TMR switch topology where the load is
driven by a total of three fully monitored, fail-safe (6 element) switch
channels, one physically resident on each FIU in the Module. Any single
switch or entire slice failure is designed to leave two of the three fail-safe
switch channels operational to power the load.
Figure 3: Output Switch Structure
Sequence of Events
Characteristics
Output Switch Structure
